Gmail Messages Are Vulnerable To Interception

Michael Wally writes "GMail messages are vulnerable to interception. An attacker has only to transmit malformed test messages to himself, and information left over in memory, from previous messages destined for other people, will appear with the test messages, in the attacker's inbox. Sometimes, this information may include usernames and passwords... Do you use GMail? Are your communications private? Should they be? Well, here's what we figured out about the issue, that may or may not help you - or perhaps GMail, if anyone can get ahold of their developers, to tell them about it." Update: 01/12 22:21 GMT by T : Good news for Gmail users; those malformed messages are no longer being accepted; read below for a message from Chris DiBona.

chrisd writes "Just so you know, at 10:15am PST mails with the problematic formatting as described in your previous story stopped being accepted into Gmail. Previous emails that had this problem will also no longer will be accessible. If you don't mind, I'd like to take the time to remind Slashdot readers that they can send bugs that may have a security aspect into security@google.com. If they like, they should feel free to cc me at cdibona@google.com. We appreciate your patience and we're sorry about the bug."

Comments

Wow

[bperkins]

Did any of this "left over" information happen to be spurious commas?

Re:Wow

[TedCheshireAcad]

,,,, no, ret,u,rn to yo,ur work. ,,
,do,not,,worry abou,t t,he com,mas.

Re:Wow

[goofyspouse]

Spurious? More like annoyingly superfluous.

Re:Wow

[bperkins]

Ah. That's the word I was looking for.

Security Category in Gmail Bugs List?

[dolo666]

Is it just me or do you find it strange that in the list of known Gmail bugs, there is no catagory for Security? I'm trying to find out if this bug is one of the known bugs, but I'm guessing it's not? And I'm also guessing that Security is not a concern for Google at this point, which is a very bad thing, IMHO. People are relying on Gmail because of its awesome features, but if someone can read insecured data directly from memory, it's a really big problem -- perhaps even a global design flaw of the system. No wonder Google plays their cards so close to their chest... I just hope they take some amazing measures to prevent these types of bugs in the future... like when somone does >>> or >>>> etc...

I use Gmail and this bug sort of disturbs me. Aren't they using a proper preg check to see if the fields are enclosed with < > ? I'm not even sure how this bug could exist in any normal computing system. I guess the gmail system is a hybrid of some kind? This is indeed very telling...

But it doesn't make me want to stop using Gmail. It's a random security breech that looks like they could fix it in an hour if they wanted to. Time to stop checking my email for a while until this is fixed...

Re:Security Category in Gmail Bugs List?

[TrippTDF]

This is just a shot in the dark, but I'm willing to bet Google left Security off the list on purpose. a security flaw becomes a lot harder to exploit if the general public does not know it is there.

I don't hold this against Google at all. I'm glad they are not telling the world how to break into my account...

Re:Security Category in Gmail Bugs List?

[Eric Giguere]

I'm not even sure how this bug could exist in any normal computing system.

It happens the same way that many (most?) bugs happen -- the human programmer forgot to check for boundary conditions in the data interpretation. As the old saying goes, "garbage in, garbage out" -- if you don't validate your data, you may be surprised at the results you'll get. Here the result is that it's exposing someone else's message to you. But it's not that surprising.

These things usually boil down to human error and incorrect assumptions. Nothing new here.

Eric
Why is William Shatner on my box of All-Bran?

Re:Security Category in Gmail Bugs List?

[PhilHibbs]

What do you mean, "I'm not even sure how this bug could exist in any normal computing system"? Buffer overruns are everywhere. Although the classic buffer overrun involves getting the app to write beyond the buffer's bounds and into the stack, this one is getting it to read beyond the point that it should. Unless the system has memory protection built in (and that is only possible on very recent processors) then this is entirely unsurprising. "Some kind of hybrid"? You're not making sense.

Re:Security Category in Gmail Bugs List?

[Anonymous Coward]

#include

Re:Security Category in Gmail Bugs List?

[RealAlaskan]

a security flaw becomes a lot harder to exploit if the general public does not know it is there.

I don't really see what difference the general public makes. The general public isn't interested in exploiting security flaws, even if there is a pre-rolled application which makes it easy, because the general public isn't script kiddies.

If one bad guy who can write a script for the script kiddies finds out about this, then the general public is at risk, even if he never releases that script. The general public is never going to find security flaws on their own, because they aren't looking. The bad guys, on the other hand, are definitely going to be looking.

If some good guy finds out about this kind of thing, I'd say that means that the bad guys either already found out, or will soon. I think that the best thing that hypothetical good guy can do for me is publish the details fast, so the google people have to get cracking and fix it, and so I know that my messages are not private.

How would waiting until the bad guys to release an exploit to the script kiddies before you tell the world help me? It wouldn't!

Re:Security Category in Gmail Bugs List?

[Anonymous Coward]

"security by obscurity" genrally refers to a system who'security requires obscurity by design. There's nothing wrong with deciding to not publicize known security holes while you try to fix them.

Re:Security Category in Gmail Bugs List?

[Anonymous Coward]

1:44: std/security_through_obscurity.h: No such file or directory

Re:Security Category in Gmail Bugs List?

[eno2001]

As I said in another post yesterday. We can never expect to be secure without full disclosure at every turn. Bring pressure to bear upon the developers, whether it's Microsoft or Google or Linus of the BSD coding corpses, whenever there is a vulnerability. Keeping it a secret only protects the black hats.

Re:Security Category in Gmail Bugs List?

[cain]

Security through obscurity is worse than no security. It gives you a false sense of security, which means you may do dangerous things under the assumption that you are secure.

Re:Security Category in Gmail Bugs List?

[Insensitive_Claudio]

Thanks Slashdot..... thanks a lot. Now everyone is gonna know about this bug....

Re:Security Category in Gmail Bugs List?

[BorgCopyeditor]

Sounds to me like a lot of dialogue on the Sci-Fi channel.

Re:Security Category in Gmail Bugs List?

[cglidden]

This is a little disconcerting, but gmail is still an invite-only beta. No system should be considered secure or trustworthy until it is finished. Betas exist to find problems like this. I realized that gmail is an extremely attractive service, which can make it hard not to use it as a primary email box. However, a beta should never be relied on. Maybe we are spoiled or have high expecations because Google puts out quality products, so we expect more of them, even their betas. Just keep in mind that betas offer no guarantees of any kind. In fact, finding this weakness does a great service to Google and its users. The final, finished product will be that much better thanks to this glitch.

Re:Security Category in Gmail Bugs List?

[ichimunki]

There's nothing wrong with deciding to not publicize known security holes while you try to fix them.

Actually, there could be. In this case, it lulls the user into a false sense of security with respect to GMail. In other cases it conceals the problem from users who may need to take some sort of corrective action until the problem is fixed. Now, if you had said it was fine to issue a notice about the bug, but conceal the mechanical details, that's a different story.

Re:Security Category in Gmail Bugs List?

[Nikker]

The curious thing is that this bug is about imbalanced symbols. If I malform an address it continues into thier system looking for the balanced pair instead of bailing out. But if it does find its pair does it remove the other from another location of memory is this problem recursive? Basically once one imbalanced pair is incountered is the whole system imbalanced? Ask Google?

Re:Security Category in Gmail Bugs List?

[cyfer2000]

several questions jumped in my mind.

Don't they store information in CDATA mode, if they use xml?

Don't they encode those Does POP access affected?

Re:Security Category in Gmail Bugs List?

[ryantate]

This sounds a lot more like a malformed regular expression than a proper buffer overrun. Something like "" to read part of a From: address on a shared mbox file would do the trick. In that case the error would be reading the wrong data, not a memory management issue.

Re:Security Category in Gmail Bugs List?

[crazy_pikachu]

they do this to help inform google about there problems, not so the world will know. if google knows about the problem then they will fix it before it becomes a bigger problem if they are a responsible company

Re:Security Category in Gmail Bugs List?

[ryantate]

woops, that malformed regex should be:

"<(.+?)>"

or just

(.+?)

surrounded by angle brackets

Re:Security Category in Gmail Bugs List?

[isomeme]

People are always saying that, but it just isn't true. Relying only on obscurity for security is probably a bad idea, but as part of a complete security solution, it can be very helpful.

People will not successfully exploit a vulnerability they do not know about, or attack a system they do not know is there. Even if some fraction of people are in the know, you've reduced your potential attacker count by the fraction of them who are not in the know.

Re:Security Category in Gmail Bugs List?

[Q2Serpent]

People will not successfully exploit a vulnerability they do not know about

You did read the article, yes? This is exactly what happened.

Re:Security Category in Gmail Bugs List?

[innocent_white_lamb]

That depends entirely on the context.

The lock on a vault generally relies entirely on obscurity to obtain its security. You can't see how the cams are turning inside of the lock so you can't open it unless you know the combination. If you do know the combination, you can open the lock within a minute or so. If someone invents magic X-ray eye glasses that could see through the steel, then the standard mechanical combination lock would be useless.

The question at that point becomes how likely is it that this would ever happen?

In the case of a steel vault door, I submit it's fairly unlikely. In the case of a computer security scheme, on the other hand, ....

Re:Security Category in Gmail Bugs List?

[Basje]

I'm all for full disclosure in public software. But gmail and other web services aren't public software.

Full disclosure has a purpose: to educate users/admins in order to prevent damage to them. It should not be goal in itself.

In case of proprietary software running on a machine nobody but the developer has access to, why bother. It's not as if the users run more risk if FD isn't practiced. Au contraire.

The only reason I can think of that would warrant FD, is when you want to keep tabs on the developer, because you don't trust them. In that case, find another service provider.

Re:Security Category in Gmail Bugs List?

[milkman_matt]

Buffer overruns are everywhere. Although the classic buffer overrun involves getting the app to write beyond the buffer's bounds and into the stack, this one is getting it to read beyond the point that it should.

Ok, Not to sound naive or anything, I've been working in IT for several years, but never as a programmer. That being said, I don't understand how there's so many buffer overrun errors everywhere. Damned near every security bulletin I read is something about a buffer overrun error. How is this so common? How is it that this isn't protected against by programming due to its overwhealming popularity as a security exploit?

Re:Security Category in Gmail Bugs List?

[mattgreen]

There's nothing wrong with deciding to not publicize known security holes while you try to fix them.

Unless you're Microsoft, of course.

Re:Security Category in Gmail Bugs List?

[Wateshay]

Because programmers are, as a rule, an incredibly lazy lot (I should know, I am a programmer). No programmer worth his salt isn't familiar with buffer overruns, but dealing with them can be extremely tedious work, and (being human) programmers will often skip over them--either because they miss a spot where they should check, because they figure they'll come back later and fix it (which never happens), or because they don't think the data will ever be malformed in that particular instance so they just don't worry about it.

Re:Security Category in Gmail Bugs List?

[isomeme]

The discoverers accidentally found a vulnerability. That sort of thing happens routinely. My point regards the wisdom of not widely advertising that vulnerability, on the theory that others are unlikely to encounter it on their own.

If you discover that I've left my car unlocked, I would much prefer that you not festoon it with a large orange banner saying "THIS CAR IS UNLOCKED".

Re:Security Category in Gmail Bugs List?

[umshaggy]

I would argue that it is becaue programmers are usually on deadlines, and properly checked code that avoids overruns takes much longer to write. If your boss doesn't care about it, you generally don't either. Programmers like being able to pay rent:)

Re:Security Category in Gmail Bugs List?

[Insensitive_Claudio]

i'm sorry, I meant this as sarcasm... Warning: My sarcasm wasn't XML 1.0 compliant. Perhaps it should have read: Thanks a lot Slashdot... now everyone's going to know...

Re:Security Category in Gmail Bugs List?

[RAMMS EIN]

``People are relying on Gmail because of its awesome features''

Not to be trolling, but what are these awesome features, besides the storage space? Access to the service seems to be limited to selected web browsers (and POP clients, once you manage to enable it).

Considering that I can get mail service with IMAP and a web interface that works in *any* browser, with technical support people that I can _actually_ contact by email, I don't think GMail has anything to offer me at this point.

Re:Security Category in Gmail Bugs List?

[Cromac]

Modded flamebait, there's slashdot moderation at it's finest rushing to defend anything Google or Linux. Face it, Googles QA team fucked up and missed something that should have been caught before beta if they'd even done the testing any $10 / hour intern would do.

Re:Security Category in Gmail Bugs List?

[viva_fourier]

dangerous things like printing off your gmail and holding up banks with the threat of papercuts?

I think there's a false sense of security with any communication medium -- cell phones and landwire are both prone to tapping. Snailmail can get stolen if your mailbox flag is up, Heck, even fiber can be sniffed(given a nice stable submarine, lots of storage, and a blanket defense budget).

I don't see how "security through obscurity" is worse than "no security". If I leave my car unlocked and a thief happens by, he only needs to know how to start the car to steal it.

But, if I leave the car locked but don't tell anyone how its locked, now the thief needs to figure out how to break into the car, and then be able to start it.

"Security through obscurity" is better than nothing at all.

Re:Security Category in Gmail Bugs List?

[Duhavid]

Works like this ( c/c++ code ).

The programmer has several string manipulation functions to choose from ( talking character array buffers, and the old C runtime.

Say we want to copy a string, or part of a string into another buffer. We might chose a fixed size buffer to copy the item into ( sometime needfull, but there are usually other choices... ). So we declare that buffer, and we give some thought to what might go into it. Well, usually, the programmer says "what I want to copy will never be longer than N characters long". So, he/she/it makes it, oh, say, N + 1 characters long ( to allow for the NULL terminating character ( that which indicates the end of the string ).

