GMail Vulnerable To Contact List Hijacking

Anonymous Coward writes "By simply logging in to GMail and visiting a website, a malicious website can steal your contact list, and all their details. The problem occurs because Google stores the contact list data in a Javascript file. So far the attack only works on Firefox, and doesn't appear to work in Opera or Internet explorer 7. IE6 was un-tested as of now."

Phew!

[sorrill]

We are lucky it was not Microsoft's Hotmail!

Thank goodness

[messner_007]

Thank goodness. I was beginning to think that no one cared about my contacts.

Re:Why do I bother with this site?

[Headcase88]

I could do nice armchair job at Slashdot.

Not with that sentence structure. You only made one grammar error. You could never be a /. editor.

Wow!

[repruhsent]

I'm glad that I run Firefox on Linux!

Oh wait...

Re:Submitter has a problem with Firefox?

[islanduniverse]

I'm glad I've switched back to IE7!

Re:Submitter has a problem with Firefox?

[MobileTatsu-NJG]

"Does the submitter have some agenda against Firefox?"

Nah, it was just a gag to get ppl to RTFA.

GMail is beta

[asCii88]

You shouldn't be suprised... as you all know GMail is still in beta.

Re:Works in most any java-script browser

[thopkins]

Most users on Slashdot won't click any links, especially links for the articles on which they are about to comment. ;)

Re:Which is the problem?

[Anonymous Coward]

Uhhh... you should be thanking these "bozos" for releasing the exploit so it can be fixed, tough-programmer-guy. If your programmer friends are such l337 d00ds then maybe they'd find and fix some of these exploits themselves, instead of being blindly vulnerable until some "bozos" save their ass. BTW, what does being a programmer have to do with being able to "retaliate" against some obviously much smarter programmers? Gonna send them some code? Gonna do a double compile on their bitch asses?

Why dont you ask your l337 h@X0r buddies to just look at the code. Then you'd see how the vulnerability works, and what information it can retrieve. Though I dont know if the code will look right when they try to open it in VB.