Slashdot Mirror
Gmail Messages Are Vulnerable To Interception
Michael Wally writes "GMail messages are vulnerable to interception. An attacker has only to transmit malformed test messages to himself, and information left over in memory, from previous messages destined for other people, will appear with the test messages, in the attacker's inbox. Sometimes, this information may include usernames and passwords... Do you use GMail? Are your communications private? Should they be? Well, here's what we figured out about the issue, that may or may not help you - or perhaps GMail, if anyone can get ahold of their developers, to tell them about it." Update: 01/12 22:21 GMT by T : Good news for Gmail users; those malformed messages are no longer being accepted; read below for a message from Chris DiBona.
chrisd writes "Just so you know, at 10:15am PST mails with the problematic formatting as described in your previous story stopped being accepted into Gmail. Previous emails that had this problem will also no longer will be accessible. If you don't mind, I'd like to take the time to remind Slashdot readers that they can send bugs that may have a security aspect into security@google.com. If they like, they should feel free to cc me at cdibona@google.com. We appreciate your patience and we're sorry about the bug."
Google will work out the kinks, they always do.
Electrons are free; it is moving them that becomes expensive.
Oh, sure, it means ready to be shipped/used in production by some companies, but has that line gotten to fuzzy for some people?
"that's not a feature, that's a bug"
A feeling of having made the same mistake before: Deja Foobar
Yeah, it's a potential privacy breach. That said, using a web-based email system for top secret or potentially embarassing mail is pretty dumb. You get what you pay for, gmail is no different. (nb: I'm a happy gmail user)
Trolling is a art,
This is just a shot in the dark, but I'm willing to bet Google left Security off the list on purpose. a security flaw becomes a lot harder to exploit if the general public does not know it is there.
I don't hold this against Google at all. I'm glad they are not telling the world how to break into my account...
Speaking loudly in a public place can be intercepted!
Although this appears to be a valid bug in GMail (that is still beta mind you, and will probably be fixed very quickly), who in the world considers plain text communication secure?
I have no idea who at my ISP has root access (or others that can gain root access) to read my plaintext mailbox.
Nothing to see here... please move along.
From the description, the way you can read messages of other people has nothing to do with 'intercepting' messages. Man in the middle attacks are always possible, but this looks like a simple serverside bug (buffer overflow or string formatting problem, most likely) which will probably be fixed on short notice.
;)
I don't think you can do directed attacks either (e.g. 'intercept' only the mail of a specific target). So I think it's not a real showstopper.
Still, it shows that even Google can make mistakes in their code...who would have thought!
Every expression is true, for a given value of 'true'
I'm not even sure how this bug could exist in any normal computing system.
It happens the same way that many (most?) bugs happen -- the human programmer forgot to check for boundary conditions in the data interpretation. As the old saying goes, "garbage in, garbage out" -- if you don't validate your data, you may be surprised at the results you'll get. Here the result is that it's exposing someone else's message to you. But it's not that surprising.
These things usually boil down to human error and incorrect assumptions. Nothing new here.
EricWhy is William Shatner on my box of All-Bran?
Serious as it may be, this does not allow you to selectively attack a specific person or account - you just have to "hope for the best", so to speak. While I wouldn't underrate it (is that a word?), I wouldn't overrate it, either, and I'm pretty sure that the Google people will plug this in no time. It's been my experience that they do look at reports that are coming in (just like they claim), and that they are generally quite quick to fix even minor issues, so something that is security-related *and* (by the sounds of it) easily fixable shouldn't last long.
:)
That being said, did the authors actually contact Google about this prior to making the whole thing public? Full disclosure is good, of course, but it's also nice to give the vendor a chance to fix things before you inform every script kiddie in the world about what you found.
quidquid latine dictum sit altum videtur.
What do you mean, "I'm not even sure how this bug could exist in any normal computing system"? Buffer overruns are everywhere. Although the classic buffer overrun involves getting the app to write beyond the buffer's bounds and into the stack, this one is getting it to read beyond the point that it should. Unless the system has memory protection built in (and that is only possible on very recent processors) then this is entirely unsurprising. "Some kind of hybrid"? You're not making sense.
To everyone expressing concern about using gmail in light of this exploit - I hope you know that all email is vulnerable to interception. It is sent as plaintext across the internet, and hops though a dozen servers before ending up at it's final destination. This exploit is just another way to do something that has been possible by design ever since email was created.
If you want your email to be secure you have to encrypt it. Otherwise don't have any expectation for privacy.
Why is everyone brushing this off by saying "well you should have known that email isnt secure, tough luck!"
:)
If Hotmail had this bug, everyone here would be up in arms.
Just because email isnt secure doesnt mean this isn't serious. I would hate to think of all the people reading my responses to craigslist postings
I don't really see what difference the general public makes. The general public isn't interested in exploiting security flaws, even if there is a pre-rolled application which makes it easy, because the general public isn't script kiddies.
If one bad guy who can write a script for the script kiddies finds out about this, then the general public is at risk, even if he never releases that script. The general public is never going to find security flaws on their own, because they aren't looking. The bad guys, on the other hand, are definitely going to be looking.