Now, on to the copying! Well, we have made the buffer big enough, so, lets just copy, eh?

So the programmer uses his/her/its trusty strcpy ( et al ) function.

So:

char pszBuffer[ 57 ];
strcpy( pszBuffer, );

Great, move on to the next, right?

Wrong. In C\C++, there are *no* checks to see if we are copying more than 56 ( N - 1 ) characters. So, if has 1000 characters, strcpy merrily copies all 1000 characters, and thoughtfully adds a NULL terminating character at the end ( for 1001 characters copied.

Here is the problem you asked about. ( not to mention that if any part of that buffer happens to lie in memory you dont own, *foomp* (tm) you are off in the weed, probably with a crashed application ).

So, what *ought* our valiant programmer do? I think it looks something like this:

char pszBuffer[ 1024 ] /* for the exceptionally anal, remove the comments from this,,, = { 0, } */;

Is that all? No, glad you asked, it is not.

strncpy( pszBuffer, sizeof( pszBuffer ) - 1, );

pszBuffer[ sizeof( pszBuffer ) - 1 ] = 0; // in case strncpy hit the end of the buffer, and did not NULL terminate. Yes, it will overwrite a character in this case, but that is better than crashing.

Is that all? Well, no, thanks for asking.

One can, if one is inclined, get the count of characters before copying, and use that number as a check before performing the copy ( adjusted, of course ).

Better would be to drop using raw character buffers, ( at least in C++ ), and use the many provided string classes instead, only dropping back to char buffers when absolutely needfull.

Comes down to habit and laziness, and not fixing what isnt broken ( well, really caught as a bug as yet... ).

Remember, memory is just a roll of toilet paper!

Re:Security Category in Gmail Bugs List?

[LeftOfCentre]

Memory protection facilities have been available for an eternity. And it doesn't necessarily help, either, if I understood correctly from my quick glance of the site. If the server re-uses the same buffer while serving up e-mail to different people, how could memory protection do any good?

Re:Security Category in Gmail Bugs List?

[malfunct]

If they really cared about hiding the information in that buffer the cleanup code from each transaction would write zeros to the buffer before deallocating it or returning it to the "pool" whatever that might be. Unfortunately the prevention is almost always rejected as a "perf hit". As a software tester I get tired of hearing that.

Re:Security Category in Gmail Bugs List?

[arevos]

They successully exploited a vulnerability without knowing what the vulnerability was? Is this part of the if-we-stumble-around-long-enough-we'll-get-lucky-e ventually school of (cr|h)acking? :P

Re:Security Category in Gmail Bugs List?

[cain]

But, if I leave the car locked but don't tell anyone how its locked, now the thief needs to figure out how to break into the car, and then be able to start it. "Security through obscurity" is better than nothing at all.

Well, that's kind of a silly example. But I'll go with it to show how security through obscurity is worse than no security at all.

Suppose in your obscurely locked car, you keep change for the toll road in your ashtray. When you get in your car in the morning, you note that is appears that your obscurely locked car has not been broken into. So you start driving and get on the toll road. Now when you come to your first toll, you reach into the ashtray only to discover that someone did stumble on to the way to unlock your car and has stolen all your change! You're stuck at the booth with no change.

Now if you has just left the car unlocked you would have checked the ashtray before you got on on the toll road. Afterall, someone could've just opened the door and stolen your change because the car is not locked at all. If someone had, you'd note it before you even left your house and could replace it before driving.

But because you assumed that your car was secure, you've been tricked into a false sense of security -- which is worse than knowing you are not secure.

Security through obsucrity is worse than no security at all. Now if you assume that no-one has broken into your car, then there is no need to check whether or not someone has stolen your change.

Re:Security Category in Gmail Bugs List?

[theapodan]

But can you get it for free? Because if you can't, then its apples to gmail's oranges.

Re:Security Category in Gmail Bugs List?

[MrYowler]

Simply put, there are thousands of systems which are vulnerable to memory deallocation/recallocation data exposures. I run across these things on a daily basis, and this one happens to be in a high-profile system.

NSA Wally (I cannot be held responsible for his choice in handles!) is the one who thought that this was important enough to make SlashDot - I discovered it last month, and could not be bothered to do a writeup about it. He and I discussed it, and he was fairly excited about the discovery, but my experiences tell me that I am quite possibly the only person who cares. He talked with a few folks from the https://www.hbx.us/HBX Networks IRC channel, and they sort of blew it off. It was NSA Wally that poked and prodded me into doing a writeup - in fact, he did one initially, which I then edited. Apparently, I still missed a few grammatical things, but seriously; I did not think that it would ever see the light of day. Until today, I did not even have a SlashDot account!

The actual cure for this problem, would probably be a wrapper for the malloc() and/or free() functions, that would clear the contents of memory as it is allocated (or deallocated). This would prevent these types of data exposures on shared systems of all sorts - whether the sharing occurs at the process or user level. Even the BSD jail() mechanism does not adequately partition memory, to prevent this sort of exposure. It could be done in the memory manager, in the function library, or in the application - but nobody seems to do any of these things, and the result is that systems often run with their zippers down. I see it so much, and so few people give a damn when I point it out, that I've stopped pointing it out... ;-P

I'm not suggesting that the folks at Google are a gaggle of monkeys with keyboards - much to the contrary; they are an exceedingly well-run organization, that has their priorities in the right places. I really do wish that I worked there. Unfortunately, like most such entities, it is nearly impossible to draw interest or attention to problems, when you find them, and security staff give the appearance of purposely distancing themselves from their users. I don't even have the 'report a bug' link in my account; it was NSA Wally that had the link, to be able to include it in our suggested solutions to the problem. So... when you find an issue of this nature, that really deserves a fix at the operating system level, and nobody even knows who you are - what do you do to get some attention to the issue? Why, publish it on SlashDot, of course! :-P

I dunno... NSA Wally came up with the idea to publish, and chose the forum. Me, I'm a stockboy at a grocery store, with Cisco and CISSP credentials. Ability and training have carried me to the exalted rank of "peon", in life, and nobody listens to a peon. I'm amazed that the article even got published... :)

Re:Security Category in Gmail Bugs List?

[RAMMS EIN]

Absolutely I can. Google for webmail imap free and you can, too.

Re:Security Category in Gmail Bugs List?

[eison]

Don't you consider it far more likely that they simply refuse to operate with any *known* security bugs??

Re:Security Category in Gmail Bugs List?

[Wateshay]

Well, there's that, too. :-)

Re:Security Category in Gmail Bugs List?

[felis_panthera]

From the GMail FAQ (emphasis added by poster):

2. How do I sign up? When can I get a Gmail account?

We're currently only offering Gmail as part of a preview release and limited test. We don't have details on when Gmail will be made more widely available, as that depends in part on the results of the test. If you're interested in receiving updates on Gmail, submit your email address using the form at the bottom of this page.

ummmm... just because gmail invites have become more common than free iPods doesn't mean that it has gone live... has everyone forgotten that we're beta (gamma, maybe even delta) testing this service... ergo, no one should be relying on them as finding bugs like this is why we have gmail accounts...

Re:Security Category in Gmail Bugs List?

[viva_fourier]

Okay, I guess the *silly example* isn't very pertinent, considering how you've just decided that being stuck at a tollbooth and short 50 cents is better than having your car lifted.

Back to a relevant example :)

What you're saying is that merely because I believe my computer to be secure, I am less secure than if it is known to be unsecured.

So, right now I believe my computer to be secure. You're telling me that if I disconnect it from the firewall and leave my system barebone cable-modem connected to the net, I am more secure just because I know this. Maybe my head is filled with cheese, because I just don't get it.

Getting back to the article at hand, I think a company that does choose "security through obscurity" is betting against the world. They're making the brash statement, "We can maintain security through whatever you throw at us". And, maybe they do pretty well -- maybe they *are* smarter than everyone else, able to keep ahead of the haxors and scriptkiddies... for awhile.

Re:Security Category in Gmail Bugs List?

[PhilHibbs]

Others have answered your main point, but as a side note, Microsoft's latest C & C++ compiler protects against stack-based buffer overrun attacks (the writing-to-the-stack kind, not the reading kind like this bug).

Re:Security Category in Gmail Bugs List?

[PhilHibbs]

Performance is very important in systems like this, especially massively parallel services like gmail. Even a 2% performance degradation would be very expensive for them. Re-initialising every memory buffer that confidential information might be written to would probably incur something like 10% (OTTOMH).

Re:Security Category in Gmail Bugs List?

[shellbeach]

Not to be trolling, but what are these awesome features, besides the storage space?

Well, if you're not trolling and are genuinely interested ... there are two things that greatly impressed me about Gmail: first, the speed of the interface, which is amazing even over dialup; secondly, the ease of use. This is the first email application I've thought to be better than PINE, which I've used for the last ten years, so I'm not in it for the pretty bells and whistles. But this has keyboard shortcuts and the threading feature is the best I've seen ...

In any case, what Gmail also provides if you want it (I don't) is not only POP downloading of mail but also SMTP sending of mail - and that IME is much less common in free webmail clients: in fact I've never seen it before. What it means is that you could completely bypass the Gmail web interface if you wanted to.

And ... if you use the POP3 and SMTP features you can still have access to all your mail, threaded - including the mail you've sent via SMTP - through the web when you're away from your own PC. That's pretty neat, I think ...

Re:Security Category in Gmail Bugs List?

[RAMMS EIN]

``SMTP sending of mail - and that IME is much less common in free webmail clients: in fact I've never seen it before.''

I've seen it in many webmail systems (it's usually called 'forwarding'). Usually you get the option of also retaining a copy in the webmail service, just like GMail. That said, I wish more services (also non-webmail) provided forwarding (my university account doesn't, for example).

Re:Security Category in Gmail Bugs List?

[jbx]

> Is it just me or do you find it strange that in the list of known Gmail bugs [google.com], there is no catagory for Security?

If gmail knew about a security bug, they would drop everything and fix it. They wouldn't take time to update [the list of known Gmail bugs] before they fixed it, and they wouldn't need to update the list after they fixed it, because the bug wouldn't exist anymore.

To put it more simply: there is no list of known Gmail security bugs because there aren't any known Gmail security bugs.

Re:Security Category in Gmail Bugs List?

[cain]

Okay, I guess the *silly example* isn't very pertinent, considering how you've just decided that being stuck at a tollbooth and short 50 cents is better than having your car lifted.

If you re-read my reply you'll see I did not say that. You seem to have missed my point. But that's OK.

So, right now I believe my computer to be secure. You're telling me that if I disconnect it from the firewall and leave my system barebone cable-modem connected to the net, I am more secure just because I know this. Maybe my head is filled with cheese, because I just don't get it.

Again. This is not my point, nor is it what I am saying. A firewall is not security through obscurity - it is a proven security tecnology. My point is simple: security through obscurity gives a false sense of security - and a false sense of security is worse than no security at all. Trust placed in an insecure system is misplaced trust. And mispaced trust is dangerous. Do you see?

And, maybe they do pretty well -- maybe they *are* smarter than everyone else, able to keep ahead of the haxors and scriptkiddies... for awhile.

And I would not trust them because the likelihood that they are correct is very small. Instead of trusting them I would use proven security techniques.

Re:Security Category in Gmail Bugs List?

[shellbeach]

I've seen it in many webmail systems (it's usually called 'forwarding').

No. "Forwarding" means sending a copy of mail that arrives in your webmail account on to another email account.

What I'm talking about is sending mail directly through PINE/Thunderbird/Sylpheed/OutlookExpress (god help us!)/etc, just as you probably do with the email address your ISP provides you with. If you're still confused, google for "SMTP" ...

Re:Security Category in Gmail Bugs List?

[malfunct]

That said spending 10% of your budget on privacy lawsuits would be less efficient.

Re:Security Category in Gmail Bugs List?

[PhilHibbs]

I can't think of any privacy lawsuit over a software bug.

In a beta product.

Re:Security Category in Gmail Bugs List?

[theapodan]

No, you're wrong.

One Key Word

[wcitechnologies]

BETA. It is unlike google to release half-assed web services. Keep in mind GMail is still being offered as a preview, you can't even sign up unless you know somebody else who has it.

Google will work out the kinks, they always do.

Re:One Key Word

[Anonymous Coward]

Next up on Slashdot: the Google apologists vs. the Apple apologists in a brown nose-off...

Re:One Key Word

[Richie1984]

Even though GMail is still being offered as a preview, there seem to be more invites then there are people willing to sign up, in my experience. Basically, in my opinion, if you want an account it isn't too hard to get one nowadays

And while GMail is still in Beta, it is still a widespread and widely used email service. So, while I can understand that there are still bugs in the service which Gmail could iron out without too much trouble, I would disagree with people who underestimate the severity of those bugs, and their implications, simply because Gmail hasn't reached final status.

Re:One Key Word

[MightyMartian]

> Google will work out the kinks, they always do.

Let me know when they fix the disaster known as Google Groups 2. They've buggered up a ton of archive references, and don't exactly seem to responding in a stellar fashion to the problems.

Re:One Key Word

[the_mad_poster]

Agreed.

Not only that, as always, e-mail from one network to another across unknown intermediaries is not private. It travels on public wires across public networks. If there's a value in someone targetting you and you're not technically competent enough to know you shouldn't use gmail for important discussions, they can just snap a packet sniffer onto your gateway and watch everything you send and receive right at the source with little fuss and no muss.

First thing's first: you ought not be relying on generated passwords that come in an e-mail. You get it, you change it, that's that.

Second thing: it's called encryption, m'friends. It doesn't matter what's in the envelope when a bad guy intercepts it if he can't open it.

