Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gmail Messages Are Vulnerable To Interception

Posted by timothy on from the top-men-are-working-on-it-top-men dept.

Michael Wally writes "GMail messages are vulnerable to interception. An attacker has only to transmit malformed test messages to himself, and information left over in memory, from previous messages destined for other people, will appear with the test messages, in the attacker's inbox. Sometimes, this information may include usernames and passwords... Do you use GMail? Are your communications private? Should they be? Well, here's what we figured out about the issue, that may or may not help you - or perhaps GMail, if anyone can get ahold of their developers, to tell them about it." Update: 01/12 22:21 GMT by T : Good news for Gmail users; those malformed messages are no longer being accepted; read below for a message from Chris DiBona.

chrisd writes "Just so you know, at 10:15am PST mails with the problematic formatting as described in your previous story stopped being accepted into Gmail. Previous emails that had this problem will also no longer will be accessible. If you don't mind, I'd like to take the time to remind Slashdot readers that they can send bugs that may have a security aspect into security@google.com. If they like, they should feel free to cc me at cdibona@google.com. We appreciate your patience and we're sorry about the bug."

6 of 460 comments (clear)

  1. Crap by Quasar1999 · · Score: 0, Offtopic

    What's the point... I can't get other people's GMAIL account/password info without already having a GMAIL account in the first place... And everyone knows, the goal is to get yourself a GMAIL account if you don't already have one... ;)

    --

    ---
    Programming is like sex... Make one mistake and support it the rest of your life.
    1. Re:Crap by dolo666 · · Score: 0, Offtopic

      I've marked you as a friend previously. Email me and I'll send you an invite if you don't already have one! Although at this point I will have to stipulate that I take no responsibility for you using the system as a condition of you accepting my invite.

  2. Communicating by drewzhrodague · · Score: 0, Offtopic

    It is difficult to communicate with a person at Google -- Hay, Google, Hire me, I'm interested in working there.

    --
    Zhrodague.net - I do projects and stuff too.
  3. Re:Gmail Inivation Emails here by Q-Branch · · Score: 0, Offtopic

    would love a gmail invite if anyone is feeling so generous. Thanks in advance. jumbotech@yahoo.com

  4. Don't wait 'till stable! by Tribbin · · Score: 0, Offtopic

    Because all good addresses will be taken by then!

    I made sure I got my tribbin@gmail.com.

    --
    If you mod this up, your slashdot background will turn into a beautiful sunset!
  5. Re:Gmail Inivation Emails here by theguywhosaid · · Score: 0, Offtopic

    ive got some i want to get rid of too.