If some good guy finds out about this kind of thing, I'd say that means that the bad guys either already found out, or will soon. I think that the best thing that hypothetical good guy can do for me is publish the details fast, so the google people have to get cracking and fix it, and so I know that my messages are not private.
How would waiting until the bad guys to release an exploit to the script kiddies before you tell the world help me? It wouldn't!
See what I've been reading.
You did notify Google and give them a reasonable period to time in which to respond, right? Because you've just shouted, in the loudest possible way, how to access all that data you're so worried about protecting.
Canthros
Chances are, since most email these days are spam, an attacker is going to have to go through a lot of spam before finding something interesting.
-bk
Many other people have pointed out that GMail is still in beta, and that if they would have told Google first it probably would have gotten quietly fixed without any damage being done.
Of course, they acknowledge that, but they're arguing that they're helping protect people by making them aware of the problem.
I call bullshit. This is about them wanting recognition for finding the bug. If they would have sent it to Google, it would have been fixed and no one would care who discovered it. Because they went public with it they can boast that they were the ones who found the bug.
Of course, it swings both ways. Now if someone uses this exploit and steals your password (which is honestly rather unlikely), you know who to blame for making it public knowledge before Google had the chance to fix it.
It doesn't matter what colour hat you classify them as, or whether you personally are glad that you know gmail is insecure - and you are also somehow happy that every script kiddie now knows how to attack your account.
There is no excuse whatsoever for releasing something like this to the public, especially without notifying the service and giving a long enough period for them to fix it (IMO even going public then doesn't achieve anything). All that this achieves is self-glorification for the people finding the exploits, they even go as far to ask for jobs at google in this case. If people could stop thinking about getting their name attached to an exploit, and thinking about the benefits for all users of the service/software affected, we'd have a lot less scripts floating around for the script kiddies to click and run.
Jesus - am I the only one to recognize this bug?
This is just the most publicly seen instance but broken XML does this every single day.
Use the greater than and less than signs as data delimiters in the 'next generation' of data encoding (XML)? WTF were they thinking?
I'm not 100% they are using true XML but from the looks of it if they aren't they are using a home-built XML wanna-be and - well it looks like I was right a few years ago when I (unsuccessfully) campaigned against doing it that way. Not that I campaigned very loud, as I am basically a nobody.
Glonoinha the MebiByte Slayer
For these people to find a single issue in such a system, then say it's a shortcoming of gmail's QA process, and in the same breath ask for work - implying they've got the skills to even handle such a job - is insulting. Please, just because you're smart enough to expose a flaw once you stumbled onto it in no way means you are qualified to correct that or any other issue. Sometimes our QA team finds a flaw and even digs in the logs enough to pinpoint the problem but it can still take the developer who designed the code days to correct.
In other words, noticing that you're bleeding does not qualify you as a surgeon. Instead of publishing their finidings in a detailed how-to, these asshats should have forwarded the info to gmail and let them deal with it, and that's assuming that the gmail team didn't already have it in their list of bugs. I just don't understand why people feel the need to not only describe a security problem, but give every hacker on the net a roadmap as to just exactly how to use it and what illicit activity it might be good for.
-- I'm not a pessimist, I'm a realist. It's not my fault that life sucks so much. --
one cookie in one browser, no wonder your system showed the same data.
Long Term Capital Managment had Nobel Prize winners doing their risk management and look where that ended, a nice multi-billion dollar tax-payer funded bail-out:
LTCM, a hedge fund above suspicion
Wikipedia entry
People are always saying that, but it just isn't true. Relying only on obscurity for security is probably a bad idea, but as part of a complete security solution, it can be very helpful.
People will not successfully exploit a vulnerability they do not know about, or attack a system they do not know is there. Even if some fraction of people are in the know, you've reduced your potential attacker count by the fraction of them who are not in the know.
When all you have is a hammer, everything looks like a skull.
lots of comments here are noting the hubris of these guys in asking for jobs.
I'd just like to add that not only are they criticizing the company's QA process and releasing the bug without having notified google first, as others pointed out...
They found the exploit by MISTAKE! It was a bug in their own code that caused the problem, something as stupid as a missing caret at the end of a line. So, in other words, they are looking for work looking for bugs in Google's software that they found solely because of a bug in the software they wrote.
On another note, bugs in software happen, no matter WHO you are, the trick is just to be able to fix them in a timely fashion and deal with the situation effectively. I believe that Google will do this, especially if the previous comment stating that it has been patched is true. Everyone is making too big a deal out of something that has happened to every developer on every software ever. The reason MS gets crap for it is simply because they continuously produce buggy code ridden with security issues, but deny this is the case, and often ignore security problems until they are found out by the general public.
-Jay
I haven't been able to receive any gmails for a half hour or so... maybe they've disabled incoming messages until they've sorted this all out?
XML never does this. XML parsers, upon finding a problem must stop parsing and throw a fatal error. It's in the specification.
Instead of mindlessly knee-jerking because you don't like XML, try reading the article. The greater-than symbol that causes problems is the delimiter for the email address - syntax that goes back to 1982's RFC 822 - long before XML's time.