Re:One Key Word

[Blue-Footed Boobie]

It doesn't matter what's in the envelope when a bad guy intercepts it if he can't open it.

I think you mean:

It doesn't matter what's in the envelope when a bad guy intercepts it if he can't READ it.

Makes more sense when talking about email encryption.

Re:One Key Word

[phats garage]

I disagree.

I know that its everyones darling, Google, but its not any less of a privacy spilling bug. Look at everyone who jumped on gmail already. Look at the bug itself, their servers trust the email client to terminate a string.

Never trust an internet client to provide properly formatted strings. Google blew it. (Besides, they're on my bad list for screwing up the usenet archives anyways, they're turning evil.)

Re:One Key Word

[valkraider]

I've taken to composing all my email in Navajo.

Re:One Key Word

[Datamonstar]

I *think* he's thinking on a different level. He's implying that if you can't open a letter you can't even read even if you could open it, then it's just that much more secure. Your way might make more every day sense, but his way makes more "programmer" sense.

Re:One Key Word

[SilentChris]

*shrug* So often when MS, Apple, etc (insert your favorite commercial developer here) releases a beta, the Slashdot community gets its panties in a bunch when it finds a security flaw.

I remember numerous comments when Windows 98 beta IE flaws were found saying, in effect, "My god... no wonder MS releases such crap products!" Not this gentle "it's only a beta" viewpoint we have towards Google.

Re:One Key Word

[pqdave]

Unless you are making an argument along the lines of "Google maintained their copy of the usenet archives, allowed free public access until nobody else wanted to bother, then when there was no competition screwed it up on puprpose", I can't see how this is evil, or how maintaining a public access copy obligates them to continue to maintain a public access copy with a particular interface forever. It's great that they took over when Dejanews tanked, but unless they are somehow preventing others from getting a copy of the archives in the same way they did I can't see a foul.

Re:One Key Word

[spectral]

What about the sites that email you the damned password all the time? plaintext, in an email.. it's absolutely moronic, but plenty of sites do it. "This is your monthly password reminder, we'll ignore the fact that you logged in two hours ago!"

Re:One Key Word

[Kent Recal]

You mean I can get a copy? How many gigs is that?
Would make a lovely testing playground for people developing or experimenting with spam filters...

Re:One Key Word

[danila]

No, he means that after years of being Beta Google Groups was suddenly downgraded to Alpha.

Re:One Key Word

[geekoid]

I've only got 40,000 invites. Very Exclusive.

Re:One Key Word

[Eric_Cartman_South_P]

I use Google on my Powerbook. I love myself.

Re:One Key Word

[pqdave]

Same way DejaGoogle did (counting Dejanews in this, since Google paid money nobody else was willing to for their work) Run a news server, store what crosses it, and piece the rest together from old media.

Oh, but that's haaard...

Beta..

[ackthpt]

Beta...beta... Golly, I wonder what that means.

Oh, sure, it means ready to be shipped/used in production by some companies, but has that line gotten to fuzzy for some people?

"that's not a feature, that's a bug"

Re:Beta..

[jxyama]

yes, it's a beta... but shouldn't beta be a functional version being tested for bugs?

if my email and/or account can be compromised, in a way that cripples its basic functionality as an email service, i am not sure if you can call it a "beta" to begin with. how do you work out bugs in the program if it can't be trusted to function as intended at the very basic level?

if a beta version of a photoshop, as an example, couldn't even reliably open a JPEG file, that's a serious problem i'd be unwilling to dismiss simply as a "bug" just because "it's a beta."

Re:Beta..

[Smidge204]

If this was an open source project, "Beta" would translate to something like... "I'm bored, let's do something else."

=Smidge=

Re:Beta..

[Short Circuit]

Google has a lot of powerful tools on their website with the Beta descriptor. Tools effective enough to be considered vital by many. Calling something "Beta," then, makes for a great excuse for mistakes and bad code.

FWIW, for me, the back end to Firefox is Google, not the Internet. :)

Re:Beta..

[ackthpt]

yes, it's a beta... but shouldn't beta be a functional version being tested for bugs?

Certainly, and as a Gmail user you should view your use of Gmail as evaluation, not something you depend upon for any critical application.

if my email and/or account can be compromised, in a way that cripples its basic functionality as an email service, i am not sure if you can call it a "beta" to begin with. how do you work out bugs in the program if it can't be trusted to function as intended at the very basic level?

You have the sense that it's experimental and don't rely on it for anything critical. Get another email service which isn't Beta for anything requiring security/reliability. I'm sure Google has the terms somewhere, which state something along the lines of "user accepts all risk" and "Google shall not be held responsible for" That's a pretty good indication you're depending on something you shouldn't.

if a beta version of a photoshop, as an example, couldn't even reliably open a JPEG file, that's a serious problem i'd be unwilling to dismiss simply as a "bug" just because "it's a beta."

Sure, but BETA means 'not ready for production' If you bought the production version of Photoshop and it left artifacts in your work, you have an issue with the company. Artifacts in Beta should not be unexpected and the role of the user is not to complain about it, but to point the bug out to the developer, after all using BETA software is intended to be testing and evaluating.

Re:Beta..

[infinii]

Quit crying wolf for christ sake!

I'm willing to bet that you have yet to encounter this bug. If this wasn't posted to /. you probably won't even know about it. Yet here you are crying that the bug "cripples its basic functionality".

I use gmail everyday and I have yet have problems retrieving email. IMO, there is nothing wrong with the basic functionality it is supposed to provide.

In essence, this is a bug and it IS in BETA so live with it.

Re:Beta..

[dAzED1]

which is where a huge chunk of the more amazing innovations and ideas come from lately (boredom). Scary, eh?

Re:Beta..

[ackthpt]

Google has a lot of powerful tools on their website with the Beta descriptor. Tools effective enough to be considered vital by many. Calling something "Beta," then, makes for a great excuse for mistakes and bad code.

A fine example is Google Groups, which has gone back under the knife and is really flaky in the new Beta incarnation. It breaks threads, loses messages, utterly fails to post and other exciting things. I'd be nuts to rely on it, tho for non-critical things I do and feel confident enough that it can find archived things I need to look up.

Relying on BETA is the fault of the user, not the vendor. In some instances, however, I can recall vendors rolling out untested (it compiled, that was the only test) software for mission critical applications (i.e. payroll for about 38,000 people), which really is inexcusable.

Re:Beta..

[freshman_a]

but shouldn't beta be a functional version being tested for bugs?


yes. and gmail is a functional version. you can send and recieive email. and gmail is being tested for bugs. this is a bug and it will surely be fixed before it's official release.

i'm not sure i would call gmail a "beta" if it were 100% functional and 'sploit proof.

Re:Beta..

[jxyama]

gee, calm down, buddy. i'm not "crying." i use gmail daily too and no, this hasn't been a problem. (and you are quite right i wouldn't have figured this out without /.)

i just wanted to post that i personally feel "being beta" should not be a blanket immunity for all the bugs, big or small. that's all.

Re:Beta..

[ad0gg]

news.google.com has been in beta for 3 years now. Same with google groups, same with froogle. Pretty much the only thing that google hasn't labeled beta is their main search engine.

Re:Beta..

[dillon_rinker]

"Being beta" means you KNOW there are bugs in your product; you should be immune from blame for having bugs. Nobody is perfect; some bugs come to light only after large-scale use. If you think public betas should be bug-free...well, don't hold your breath.

"Being beta" means you KNOW you have to fix your bugs. You should not be immune from blame for failing to fix bugs. I have seen no signs of Google refusing to fix this bug. (Feel free to correct me if I'm wrong).

Re:Beta..

[OmnipotentEntity]

What again about GMail on "a very basic level" is not functional?

It does have bugs. It's in beta and it has bugs. I honestly don't see where this is even news.

if a beta version of a photoshop, as an example, couldn't even reliably open a JPEG file, that's a serious problem i'd be unwilling to dismiss simply as a "bug" just because "it's a beta."

That metaphor is flawed. A better one would be, "If a beta version of Photoshop couldn't open a JPEG with a bad header reliably, it's a serious problem." And, AFAIK, you can't open a JPEG in Photoshop if it has a corrupt header.

if my email and/or account can be compromised

If you're worried about security use PGP first. There are easier ways to intercept email than this. This doesn't really do anything in the way of decreasing security, all it says is "Hey look, someone at Google forgot a conditional." And it'll probably be fixed tomarrow. GMail is loads more stable than most programs in beta. Get rid of your unrealistic expectations. Nothing is bullet proof.

Re:Beta..

[Skidge]

We recently had a discussion at work over whether or not to label something as "Beta". One side said users will think beta == crappy. The other side said users think beta == cutting-edge. I'm sure, as with most two-sided issues, reality lies somewhere in the middle.

Re:Beta..

[bogado]

I think beta here means no warranties, no more, no less. Google has many services labled as beta, but the said services are working as if they were ready. The only diference is that if any find a bug, and some of them have tons of it (orkut comes to mind), they can simply state that this is a beta test.

Re:Beta..

[carabela]

Speaking of which; how many years was ICQ in Beta?

Re:Beta..

[jacksonj04]

Beta = should work for anything you need it to, but if it falls over or does something strange then tell us coz it's probably a bug we haven't fixed yet.

There's Alpha status for "Some bits of this might work if you hack the database and give it specific input"

Re:Beta..

[cmacb]

I'm sure Google has the terms somewhere, which state something along the lines of "user accepts all risk" and "Google shall not be held responsible for" That's a pretty good indication you're depending on something you shouldn't.

The problem is that most commercial software has these same caviats in the final release of their software as well, making the distinction between Beta and Production fairly meaningless.

Now, if you could without too much trouble sue a software company for damages beyond the purchase price of the software it would be a different matter. In such a case I suspect many titles would be released as Beta, and stay that way for years at a time.

Re:Beta..

[Smidge204]

Got any examples?

=Smidge=

Re:Beta..

[maxpublic]

And let's not forget it's Google. Just as Microsoft is the Great Satan, Google is the entity that frenzied geeks bow down to and worship as one of the New Gods(TM).

The hypocrisy would be annoying if it weren't so fucking hilarious.

Max

Re:Beta..

[glorf]

Sure it's a Beta, but its a public Beta. If you ask then entire world to help do your QA for you, then you can expect the bugs found to be known to the entire world. And Beta also implies that it has been through the Alpha stage and is very close to production ready code. Considering that the buffer overflow is the security bug celebrity of the year I would expect those to be found in the Alpha.

Re:Beta..

[fred911]

"A fine example is Google Groups, which has gone back under the knife and is really flaky in the new Beta incarnation."

Not to mention how sucky the "new" interface is. Jeeze, dejanews had a clean interface. When it 1st became "Googlefied" it was fine, now it's allmost unusable! Such a waste of historic archives.

Re:Beta..

[Alsee]

Beta...beta... Golly, I wonder what that means.

I always thought it was Microsoft's codename for ServicePack2 versions of various products? ServicePack1 version is called Alpha, and I don't know what they call the initial release.

-

Re:Beta..

[strider44]

how long was Firefox in BETA, even though they had what to 99% of people would be a perfectly usable and featureful browser.

Email isn't secure

[krog]

and should never be treated as such. If you want security, use strong encryption.

This is as it was 10 years ago, 5 years ago, now, and in the future. Plaintext should be treated as though you were sending a postcard in the mail.

Re:Email isn't secure

[LostCauz]

why isn't this modded up?

Re:Email isn't secure

[jxyama]

email isn't secure, sure. but accounts should be, at least to a reasonable level. afterall, we have many examples of web-based services that depend on the security of account id/paassword, like banking and credit card sites.

it's one thing for the email being sent to be intercepted. it's quite another to leave a hole such that your account name and password can be obtained by strangers.

Re:Email isn't secure

[Riddlefox]

While that is true, the blurb about the article states that passwords and usernames may have been revealed. Encrypting your e-mail probably wouldn't prevent that.

Re:Email isn't secure

[sketerpot]

If the usernames and passwords are in the email body, then encrypting it will protect the information. Why wouldn't it?

Re:Email isn't secure

[SoVeryWrong]

It means usernames/passwords that were e-mailed to you in plaintext. Doing that for sensitive data is just fundamentally stupid, and is more the fault of the person/company sending the e-mail than google or anyone who hosts a mail server.

Re:Email isn't secure

[tetromino]

Plaintext should be treated as though you were sending a postcard in the mail.

Most people have the reasonable expectation that their postcards are at least being delivered to the right recipients. The gmail bug is equivalent to the post office making photocopies of a postcard and stuffing them in all your neighbors' postboxes. It allows lots of technically illiterate people with no hacker/secret-agent/NSA training to read your mail.

Re:Email isn't secure

[Heisenbug]

OK, but if someone found a short perl script that would reveal random selections from recently sent postcards in the mail, that would sure as hell be news. The fact that it can be read in theory by other means doesn't mean that a particularly easy way to read it is irrelevant.

Re:Email isn't secure

[RpiMatty]

No it doesn't allow lots of technically illiterate people access to your mail.
An email has to arrive at a gmail inbox, with a bad from field in the header. the sending mail client must leave > of the end of the field. It would take a bit of skill to get a client that does this.
Also the article makes no mention if the information revealed is random, or the same each time.
my guess is that it is randomly pulling data each time a damaged email is recieved, but the article didn't specify if the same "extra" information is revealed each time an email is opened.

Re:Email isn't secure

[mindriot]

True. But how is that an excuse for security flaws in Gmail's interface?

I'd love to hear you make the same statement when the next Outlook attack comes up...

Re:Email isn't secure

[elmegil]

So blame the idiots who are sending you passwords on the equivalent of a postcard then. Namely those web services.

Re:Email isn't secure

[jxyama]

did you even read what this news is about?

>An attacker has only to transmit malformed test messages to himself, and information left over in memory, from previous messages destined for other people, will appear with the test messages, in the attacker's inbox. Sometimes, this information may include usernames and passwords...

no one is transmitting any passwords. a malicious stranger can send a mail to him/herself and as a result, can get pieces of email sent by a third party to another third party, sometimes containing password/id of some third party.

Re:Email isn't secure

[aardvarkjoe]

The gmail bug is equivalent to the post office making photocopies of a postcard and stuffing them in all your neighbors' postboxes.

This has to be one of the stupidest, most nonsensical analogies I've ever seen on slashdot. And the intellectual property threads get some doozies.

It allows lots of technically illiterate people with no hacker/secret-agent/NSA training to read your mail.

Yeah, like you've got to be a highly-trained spy to open your neighbor's mailbox and read the contents.

Re:Email isn't secure

[tetromino]

This has to be one of the stupidest, most nonsensical analogies I've ever seen on slashdot.

Why? The gmail bug allows you to read random snippets of mail that's located near yours on a gmail server hard drive (at least that's the way I understood it) - same as if the post office was making photocopies of your mail, and sending them to a guy five streets over.

Yeah, like you've got to be a highly-trained spy to open your neighbor's mailbox and read the contents.

No, but you do have to have some skill to read your neighbors email box under ordinary circumstances. Unless you operate an ISP, or are on the same network segment as your victim, you will have some difficulty in reading his packets. It's not enough to just run ethereal. There are ways to do it, but Joe Sixpack doesn't know about them. The gmail bug significantly lowers the barrier to entry to reading other people's email, just like a post office that provides other with photocopies of your stuff dramatically lowers the barrier to entry to strangers reading your postcards. The whole point of my analogy was to show that "plaintext email is already insecure so gmail bug doesn't matter" argument is bollocks.

Sheesh, some people just don't get analogies...

Re:Email isn't secure

[elmegil]

Did you even read what this thread is about? If some moron is sending you passwords in clear text in email, THAT PASSWORD WAS NOT SECURE TO BEGIN WITH.

And guess what? That's true of the rest of your email too, though I doubt anyone cares about you sending love notes to your hand's gmail account.

A Darker Shade of Grey Hat

[American AC in Paris]

When you find a bug like this, you should first and foremost submit it to the party responsible for the maintenance of the code. You should at least give the responsible party the opportunity to review/respond/repair before making vulnerabilities public knowledge.

Security exploits are a serious matter, and they need to be handled properly. Throwing this kind of thing out in the open willy-nilly is, at best, irresponsible. For one, it means that Google must now rush a fix for something which may have already been in the bugfix queue; rush jobs can disrupt the entire project and increases the odds of human error--which can lead to unnecessary security vulnerabilities.

As for these guys getting hired by Google--being smarmy twits about Google's code review practices probably isn't gonna help their case any. Shame, because a little tact and professional courtesy would have given them a damn good running start at it...

Re:A Darker Shade of Grey Hat

[Threni]

What's this - the 10 commandments? You seem rather opinionated. Clearly the guys concerned don't agree with you. I use Gmail and I'm glad I'm aware of how insecure it is - something which wouldn't be the case if they'd not made me aware of it.

I guess it's the hat thing. You've decided you have to choose what colour they're wearing and what they've done doesn't match. I'd leave the hats alone and think for yourself. They've spotted a bug in beta code and decided it was easier to tell the public rather than Google. Good luck to them.

Re:A Darker Shade of Grey Hat

[pthisis]

When you find a bug like this, you should first and foremost submit it to the party responsible for the maintenance of the code. You should at least give the responsible party the opportunity to review/respond/repair before making vulnerabilities public knowledge.

Security exploits are a serious matter, and they need to be handled properly. Throwing this kind of thing out in the open willy-nilly is, at best, irresponsible.

You state that as fact, yet full disclosure is probably the most widely accepted way of dealing with exploits--and the most widely advocated by security experts.

It's at the very least a matter that's open to a lot of debate.

http://www.securityfocus.com/news/238

Re:A Darker Shade of Grey Hat

[cakestick]

Sorry to bother you, Microsoft. It won't happen again.

Re:A Darker Shade of Grey Hat

[a16]

It doesn't matter what colour hat you classify them as, or whether you personally are glad that you know gmail is insecure - and you are also somehow happy that every script kiddie now knows how to attack your account.

There is no excuse whatsoever for releasing something like this to the public, especially without notifying the service and giving a long enough period for them to fix it (IMO even going public then doesn't achieve anything). All that this achieves is self-glorification for the people finding the exploits, they even go as far to ask for jobs at google in this case. If people could stop thinking about getting their name attached to an exploit, and thinking about the benefits for all users of the service/software affected, we'd have a lot less scripts floating around for the script kiddies to click and run.

Re:A Darker Shade of Grey Hat

[demachina]

I wager most of their pre IPO developers are a little busy watching the value of their stock, debating whether to buy a Porsche or Mercedes, shopping for the country estate, and trying to decide when the perfect time to retire to maximimize their wealth.

The 60 minutes piece on them suggests the company culture is try to compel them to not flaunt their wealth and keep their head screwed on straight but when people become millionaires and billionaires overnight chances are high that they are going to lose the will to do security audits, grind out code, and fix bugs. I guess they have new hires to do that but new hires are ... well ... new hires.

Re:A Darker Shade of Grey Hat

[argel]

What's this - the 10 commandments? You seem rather opinionated. Clearly the guys concerned don't agree with you. [...] They've spotted a bug in beta code and decided it was easier to tell the public rather than Google. Good luck to them.

Because it has become standard practice in the industry to inform the vendor and give them a reasonable amount of time to come out with a patch before publically annoucing the exploit. It's called professionalism a.k.a. an endangered species here at slashdot.

Re:A Darker Shade of Grey Hat

[Goaway]

This has nothing to do with full disclosure. It is both responsible and customary to contant the developers responsible for the security hole in secret first, let them make a fix, and only then disclose the details.

Did you ever wonder why it is that most open-soruce security holes announced on slashdot have patches ready at the same time? It's not because open-source developer move lightning fast to patch. It's because they've had advance warning to develop and test the fixes before the announcement is made.

Re:A Darker Shade of Grey Hat

[goofyspouse]

"As for these guys getting hired by Google--being smarmy twits about Google's code review practices probably isn't gonna help their case any. Shame, because a little tact and professional courtesy would have given them a damn good running start at it..."

The folks at Google are way too bright to go offering jobs to such blatant comma abusers no matter how much tact and courtesy they possess.

Re:A Darker Shade of Grey Hat

[pthisis]

This has nothing to do with full disclosure. It is both responsible and customary to contant the developers responsible for the security hole in secret first, let them make a fix, and only then disclose the details.

That is one school of thought. The full disclosure camp normally holds that you should NOT delay public announcements, for many reasons. Those include but are not limited to:
1. By informing the public ASAP of a vulnerability, they can adjust their habits to deal with the problem (e.g. don't send sensitive data to gmail accounts now). You have no idea if the "black hats" already know about the bug, so by failing to disclose it you may be allowing real-world exploits to continue when you could abate them.
2. By making the knowledge public, corporations who might ignore or waitlist private messages will be spurred on to fix the bug quickly.
3. You do not know who is in the best position to fix a bug in open-source code, so by limiting who you give that information to you are limiting the ability to fix it.

and more. It is a complicated issue that can't be adequately examined in a couple of posts. My only point was that the first poster I responded to was taking a position that is not widely accepted by experts in the field and presenting it as though it were fact.

Re:A Darker Shade of Grey Hat

[pthisis]

Because it has become standard practice in the industry to inform the vendor and give them a reasonable amount of time to come out with a patch before publically annoucing the exploit.

Key here is "reasonable amount of time", which should be no more than a couple of weeks. Even that may be too long and many vendors will threaten you with lawsuits for going public once you've privately informed them of security holes.

As Bruce Schneier (author of Applied Cryptography, creator of Blowfish/Twofish, etc) writes:

What we've learned during the past eight or so years is that full disclosure helps much more than it hurts. Since full disclosure has become the norm, the computer industry has transformed itself from a group of companies that ignores security and belittles vulnerabilities into one that fixes vulnerabilities as quickly as possible.

Note that Schneier does say:

I believe in giving the vendor advance notice. CERT took this to an extreme, sometimes giving the vendor years to fix the problem. I'd like to see the researcher tell the vendor that he will publish the vulnerability in a few weeks, and then stick to that promise.

Also from the same article:
http://www.schneier.com/crypto-gram-0111.html

During the early years of computers and networks, bug secrecy was the norm. When users and researchers found vulnerabilities in a software product, they would quietly alert the vendor. In theory, the vendor would then fix the vulnerability...There were incidents of vendors threatening researchers if they made their findings public, and smear campaigns against researchers who announced the existence of vulnerabilities (even if they omitted details). And so many vulnerabilities remained unfixed for years.

The full disclosure movement was born out of frustration with this process. Once a vulnerability is published, public pressures give vendors a strong incentive to fix the problem quickly. For the most part, this has worked. Today, many researchers publish vulnerabilities they discover on mailing lists such as Bugtraq. The press writes about the vulnerabilities in the computer magazines. The vendors scramble to patch these vulnerabilities as soon as they are publicized, so they can write their own press releases about how quickly and thoroughly they fixed things. The full disclosure movement is improving Internet security.

Re:A Darker Shade of Grey Hat

[maxpublic]

It's called professionalism a.k.a. an endangered species here at slashdot.

No, it's called "corporate cocksucking", which started when certain comapnies started threatening to sue folks who publicly reveal security flaws in their products. Nothing more than craven cowardice dressed up as 'good manners'.

Max

Re:A Darker Shade of Grey Hat

[MerlynDavis]

That's pretty pathetic to just release exploit code without giving the vendor a chance to respond. Heck...folks even give M$ a chance to build a patch before releasing exploit code...why not Google??

It's not about "easier"...it's about what's right.

Re:A Darker Shade of Grey Hat

[MerlynDavis]

You state that as fact, yet full disclosure is probably the most widely accepted way of dealing with exploits--and the most widely advocated by security experts. It's at the very least a matter that's open to a lot of debate. Full Disclosure is one thing... Actually posting usable exploit code or directions on how to do the exploit is another...and unacceptable. A simple "Gmail has issues with malformed headers, please beware" would have sufficed.

Re:A Darker Shade of Grey Hat

[msuzio]

I think most people at least make an effort to privately contact the vendor first and give them a lead on any public disclosures. That's considered to be polite, even if you just give them a heads-up and 24 hours notice.

Re:A Darker Shade of Grey Hat

[pthisis]

Full Disclosure is one thing... Actually posting usable exploit code or directions on how to do the exploit is another...and unacceptable. A simple "Gmail has issues with malformed headers, please beware" would have sufficed.

Again, most security experts argue that you MUST disclose working code (NOT an exploit, but code demonstrating the problem) and detailed descriptions, not simply a vague statement--that's why it's called full disclosure.

Bruce Schneier, e.g., writes in http://www.schneier.com/crypto-gram-0111.html:

And detailed information is required. If a researcher just publishes vague statements about the vulnerability, then the vendor can claim that it's not real. If the researcher publishes scientific details without example code, then the vendor can claim that it's just theoretical. The only way to make vendors sit up and take notice is to publish details: both in human- and computer-readable form. (Microsoft is guilty of both of these practices, using their PR machine to deny and belittle vulnerabilities until they are demonstrated with actual code.) And demonstration code is the only way to verify that a vendor's vulnerability patch actually patched the vulnerability.

Re:A Darker Shade of Grey Hat

[MrYowler]

Feh. I have reported issues like this many times, and the nearly universal result is that:

my accounts get cancelled

I become the target of blame for any compromises that they cannot otherwise easily explain away

the bug does not get fixed, and

I continue, despite significant credentials, to be employable only as a stockboy at a grocery store.

Forgive me my smarmy twitness, but the article has been up on SlashDot - much to my surprise - for about seven hours, and I could not read it because I was engaged in the important business of putting ice cream out where small children could insert their fingers into it.

I did not seriously think that the article would get printed, much less that any action would be taken on it, and I certainly do not seriously expect to ever get a job out of it. I have spent years licking the tail ends of suit-wearing twits while they tell me how little I know about this or that - or, conversely, while they tell me how overqualified I am to make a living. Professionalism and courtesy will buy you a kick in the ass, if it gets you anything at all. I still do it, most of the time, despite the worthlessness of the effort, because rudeness doesn't change anything, either. But you know, there is more than one way to be a twit. Thanks for condescending to us. We were very probably not the first people to discover the problem - the rest simply chose not to tell anyone about it. Which would you prefer - the reported discovery, or the exploited one?

I'll also point out that while you label me as a darker shade of grey, the darker circles label me a browner shade of white, for having spread the information around. It's an interesting change, in the industry, to see us moving away from the ethical imperative that 'information wants to be free' - on both the black and white sides of the fence. Where would the people who are making this move, be, if that imperative had never been in play? Do you also blame SlashDot for printing the information? Do you not realize that it is only because people were interested, that it appeared?

Re:A Darker Shade of Grey Hat

[Goaway]

Would you like some cheese with that whine?

Well...

[grub]

Yeah, it's a potential privacy breach. That said, using a web-based email system for top secret or potentially embarassing mail is pretty dumb. You get what you pay for, gmail is no different. (nb: I'm a happy gmail user)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Newsflash

[hackstraw]

Speaking loudly in a public place can be intercepted!

Although this appears to be a valid bug in GMail (that is still beta mind you, and will probably be fixed very quickly), who in the world considers plain text communication secure?

I have no idea who at my ISP has root access (or others that can gain root access) to read my plaintext mailbox.

Nothing to see here... please move along.

Re:Newsflash

[Country_hacker]

Looks to me like they already fixed it, I tried sending an email without putting the end bracket on the address (Just like the guys in TFA) and it popped an error message. Those guys at Google are on the ball today. :-)

Re:Newsflash

[Wordsmith]

Ideally, the machines at the ISP would be set up so that even Root couldn't read the mail under normal circumstances - it would be encrypted and only tranlated to something readable at the request of the user.

But then again, I doubt that's actually the setup in many, many places.

Re:Newsflash

[dAzED1]

if its translated to something readable by the user at their request, then that is done by a a tool on the system. The user merely has pop/whatever access . Its not like they're going to do much that is special (since we're talking Joe-Blow user here, not the DoD)

So, armed with root, you just run that tool yourself. Wow, that was difficult.

Re:Newsflash

[OverlordQ]

No, it still works.

Net::SMTP>>> Net::SMTP(2.29)
Net::SMTP>>> Net::Cmd(2.26)
Net::SMTP>>> Exporter(5.58)
Net::SMTP>>> IO::Socket::INET(1.27)
Net::SMTP>>> IO::Socket(1.28)
Net::SMTP>>> IO::Handle(1.24)
Net::SMTP=GLOB(0x182eb00)<<< 220 mx.gmail.com ESMTP 35si124276wra
Net::SMTP=GLOB(0x182eb00)>>> EHLO localhost.localdomain

Net::SMTP=GLOB(0x182eb00) <<< 250-mx.gmail.com at your service
Net::SMTP=GLOB(0x182eb00)<<< 250-SIZE 20971520
Net::SMTP=GLOB(0x182eb00)<<< 250-8BITMIME
Net::SMTP=GLOB(0x182eb00)<<< 250 ENHANCEDSTATUSCODES
Net::SMTP=GLOB(0x182eb00)>>> MAIL FROM:<>

Net::SMTP=GLOB(0x182eb00)<<< 250 2.1.0 OK
Net::SMTP=GLOB(0x182eb00)>>> RCPT TO:<overlordq@gmail.com>

Net::SMTP=GLOB(0x182eb 00)<<< 250 2.1.5 OK
Net::SMTP=GLOB(0x182eb00)>>> DATA

Net::SMTP=GLOB(0x182eb00)<<< 354 Enter mail, end with "." on a line by itself
Net::SMTP=GLOB(0x182eb00)>>> From: <test@test.com
Net::SMTP=GLOB(0x182eb00)>>> Subject: test
Net::SMTP=GLOB(0x182eb00)>>> Simple test message
Net::SMTP=GLOB(0x182eb00)>>> .
Net::SMTP=GLOB(0x182eb00)<<< 250 2.0.0 OK 1105553059
Net::SMTP=GLOB(0x182eb00)>>> QUIT

Net::SMTP=GLOB(0x182eb00)<<< 221 2.0.0 mx.gmail.com closing connection

Re:Newsflash

[M.C. Hampster]

The problem wasn't that it was accepting mail that looked like that, it was that when reading the email that contained the faulty send line, it would read past the end of the "From" line looking for the matching >, which could result in a sort of buffer overflow that would read into other people's messages.

You need to actually look at the message you sent in the GMail interface to see if it has been fixed.

Re:Newsflash

[Wordsmith]

I said ideally. What would be wrong with an ISP that ONLY will deliver encypted mail, and that requires secure logins and password authentications etc to access it? Why is unencrypted mail over pop3 with plaintext passwords still so common when alternatives exist, and are usually supported by most e-mail clients?

If I was an ISP, I'd be advertising security (which protects you from, say, identity theft) as an option, and explain that with freely available e-mail programs and PGP you can lock things down so much that even the ISP admins can't read your mail.

Re:Newsflash

[OverlordQ]

yea . . it works.

Re:Newsflash

[MrYowler]

If only it had been so easy to reach them, in the first place... ;-P

I'd have loved to have been able to report it quietly, and just seen it fixed...

Well hey..

[sinner0423]

Google = best & brightest, right?

I mean, their aptitude tests & hiring policies makes me believe they've got a few nobel prize winners working there..

Shouldn't they be able to fix this during lunch break?

Re:Well hey..

[Anonymous Coward]

I mean, their aptitude tests & hiring policies makes me believe they've got a few nobel prize winners working there..

Yes, but they are busy playing with colored balls and rolling around on Segway-scooters.

The real work is done by 4$/h student-workers.

This is no lie, believe me.

Re:Well hey..

[LiquidCoooled]

Just above you in the postings:

Re:Newsflash (Score:3, Informative)
by Country_hacker (639557) Alter Relationship on Wednesday January 12, @17:41 (#11337181)
Looks to me like they already fixed it, I tried sending an email without putting the end bracket on the address (Just like the guys in TFA) and it popped an error message. Those guys at Google are on the ball today. :-)

Re:Well hey..

[justforaday]

Ummm...never? They're PhDs. They'll simply hold conferences to discuss the bug...

Re:Well hey..

[Shafik]

Long Term Capital Managment had Nobel Prize winners doing their risk management and look where that ended, a nice multi-billion dollar tax-payer funded bail-out:

LTCM, a hedge fund above suspicion
Wikipedia entry

Re:Well hey..

[Xerp]

I fixed this already. Just start each message with a > Next!

Re:Well hey..

[MrYowler]

It seems that they did... :)

And yes - they do have some very sharp folks working there. My ascerbic comments are mostly borne of the fact that I'm not one of them, and my place in life is just slightly higher than your average illegal immigrant... ;-P Call it a bit of jealousy, if you like.

You mean there is a server-side bug in GMail

[Idaho]

From the description, the way you can read messages of other people has nothing to do with 'intercepting' messages. Man in the middle attacks are always possible, but this looks like a simple serverside bug (buffer overflow or string formatting problem, most likely) which will probably be fixed on short notice.

I don't think you can do directed attacks either (e.g. 'intercept' only the mail of a specific target). So I think it's not a real showstopper.

Still, it shows that even Google can make mistakes in their code...who would have thought! ;)

Re:You mean there is a server-side bug in GMail

[Edward Faulkner]

...has nothing to do with 'intercepting' messages...

You are correct. But we should remember that actually intercepting your messages is quite easy for anyone on your subnet, or anyone controlling a router between you and GMail.

The login is SSL encrypted, but after that it's plaintext. It's a scalability issue.

end of the world is coming!!

[jxyama]

headless $500 Mac and $99 iPod...

now Google messes up...

with all the natural disasters happening, i cannot think of a good reason why the world wouldn't end the day after tomorrow.

Re:end of the world is coming!!

[A Cheese Danish]

Jyxama said:

cannot think of a good reason why the world wouldn't end the day after tomorrow

The world probably wouldn't want to do that, seeing as how the MPAA would want to sue the World for copyright infringement on one of last year's summer "blockbusters".

Though personally, I think the world has a bit better taste than that. ^_^

Re:end of the world is coming!!

[Lord Bitman]

I guess the world isnt doomed, people still dont know the difference between a trademark and a copyright on slashdot.

Re:end of the world is coming!!

[David Horn]

Surely the world should end on a Thursday...

Re:Are you communications private?

[American AC in Paris]

I don't even know where to start with this one!!!!>

Simple.

All you communications are belong to them.

Let me just say..

[Wes Janson]

Oh shit!


Couldn't they have notified Google first, before going public? Given them time to take action? I don't like the fact that my email is suddenly vulnerable now that everyone and their brother knows how to intercept gmail messages.

Well...

[slavemowgli]

Serious as it may be, this does not allow you to selectively attack a specific person or account - you just have to "hope for the best", so to speak. While I wouldn't underrate it (is that a word?), I wouldn't overrate it, either, and I'm pretty sure that the Google people will plug this in no time. It's been my experience that they do look at reports that are coming in (just like they claim), and that they are generally quite quick to fix even minor issues, so something that is security-related *and* (by the sounds of it) easily fixable shouldn't last long.

That being said, did the authors actually contact Google about this prior to making the whole thing public? Full disclosure is good, of course, but it's also nice to give the vendor a chance to fix things before you inform every script kiddie in the world about what you found. :)

Re:email unsecure: news at 11 (n/t)

[paulhar]

So why put any text there? Sort of defeats the object... a bit like "This Page Intentionally Left Blank".

or my fav... "test message... please ignore" that you just _have_ to respond to...

Re:Gmail Inivation Emails here

[derphilipp]

I have sent you an Invitation.

Re:To be fair...

[ballsanya]

Does anyone do this with MS, or do they post it on Slashdot so we can all laugh and make fun? It's the same thing weather you like the company or not.

All email is vulnerable.

[pavon]

To everyone expressing concern about using gmail in light of this exploit - I hope you know that all email is vulnerable to interception. It is sent as plaintext across the internet, and hops though a dozen servers before ending up at it's final destination. This exploit is just another way to do something that has been possible by design ever since email was created.

If you want your email to be secure you have to encrypt it. Otherwise don't have any expectation for privacy.

Re:All email is vulnerable.

[Carthag]

This exploit uses a flaw in Google's code that allows viewing of memory on Google's servers. Hardly an inherent flaw in email as such.

Re:All email is vulnerable.

[CharlieHedlin]

This is getting better, many mail servers will use TLS (same protocol as SSL for the most part) for the communication between servers, and dozens of mail servers is a bit more than reality. Some ISPs may have 2-4 servers it will pass through internally, and then the next ISP may have 2-4.

I have administered SMTP servers for small businesses and small to midsize ISPs for 10 years.

Re:All email is vulnerable.

[TheGavster]

Message bodies aren't the only thing being retrieved; this exploit gets whatever data was hanging around at the time, including sets of usernames and passwords. Rather than seeing mail as you send it, an attacker could just log into your account.

Re:All email is vulnerable.

[Spy der Mann]

I hope you know that all email is vulnerable to interception.

Including usernames and passwords? O.o

Re:All email is vulnerable.

[hughk]

Heard of gpg/pgp? It works with gmail as well as most other Email systems. The best you will get is a sender and a recipient.

*nod*

[derfy]

I'm ok with that too, as long as there is some indication that it is being looked at, and not just shoved under the rug.

Also, ISTR hearing about this bug a few months ago. If it's all over the net, chances are good it's getting some attention.

In other news...

[khrtt]

E-mail messages succeptable to interception!!

Re:In other news...

[un1xl0ser]

Messages are vulnerable to interception!

GMail vs Hotmail

[kevin_conaway]

Why is everyone brushing this off by saying "well you should have known that email isnt secure, tough luck!"

If Hotmail had this bug, everyone here would be up in arms.

Just because email isnt secure doesnt mean this isn't serious. I would hate to think of all the people reading my responses to craigslist postings :)

Re:GMail vs Hotmail

[iapetus]

What does the word at the bottom right of this image say? (Clue: you won't find it on the Hotmail site...)

Re:GMail vs Hotmail

[valkraider]

What do you think BETA is for? Isn't the whole purpose to find and fix bugs exactly like this?

Re:GMail vs Hotmail

[Loco3KGT]

You're not trying to imply /.ers are biased, are you?

Re:GMail vs Hotmail

[LocoSpitz]

If you know that your product may well have serious bugs like this, you shouldn't have sent out a press release promoting its launch, you shouldn't have given away free accounts to thousands of Blogger users, you shouldn't allow people to fire off a bunch of invitations to anyone they choose, and you should make some indication on the website (beyond "BETA," not everyone who uses Google reads Slashdot) that there can be risks associated with using it.

Re:GMail vs Hotmail

[valkraider]

If you know that your product may well have serious bugs like this, you shouldn't have sent out a press release promoting its launch, you shouldn't have given away free accounts to thousands of Blogger users, you shouldn't allow people to fire off a bunch of invitations to anyone they choose, and you should make some indication on the website (beyond "BETA," not everyone who uses Google reads Slashdot) that there can be risks associated with using it.

Hmm. I wouldn't try Windows if I were you...

Re:Are you communications private?

[Anonymous Coward]

Are you communications private?

I don't even know where to start with this one!!!! Editors? You out there???

He's talking to the communications. Example:

"Are you guys ready?"
"Are you folks hungry?"

Interception

[the eric conspiracy]

GMail messages are vulnerable to interception.

Can anyone name a form of message that isn't vulnerable to interception?

Duh

[Jeffrey Baker]

That's what you get for writing your OWN web server instead of using Apache or Zeus or whatever:

Server: GFE/1.3

For more fun, check out how ebay's static and images server returs responses null-padded to 4KB boundaries (usually).

Re:Duh

[Jeffrey Baker]

What I mean is, please notice that they often return responses null-padded to 4KB boundaries, which gives some insight regarding how their HTTP server is implemented.

Way to go, jerks.

[Canthros]

You did notify Google and give them a reasonable period to time in which to respond, right? Because you've just shouted, in the loudest possible way, how to access all that data you're so worried about protecting.

SPAM!

[knitterb]

Chances are, since most email these days are spam, an attacker is going to have to go through a lot of spam before finding something interesting.

Re:SPAM!

[Richie1984]

Unless they're specifically after herbal penis enlargers, or super zoom spy cameras, and just aren't lucky enough to be spammed with adverts for them.

Re:SPAM!

[Peldor]

Yes, but couldn't our nefarious attacker use Google's mighty search tools to find the interesting bits?

Re:Kinda Open

[Glonoinha]

A breech is a breach of Goatse proportions.

i tried...

[tcollier]

sending my own malformed message, but I didn't see any extra info in the headers....

Well...

[Anonymous Coward]

I tried to exploit it, but it appears to be fixed...

Re:Communicating

[donnyspi]

I think you have to solve a math problem first.

Yawn...

[revery]

I already read about this in a newsletter that I received in the "Reply To" field of an email.

--
Was it the sheep climbing onto the altar, or the cattle lowing to be slain,
or the Son of God hanging dead and bloodied on a cross that told me this was a world condemned, but loved and bought with blood.

This was more about their 15 minutes than Google.

[EvilFrog]

Many other people have pointed out that GMail is still in beta, and that if they would have told Google first it probably would have gotten quietly fixed without any damage being done.

Of course, they acknowledge that, but they're arguing that they're helping protect people by making them aware of the problem.

I call bullshit. This is about them wanting recognition for finding the bug. If they would have sent it to Google, it would have been fixed and no one would care who discovered it. Because they went public with it they can boast that they were the ones who found the bug.

Of course, it swings both ways. Now if someone uses this exploit and steals your password (which is honestly rather unlikely), you know who to blame for making it public knowledge before Google had the chance to fix it.

Just a simple, obvious case of omitting a letter

[jdcook]

It should read, "Are you a communications private?"

To which I would answer, "No, I am a communications major."

The Emperor is Naked

[hashmap]

Guess what? The Emperor is Naked

This must be the most trivial, ridicuolus and dangeorus bug I have ever seen in an email system

Now everybody and their little sister will start creating these emails, it is trivial to do on a large scale, everybody is screwed, your only hope is that it will happen to someone else

stupid, stupid Google!

Gmail is FREE!

[scottennis]

Need it be said: You get what you pay for.

Re:This was more about their 15 minutes than Googl

[hashmap]

Now if someone uses this exploit and steals your password (which is honestly rather unlikely), you know who to blame Who? The one who made the mistake or the one that found it? Heh.

I wonder if...

[dAzED1]

..this effects the other person's email in any way? The only way to know would be for them to email the people whose email addresses they've cencored, and ask them to check those particular emails. I wonder if they may have gotten corrupted too due to this, before the buffers were flushed?

Broken XML

[Glonoinha]

Jesus - am I the only one to recognize this bug?
This is just the most publicly seen instance but broken XML does this every single day.

Use the greater than and less than signs as data delimiters in the 'next generation' of data encoding (XML)? WTF were they thinking?

I'm not 100% they are using true XML but from the looks of it if they aren't they are using a home-built XML wanna-be and - well it looks like I was right a few years ago when I (unsuccessfully) campaigned against doing it that way. Not that I campaigned very loud, as I am basically a nobody.

Re:Broken XML

[Anonymous Coward]

> Use the greater than and less than signs as data delimiters in the 'next generation' of data encoding (XML)? WTF were they thinking?

Hardly the "next generation". SGML has been around since 1976.

Re:Broken XML

[ezberry]

true, but sgml doesn't require delimiters. You can make it whatever you want.

Re:Broken XML

[CK2004PA]

Gmail is BETA, you do know this correct?

For those of you who aren't familiar with IT lingo, Beta means not ready for mass consumption. Your trying our a new food or drug product. It may had adverse effects on you, including death.

Get over yourselves already. Gmail is a great client, it will have flaws, but I'm sure Google will fix them.

To critique Google, they should have some method for anonymously submitting security defects/flaws. Or non-anonymous for you attention whores.

Re:Broken XML

[sidb]

Use the greater than and less than signs as data delimiters in the 'next generation' of data encoding (XML)? WTF were they thinking?

Well, you've got to use something to delimit. As long as people aren't writing XML files by hand, it shouldn't be a problem. And it they are, the increased readability of < and > is surely preferable in terms of usability to that of something like a null character. What would you have used?

Re:Broken XML

[blackpaw]

Big fat duh ! the problem in question is in a RFC822 header, *not* XML

Re:Broken XML

[LocoSpitz]

If Beta means "not ready for mass consumption," why is Google acting like it is? They announced GMail about nine months ago and received press coverage for it. They must have tens, if not hundreds, of thousands of users thanks to the ever-increasing number of free invites and accounts given to Blogger users. Correct me if I'm wrong, but other than the small "Beta" text under the Google logo, there's nothing on the GMail site to indicate to a user that there may be a risk involved with using it, and you can't reasonably expect people to know what "Beta" means, as you note in your post.

Maybe Beta SHOULD mean it's not ready for mass consumption, but Google's not acting like that. In fact, most of their services - Alerts, Catalogs, Froogle, Local, News, Scholar, Desktop Search - are in Beta, and are no more than a click or two away from the front page.

Re:Broken XML

[Glonoinha]

How about ASCII characters AE and AF?
That's like a double LT and double GT character, not something the end user is likely to fat-finger during data entry.

Re:Broken XML

[Dwonis]

Well, you've got to use something to delimit.

Why? People have been using length+data encodings for decades.

Re:Broken XML

[Deekin_Scalesinger]

I (along with many other people I am sure) notified GMail of this yesterday after reading this story. I got the following in my Inbox this morning:

Hello,

Thank you for your message. Today, Google was alerted to a security
vulnerability affecting Gmail, and our engineers quickly resolved the
issue. A very small number of Gmail users were affected, and all Gmail
accounts are now protected from this vulnerability.

Google has the highest regard for the security of our users' information
and we apologize for any concern this issue may have caused. Thank you for
taking the time to contact us.

Sincerely,

The Gmail Team

Nice to know that they do read and respond appropriately to both problems and concerns raised to them.

or rather

[apparently]

#include <std/security_through_obscurity_rant.h hey moms, it's big poppa here! be looking to fly with you 2nite an' get a little stank on mah hanglow, dig-it?! It's gonna be a <B

Re:Gmail Inivation Emails here

[skeptic68]

Instead of posting requests for Gmail accounts here (where they are offtopic). Use http://www.gmailswap.com/ [Gmail Swap] where they are very happy to give you an invite. Ignore any messages that want something in return, you can easily get an account for free.

Re:Dear krog

[Cromac]

When was the last time you even saw your postman, do you camp out at the mailbox? How much time do you spend in the back room at your local post office, how about the regional mail distribution center? Does your mailbox have a lock on it (some do), if not how do you know your neighbors aren't opening it up and taking a peek while you're at work?

5 Free Invites

[mwagner_00]

Kind of off topic, but might as well give them away here.
http://gmail.google.com/gmail/a-2f47c4c506-34d0abf bce-41a4dc0b1b
http://gmail.google.com/gmail/a-2f47c4c506-7094575 c12-936bc39037
http://gmail.google.com/gmail/a-2f47c4c506-7193e26 450-b2a929bc15
http://gmail.google.com/gmail/a-2f47c4c506-a3a547d b1e-7df6129e51
http://gmail.google.com/gmail/a-2f47c4c506-af561c1 f25-4a3c395b3c

Re:5 Free Invites

[funk_doc]

Great Idea, 6 more invites: Invite
Invite
Invite
Invite
Invite
Invite

Reads encrypted zip files

[Free_Trial_Thinking]

The strangest thing happened to me when using gmail a few weeks ago. First I tried to send an .exe file, and of course gmail told me, "you're not allowed to send .exe files". So I changed the file extension and still got the same response somehow. Ok, then it gets weird:
I figured I could hide it in a zip file so gmail wouldn't notice, and it still tells me I can't send an exe file!, then I encrypt the zip file, figuring there would be no way gmail could see what's inside, and it still finds the .exe file somehow!

It really felt invasive to me to think that google is looking inside my encrypted zip files. I sent them a letter but never heard anything back.

Does anyone have any insight into this? If you don't believe me, try it for yourself.

Re:Reads encrypted zip files

[MrP-(at work)]

I think its because gmail doesnt allow zip files either.

Re:Reads encrypted zip files

[emeyer]

I don't think GMAIL/GOOGLE is looking inside the zip files. I just did a test with a ZIP file that contained a BMP file and it wouldn't let me send that. I think it just bitches about any zip file. (A real PITA by the way.)

-Eric

Re:Reads encrypted zip files

[Prophet of Nixon]

Just send Rar files... it can't read inside them, and unlike zips they won't sometimes corrupt files with pre-existing compression.

Re:Reads encrypted zip files

[MyoTechie]

Parent is correct from my observations. Google does exhibit some interesting behavior with zips. I have been sending zip attachments to my account for some time now.

In one of my recent zips I had an exe and the zip was rejected. After removing the exe it worked without issue. I also believe that some scripting files will be rejected as well.

Re:Reads encrypted zip files

[4titude]

Encrypting a zip file only encrypts the data inside the files, not the filenames... so google can easily look at the file NAMES inside the zip, just not what they contain. Solution: use rar or any one of the 10+ better archivers than zip

T-Shirts

[txz]

Wasn't the people at google wearing "I read your Email" T-Shirts at the Blackhat Conference?

I hope GMail wasn't there backup plan

[motherjoe]

Gee, I hope Gmail wasn't the secret service's plan B option for email use.
http://yro.slashdot.org/article.pl?sid=05/01/12/07 50227&tid=172&tid=215&tid=158

need invite

[Anonymous Coward]

Please send an gmail invite. the last one got intercepted...

Hacker Hubris

[Jtheletter]

Wow, are these guys full of themselves. I write complex automation code for a living, in an environment that demands rigorous QA practices and documentation, but guess what? We still create bugs, find latent bugs that have gone undiscovered for many builds, and even get some real DUH! headslappers from time to time. Fact of the matter is, when you've got a couple hundred thousand lines of code there are going to be errors and unintended consequences, mostly arising out of missed checks, such as this gmail problem (assuming they're right about the end tag check being the cause).

For these people to find a single issue in such a system, then say it's a shortcoming of gmail's QA process, and in the same breath ask for work - implying they've got the skills to even handle such a job - is insulting. Please, just because you're smart enough to expose a flaw once you stumbled onto it in no way means you are qualified to correct that or any other issue. Sometimes our QA team finds a flaw and even digs in the logs enough to pinpoint the problem but it can still take the developer who designed the code days to correct.

In other words, noticing that you're bleeding does not qualify you as a surgeon. Instead of publishing their finidings in a detailed how-to, these asshats should have forwarded the info to gmail and let them deal with it, and that's assuming that the gmail team didn't already have it in their list of bugs. I just don't understand why people feel the need to not only describe a security problem, but give every hacker on the net a roadmap as to just exactly how to use it and what illicit activity it might be good for.

Re:Hacker Hubris

[imgunby]

I've been in QA for just over 8 years now, with the last 4 being devoted to web application QA, and the last 2 with an eye towards "security" type testing. This is definately a clean attack, albeit poorly reported and of questionable value due to the random nature of the returned data. While some will see this as a pure developer failure for failing to sufficiently parse the input, as was mentioned, this was only brought about by the malformed request from a incompletely written homegrown emailer. I would expect and assume *most* testing organizations would miss this type of issue, and in some cases, I would expect that this would be extremely complex to resolve, and in most cases, the desire to resolve the issue will usually be overridden by the "business" needs of releasing software.

Re:Hacker Hubris

[MrYowler]

Yaknow...

It's not as though I weren't professionally credentialled, myself. I do have a CISSP and Cisco credentials - I just don't wave them around like badges of honor. I worked as a network programmer for guys like Inktomi (now Yahoo) and WebTV (now MSNBC) for several years, after starting two of my own very successful telecommunications service companies. That things went south for me, during the crash of the Internet economy, does not mean that you are somehow superior - just that you were lucky. Or perhaps young.

To demonstrate system complexity; I worked for the US Air Force, writing code to perform gamma spectral analysis in a nuclear chemistry laboratory, at one time. As for qualifications; I have worked for two organizations on high-capacity email systems; WebTV (now MSNBC) is one of them. I have ten years of college, 20 years of professional experience in various information technology roles, and a wealth of paper credentials.

I *do* have the experience and intelligence to both assess and correct the problem, and I was fairly certain that GMail would be capable of correcting the problem in sort order, if/when they chose to do so. And while I'd love to work there; no, I don't seriously expect this report to get me hired. There is a little more to the interview process than that, I suspect... ;-P

It *is* possible that the person who sees that you're bleeding - he just *might* be a surgeon.

You are guilty of the same assumptions that you accuse us of. You have assumed that we are a couple of ignorant fools who stumbled onto something, and you are degrading us for having the arrogance to publicly report on it. You further assume that we did not attempt to privately report on it.

The fact is that we tried. We could not find a reporting channel that elicited an apparent response, and so (with much needling and pushing from NSA Wally) we reported on it, somewhat more publicly. I frankly did not think that anyone but NSA Wally and I would even give a damn. And indeed, no one would have, except that we provided a detailed roadmap to the vulnerability. In fact, I seriously doubt that we would have gotten anywhere with the article, if NSA Wally had not happened to run across a username/password pair, in one of the messages that he intercepted.

And while I realize that our use of handles gives rise to the immediate assumption that we are '3v1l h4x0r5', the fact is that we like our privacy, and the psuedonyms serve to help us maintain it. You'll have to ask NSA Wally why he needled me into writing the article, or why has the name that he does. I think the latter has something to do with a bunch of people accusing him of being a member of federal law enforcement. I think that he did not want to argue the case. The former, I could not even speculate - but I'm not fond of arguing, either, and the article did not require much effort to write.

I seriously doubt that we were the first people to find the problem - more probably, we were just the first to bring attention to it. GMail accounts may have been being compromised in this way, for who knows how long - and this information used to compromise eBay/PayPal accounts, Amazon.com accounts (and the financial data that they retain for customer 'convenience'), and who knows what else. It is a fundamental fact of information security policy development, that such policies are designed to protect the organization that creates them - not necessarily the users, vendors, employees, or affiliates of the organization. If you publicly report on these issues, when you find them, then yes, there will be some abuse by the script-kiddies who hear about it. But the issue also suddenly becomes important, and resolution is usually rapidly forthcoming, because the problem is now high-profile. If you don't report on it, it may remain unknown to the folks who fix these things, or it may remain low-priority, because it does not represent a risk to the organization responsible for fix

WORKAROUND

[Lehk228]

From what I read on the site you could protect your message from interception by placing a '>' character at the start of yout subject line or message body. If you are concerned about privacy use a > until they fix the bug.

Re:WORKAROUND

[fbartho]

not quite, they very probably would escape that for you... :)

Did anyone else see this?

[Lank]

At the bottom of TFA:

Screen Capture #5
Jack Rabbit Vibrator Features

This message describes the features of one "Jack Rabbit Vibrator," a 7.5" Multi-Speed toy of sorts.

What are the odds of finding that?

Re:Did anyone else see this?

[Donoho]

What are the odds of finding that?

Yup, still laughing. Based on porn industry numbers, not that bad.

Client side contamination between accounts

[behindthewall]

I have two gmail accounts (I'm evil). I tried to open both simultaneously in separate Firefox tabs. A short time after opening the second tab / account, I switched back to the first, to find the inbox listing the messages from the second account. Refreshing the page brought the entire page display to reflect the second account.

I've also witnessed on at least one occasion an https session surviving overnight, with the POTS connection severed during this time.

These experiences have already led me to consider gmail less than secure.

The Google people are very, positively imaginative and creative. But they are not, at least not at first pass, all seeing. There are details to security that require some grinding detail and a lot of testing. A good language and a smart approach can lessen the grunt work, but a significant amount is still necessary.

I think people haven't come down on Google like they do on MS because, in large part, Google is straight forward and direct in its communications and its intentions. And when a bug pops its head, they consider it a personal priority to correct it. Not just a business priority, based upon cost/benefit, but also the PERSONAL priority of those at Google who are involved in the issue.

I hope they'll fix this quickly, and take a good, hard look at their server and session management. Looks like there's a serious need for better compartmentalization, and for data scope management.

Re:Client side contamination between accounts

[Anonymous Coward]

one cookie in one browser, no wonder your system showed the same data.

Re:Client side contamination between accounts

[behindthewall]

Yes, but other providers, e.g. ziplip, are able to avoid this. On a machine that's shared, I'd have hesitation about what might potentially be exposed.

I'm no expert in web based applications. But it causes me concern.

Re:Client side contamination between accounts

[valkraider]

Google is not *really* or *purely* web based. Google is using a custom applet through the web browser, utilizing the connection and VM of the browser. The other sites might be passing session information on the URL instead of with a Cookie, or they could use a combination of both or maybe have more info in each cookie. There are a thousand ways to do this stuff, and no two sites will chose the exact same way.

This is nothing odd, sinister, or bad. And if you use a shared machine, you should have it deleting cookies when you close the web browser, or delete them yourself.

Re:Client side contamination between accounts

[behindthewall]

A little news. I sent an email to google, after writing my post. It took one back and forth to get past the "form letter" response they were sending right after the "broken brackets" news hit (sounds like they received quite a dose of emails at that time).

After that, I received a personal response and an indication that my concerns were being forwarded.

Yesterday, 1/16, I noticed some new behavior on sign out. I see it again today.

I haven't had a chance to investigate more thoroughly, but it's obvious they've already addressed some aspects of their session management. E.g. one cannot back button from sign out back into a session.

That's a 3-4 day turnaround. I'm not saying I caused it; regardless, it seems things are already being done that ameliorate some of my concerns.

I'd say that's pretty damned good.

Re:Are you communications private?

[bogado]

Missing an 'r'?

Are your communications private?

Doesen't seem too bad to me. But I am just a foreinger... :-D

unlimited space

[marafa]

for 6usd a month one can find a reputable compnay to provide him wtih more than one mega of mail. thats like unlimited quota constrained by your wallet.
and to top it off, u get a bonus, space to put your own weblog too!

Security 101

[bill_kress]

NOTHING is secure. Everything on the net lasts forever. It can easily be intercepted, archived and screwed with in a hundred different places, and since it's around so long, eventually someone is going to figure out the encryption.

So if you are worried about your companies cooked books, your mistress and your assanitation plan being discovered--DON'T write Email about them!

Also, by the way, if it's that important: Don't post it in a chat room or BBS, even "Anonymously", don't write or type it anywhere, don't get drunk and brag about it to your co-workers and prey that you don't talk in your sleep.

Re:Security 101

[narcc]

and prey that you don't talk in your sleep.

That's how I ended up here. My youngest boy heard me saying in my sleep: Down with big brother, down with big brother!

He's a good boy, called the though police right away.

Gmail is _NOT_ FREE.

[Spy der Mann]

There's the ads, remember?

The real losers here are the advertisers if Google doesn't fix this thing.

Still, gmail is in BETA, has an INVITATION-based signing up scheme. And no software is bug-free.

Anyway, thankfully I don't keep private info on my spydermann.slashdot g-mail account :)

I MISS THE SUBJECTLINE TROLL.

[irc.goatse.cx troll]

Microsoft...

[IdahoEv]

with all the natural disasters happening, i cannot think of a good reason why the world wouldn't end the day after tomorrow.

Because M$ will release a bug-free, easy to use operating system with reasonable licensing three days from now.

avaliable invites

[DownTownMT]

I have already sent out all of my original invites to friends, and was recently given 10 more. If anyone wants them let me know.

Re:avaliable invites

[crazy_pikachu]

I have some too if any one wants some just let me know

Re:avaliable invites

[DrSkwid]

surely you mean lonely_thes@hotmail.com ?

Re:avaliable invites

[AvitarX]

I'd like one.

I have wanted one and nobody I know has one (well it doesn't come up in casual conversation)

email is up top.

Re:avaliable invites

[antirename]

I'd like to try it out... have an email adress to contact?

Re:avaliable invites

[crazy_pikachu]

send me your email adress at crazy_pikachu11@yahoo.com so I can send you a Gmail invite. I have a real gmail accound I just dont want to adress it to the world of slashdoters

Rather useless...

[SharpFang]

This exploit would be hardly interesting to a cracker. Suer it is a nasty bug, but it's too unpredictable to be useful. I mean, you can read -someone's- email, but not email of someone you're stalking or something like that. You may find a random piece of information, but there's no way you know what you find. With enough luck you can take over an account... of a stranger. The info could be sometimes used for malicious purposes, but it will in no way be profitable.

Re:Rather useless...

[MrYowler]

The probable practical application for the bug would have been to sniff for passwords being emailed to users, from PayPal, eBay, E*Trade, vendors who retain financial information for 'customer convenience', domain name registrars, and/or banks. Compromises of these accounts, on an opportunistic basis, would be possible - with enough raw data collected.

No, it's not a way to 'hack' GMail accounts. I'd have been a lot more aggressive about reporting a bug of that nature, had I run across one... ;-P

Malformed message, etc.

[dbacher]

OK so here's the vulnerability...

You send a malformed message, and you get some data remaining in the memory block. You can't control what account that data is from, it might or might not be something interesting to read and it might or might not contain sensitive data, etc. If you get lucky, someone using a single password at every site or a simply recognized pattern happens to have the one message that isn't spam in their buffer copied into your message so you can view it, you see their password, guess at the pattern and then have access to all of their data.

In the more likely case, you view their advertisement for v1agra.

Re:Crap

[Le Marteau]

Last time I checked gmail invites were going for less than a dollar per on ebay. On linuxquestions.org there is a whole thread of messages offering invites for free. There are more offers than people who want them. Gmail used to be cool and exclusive, and some of the coolness was the exclusivity, but today, anyone who wants an invite can get one in about five minutes.
Personally, I have my own email server with 40+ gigs free in my own domain, which is better than any web based email. And I can grep my own email myself, without the ads, thanks anyway.

Hey! I thought you had to "know" someone....

[microcars]

to get a GMail account.

I just read: "...you can't even sign up unless you know somebody else who has it"

however-to be fair, I've seen other postings like the parent on other discussion lists.
Just "Here's some GMail invites" and a list of URLs.

Re:This was more about their 15 minutes than Googl

[gingerTabs]

Of course, it swings both ways. Now if someone uses this exploit and steals your password (which is honestly rather unlikely), you know who to blame for making it public knowledge before Google had the chance to fix it.
Blame, or sue?

That word...

[joranbelar]

...spurious - I do not think it means what you think it means...

Re:That word...

[bperkins]

Nah. I knew it wasn't right. I was just looking for superfluous (thanks goofyspouse). Damn kernel messages flooding my brain.

I guess "extra" would have been OK too. :)

Re:That word...

[Lemm]

That's what you get for being supercilious.

Confidentiality notice

[trev2023]

At least they won't be able to use any "sensitive information" against you. Confidentiality Notice The information transmitted in this e-mail is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this e-mail in error, please contact the sender and delete the e-mail and any attached material immediately. Thank you.

Do we really think Google doesn't already know?

[et764]

Think of how many people at Google probably read slashdot. To think that now that it's on slashdot everybody knows except Google is kind of silly. Also, at least one person on here reported that it seems they fixed the bug already, which doesn't surprise me.

you should have expected this

[cg0def]

GMail is a beta as some of the other people mentioned and beta product even though they are not supposed to be buggy are still in testing stages and are not ready for production release. So is it surprising that there was another bug found in the system? Not at all. After all that's how all software gets developed. You test it to exhaustion and if it passes all the tests it's good to go. If not you fix the problems. And if you are using GMail you should know that you have already agreed to the possiblitly of having an unreliable service. After all this is why Google is gradually expanding the number of users.

That aside. I use GMail and Spymac since they were the first 2 free services to offer 1GB storage and google whips Spymacs butt in every aspect. So does that bug bother me? Not really. I use pop3/smtp access all the time and plus this bug will be fixed very soon just like all the other problems found so far.

Re:you should have expected this

[Hrothgar The Great]

That is SO GREAT that you posted that. ESPECIALLY since 500 people DIDN'T already make the exact same points before you. If I hadn't read your TIMELY and INFORMATIVE memo, I may never have known what a Beta is and I might have actually thought it was appropriate to discuss security flaws without being a shameless corporate apologist! Thank god you've pulled the wool away from my eyes!

Re:Gmail Inivation Emails here

[mobby_6kl]

Or try this invite spooler here

what does "beta" mean?

[mclaincausey]

I keep seeing that word on the gmail site...

When you use beta apps on your computer, do you expect them to be bug free? Why would an internet application differ from, say, a pre-release version of Longhorn?

If you are doing mission-critical email (as if email's even suitable for anything m-c) or are overly converned about privacy, here's an idea: try using established technology, and maybe even GPG. Don't use something that says "beta" for those sensitive transactions....

I'm glad this article was posted, I'm just confused by some of the reponses to it.

signed,
Captain Ob(li)vious

hmmmm - note to moderators

[orasio]

Parent is not flamebait, it is a real insult.
It could be called informative, because I honestly believe the guy is a dumbass. At least, not flamebait.
Insulting the guy is just what I felt like doing, because I thought it was a stupid question to ask, not a call for flames.
In the FAQ it doesn't say that "profanity" or insults are discouraged.
My post was even on-topic because it answered a question regarding the way the site works (why no no-text messages)

just a thought

Re: If they would have sent it to Google

[Catullus]

They may actually have tried to contact Google and failed.

Have you tried to send a GMail bug report to Google? It's really difficult! I tried it and whatever software they have to automatically scan bug reports kept misclassifying what I was saying. I gave up in the end; for a product in beta, they don't seem very keen to get feedback.

google on it already?

[WrenchPilot]

well after trying this out for myself, it appears google isn't delivering any mail (at least to my inbox) at the moment. after sending about 20 emails, half valid, half tesing the missing '>'. After 20 minutes, none of the 20 have reached my inbox.

A Job?

[jayloden]

lots of comments here are noting the hubris of these guys in asking for jobs.

I'd just like to add that not only are they criticizing the company's QA process and releasing the bug without having notified google first, as others pointed out...

They found the exploit by MISTAKE! It was a bug in their own code that caused the problem, something as stupid as a missing caret at the end of a line. So, in other words, they are looking for work looking for bugs in Google's software that they found solely because of a bug in the software they wrote.

On another note, bugs in software happen, no matter WHO you are, the trick is just to be able to fix them in a timely fashion and deal with the situation effectively. I believe that Google will do this, especially if the previous comment stating that it has been patched is true. Everyone is making too big a deal out of something that has happened to every developer on every software ever. The reason MS gets crap for it is simply because they continuously produce buggy code ridden with security issues, but deny this is the case, and often ignore security problems until they are found out by the general public.

-Jay

Re:A Job?

[MrYowler]

Hey, at least we were looking for our bug... ;-P

Seriously, though - I didn't even think this would make Slashdot headlines, much less result in a job. Sure, that'd be great, but get serious! I was just screwing around with a document that I didn't think anyone would ever see, for the benefit of NSA Wally, since he was prodding me to do it. Hubris? Please... I never expected YOU to be reading this, much less Google... ;-P

And for the record, yes, I did try to report it to Google, but to no avail. If they got my report, I got only an anonymous autoresponder, and saw no further indication that the problem was ever going to get human attention.

I'm frankly becoming sorry that we reported it, at all - there seem to be more people down on us for saying something, than there are people up about the fact that Google responded (appropriately) by solving the problem. Honestly, I didn't even expect THAT to happen...

Re:A Job?

[jayloden]

Well taken, and I don't hate you for it, I just found it amusing. I totally understand where you're coming from. I'm glad it was found by someone who at least reported it and bothered to make it public rather than just spy on lots of people for various reasons.

Look at the bright side, you're on slashdot :)

-Jay

Google not receiving?

[everythingischanging]

I haven't been able to receive any gmails for a half hour or so... maybe they've disabled incoming messages until they've sorted this all out?

Re:Google not receiving?

[SilenceEchoed]

I could be wrong (it happens a lot), but just in case...

Google's GMail doesn't use a port 25 SMTP due to the fact that a lot of ISPs block it. Try port 465.

Well, it's up now, but for future reference at least.

The sense of security coming from using a beta?

[Behrooz]

The sense of security coming from using a non-publicly-available product that is still in beta? Where the banner "Gmail by Google - Beta" is displayed at the top left of every page loaded? Where the 'Security' section of the user agreement is:

Security

You must promptly notify Google of any breach of security related to the Services, including but not limited to unauthorized use of your password or account. To help ensure the security of your password or account, please sign out from your account at the end of each session.

Oh yes, Google is certainly lulling us into a false sense of security.

Re:The sense of security coming from using a beta?

[ichimunki]

I agree that Google need not scream this from the mountaintop, however my response was more geared to the general sentiment that there was no downside to keeping security holes secret until they are fixed. It seems to me from your response that you are really stretching my statement into something that I did not write. I certainly wasn't trying to imply that Google was trying to put one over on the users. But that's the way you seem to have read it.

If the project is in beta and they track other bugs in public, then they really ought to be disclosing this one as well. Maybe that will drive home the foolishness of using a beta for critical or sensitive email.

gone GHISHING

[museumpeace]

I hope google fixes this poor buffer hygiene soon
But since we now have a published exploit, I will be damn careful what I send for a while except for the messages my script sends to me;-)
Since [as GBS pointed out] "GH" can be pronounced "F" and in "enough" I chriten this technique for dredging buffer junk for other people's goodies as
GHISHING
Which you would pronounce the same as PHISHING. And the GH might stand for Google Hack

Re:I'm New Here

[over_exposed]

No no, you don't get it! He's simply introducing himself to the community at large. It's a play on words, really. Because, you see, his name is actually "New Here," so when someone utters (types) the phrase "New Here" his attention is drawn. When someone mentions my name incorrectly, I like to correct them as well! Of course, if people kept telling other people that their name is in fact your name, wouldn't you want to correct them? Honestly...

John Doe (to UserX): You must be Bob Dole.
Bob Dole: No, I'm Bob Dole.
You: Fuck off.

See how your response is completely inappropriate? Granted, that wasn't the *exact* syntax for this exchange, but there's no need to nitpick.

BTW, New Here - you're my hero.

GPG..

[handmedowns]

I've been bugging google about gpg support built into gmail. Never get any response though.

Re:GPG..

[pluggo]

You probably don't want this.

Seriously. Think about it. You'd have to have a copy of your keyrings on the server... including your private key. Anyone at Google with proper access (plus any 5up3r-31337 h4xx0rz who make a properly malformed e-mail message...) can decrypt your messages at whim and sign messages as you, having only to break your password. (And if you had a huge supercluster like Google does, how long do you think that would take?)

Here's what I do. Turn on POP access, then run a POP client with a GPG plugin (Enigmail for Thunderbird kicks arse). Problem solved: your keyrings are still safe on your hard drive, and your communications are secure.

On another note, for those of you who are shocked that (gasp) someone may be able to read your cleartext e-mails, I have a news flash: e-mail is much more like a post card than an envelope. And, as my mailman once said, never write anything you don't want people to read on a postcard. (Kinda creepy, actually.)

Even lacking an exploit, any machine your message bounces through (gmail to MX to user, at best... with hops in between each host) is capable of sniffing it. Ever submit a form for the first time in a fresh install of a web browser? "Unencrypted information may be observed, blah blah blah." The same goes for e-mail.

More like an unsealed envelope then a post card

[LordZardoz]

Rather then a post card, I would say it is more like sending a letter in an unsealed envelope.

You can see the content of a post card just at a glance. You can glance at things by accident. You can read an unsealed letter, but first you have to take it out of the envelope. You cannot do that by accident.

You cannot accidently catch a glimpse of an e-mail, you have to intentionally look at it.

END COMMUNICATION

Far more disconcerting...

[PornMaster]

Far more disconcerting is the label American online in the screencaps.

free gMail anyone ?

[lixlpixel]

gmail invites - first come, first serve

get one for yourself @ http://fundisom.com/free-gmail.php...

and if you don't get one now - i'll add many more over time.

and if you manage to get one and feel like saying thanks - have a look at the ads on the page...
enjoy...

Re:security through obsecurity praise= +5 insightf

[mattgreen]

Burn the AC, he's using logic!

Is this really a big deal?

[qray]

SMTP isn't secure anyway. SO what's the big risk that someone can get my message off of gmail from left over memory image. They could have just as easily sniffed the SMTP packets going from gmail to whatever server they're going to.

Bottom line don't use e-mail for sensitive information unless you use proper encryption before hand. -- fopd sodis risdick tra

Looks like GMail is not accepting Mail

[ahsile]

I'm assuming this is until the problem is fixed:

"APPLICATION" 516 "2005-01-12 20:01:48" "SMTPDeliverer - Message 15213: Delivering message from xxxxxxxxx@xxxxx.com to xxxxx@gmail.com."
"TCPIP" 516 "2005-01-12 20:01:48" "DNSResolver - MX Lookup: gmail.com"
"TCPIP" 516 "2005-01-12 20:01:48" "DNSResolver - MX Lookup result for gmail.com: 3 servers"
"APPLICATION" 516 "2005-01-12 20:02:09" "SMTPDeliverer - Message 15213: Failed to connect to gsmtp185.google.com."
"APPLICATION" 516 "2005-01-12 20:02:30" "SMTPDeliverer - Message 15213: Failed to connect to gsmtp171.google.com."
"APPLICATION" 516 "2005-01-12 20:02:51" "SMTPDeliverer - Message 15213: Failed to connect to gsmtp57.google.com."
"APPLICATION" 516 "2005-01-12 20:03:13" "SMTPDeliverer - Message 15213: Failed to connect to gmail.com."
"APPLICATION" 516 "2005-01-12 20:03:13" "SMTPDeliverer - Message 15213: Failed to connect to all xxxxx@gmail.com's mail servers."

Google News

[silverfuck]

Why is google news still in beta?

Re:Gmail Inivation Emails here

[northcat]

Whoever modded parent as offtopic has no sense of humor.

Can't recieve email messages now

[northcat]

Ever since I read this story on slashdot, I've not been able to recieve emails in my 3 gmail accounts (the emails are from two different mail providers). So, have they now started refusing incoming messages (until the bug is fixed) ?

Re:Can't recieve email messages now

[valkraider]

Now there is no security problem. No email, no problem.

Not broken XML at all

[JimDabell]

This is just the most publicly seen instance but broken XML does this every single day.

XML never does this. XML parsers, upon finding a problem must stop parsing and throw a fatal error. It's in the specification.

Instead of mindlessly knee-jerking because you don't like XML, try reading the article. The greater-than symbol that causes problems is the delimiter for the email address - syntax that goes back to 1982's RFC 822 - long before XML's time.

Re:Not broken XML at all

[Glonoinha]

Well for the record I use (and like) GMAIL.
And there are plenty of apps where I work that use XML as the interprocess communications vector and several of those applications are more than happy to die in a most glorious fashion when coming across bad XML.

I haven't seen it broken in the fashion we are seeing here with GMAIL, but I have seen plenty of instances of a GT or LT character used in user data entry fields (hosing the XML in the process.) That's what I was talking about. Not too often that characters use one of the high-bit ASCII characters in their data entry - why not use one of those instead?

Re:Not broken XML at all

[malakai]

Based on the purpose of XML, part of the requirements to meet that purpose is for a human to both be able to easily read and write XML. Type a GT or LT sign via the keyboard is far easier than figuring out how to impound a high-ascii character into some data your are scribing.

The proble your decscribed above, is one of those applications. It is their job to police the correct syntax of the language they are accepting. If said syntax is invalid, they should fail with an error. If said syntax happens to be valid, by chance, but not what the writter meant, well, tough shit. The human made a mistake, and god forbid if the computer isn't programmed for the less than .00001% chance of things.

You Win An Award

[rho]

Most Humorously Appropriate Usage of the Word "Festoon" In A Slashdot Post.

gmail bug I don't see mentioned

[kisrael]

For some reason, when you click on a link someone sends you in gmail, it opens in a new window, all well and good, but it rearranges IE's toolbars. I carefully put the standard set of buttons, the "File" menu, and the Address bar on one line (to minimize use of vertical real estate) and the new window has them all on seperate lines...which is irksome if that's the last window that gets closed in IE, because that means it sets the pattern for next time you start up IE.

*Sir, no Sir!*

[SoTuA]

I'm communications corporal, sir!

Re:I'm New Here

[iwan-nl]

He's simply introducing himself to the community at large.

I wish he was... Check out the guy's previous comments, he introduced himself quite enough already. It's getting old. I agree the AC's reply is much more disturbing though.

Re:I'm New Here

[over_exposed]

I'm sorry - I forgot the sarcasm tags in that last post.

This is why I do not use it ...

[tekjock]

There was a web site called gmail-is-to-creepy.com that had alot of info about gmail ... I stoped using it a week after I saw that site

Re:This is why I do not use it ...

[SilenceEchoed]

Maybe I'll make a new site called email-is-too-creepy.com just for you. If you think the service you're using now is any better, then you're likely in for quite a surpise. Email has never been a secure method of communication. Ever. Someone else said this already, so I'll quote (loosely): "Plaintext [aka, unencryped emails] are as secure as sending the same information on a postcard."

Re:This is why I do not use it ...

[valkraider]

Maybe I'll make a new site called email-is-too-creepy.com just for you. If you think the service you're using now is any better, then you're likely in for quite a surpise. Email has never been a secure method of communication. Ever. Someone else said this already, so I'll quote (loosely): "Plaintext [aka, unencryped emails] are as secure as sending the same information on a postcard."

Even worse. Just about every system an email passes through now keeps a copy of the email for legal purposes. And if they don't say they do, odds are they are anyway.

So instead of just your "exposed" postcard being read by a few people - email is read, shared, saved, recalled, read, shared, saved, and spread. Rinse and repeat.

No matter how many times people say it, some just don't get - email is not secure.

I still have inlaws who send credit card numbers over email despite all the warnings... And no, you can't have their email address. :)

I can go to Google and other search engines and find Usenet and Email from me back in the late 80's early 90's!

Re:This is why I do not use it ...

[Farq Fenderson]

I agree with the spirit of what you say, but I'd really like you to back up the bit about mailsystems keeping copies. I'm sure many do, but certainly not most.

I happen to do maintenance on over 200 mailservers (different companies) and not one of them retains messages beyond normal queuing. In fact, WE DON'T WANT YOUR MAIL ON OUR SERVERS. Think about the average email volume per day.

Now, mutiply that by the number of days you'd expect this mail to be retained... that's a lot of wasted money on storage for something we're not even liable for.

Re:This is why I do not use it ...

[valkraider]

Caches, backups, server logs, firewall logs, intrusion detection systems, spam filters, search engines....

They might not exactly be saved my the email server - but that doesn't mean they go away either. It is also possible that some companies you work with might do things that you are not aware of (indeed that many of the people involved might not be aware of) like mirroring drives and making off-site copies. And some companies (especially large ones or in the financial sector) might be required to keep them for a certain amount of time or forever. And any state, local, or federal governments in the USA keep them (and many states are required to turn them over in public freedom of information requests).

But the bigger message is that *we don't know*, and like clandestine communications - they are only as good as the weakest link... It must always be assumed they are compromised and can't be trusted...

But Slashdot comments on the other hand.... (smile)

Re:This is why I do not use it ...

[Farq Fenderson]

Okay, that makes more sense.

Re:smtp.gmail.com disabled

[SilenceEchoed]

If an SMTP server is stopping you from READING email, than we have bigger problems. The SMTP only handles your outgoing, not your incoming... If the POP server was down, then you wouldn't be able to read your email. As it were, though, GMail in general was down for a while.

Re:Am I missing something?

[SilenceEchoed]

Yeah, I noticed that one too. You'd think that at Google, of all companies, they'd be looking for the stupid crap the end user might do with their product before even considering daily use, but that's just me. Regardless, the hole that was found, though having large implications, is minor at the worst.

Re:Are you communications private?

[AaronStJ]

I don't even know where to start with this one!!!! Editors? You out there???

Strong words for a man with four exlamation marks in a row, a three question marks.

Re:solution?

[SilenceEchoed]

Theoretically, yes, but at the same time, if the loss of a single '>' is the cause for this, then there is reason to believe that an additional '' could cause just as much of an issue, though not the exact problem for obvious reasons. Clearly, someone is not validating inputs on the SMTP side of things, as the original server was built with a web interface and thus there was no need for such a thing. Google tends to stay pretty well on the ball, so I'm sure this will be resolved soon enough, if not already. You know at least half their staff are avid /.ers. Anyway, you're using a free mail server, so just encrypt everything and assume anyone can get a copy at will of anythingthing you send. Unless you somehow come to own the internet in it's entirety, that assumption is a lot closer to the truth than you think...

Re:Just a simple, obvious case of omitting a lette

[Drakonian]

Haha, mod that up. Very nice puns.

Here is why the world will not end.

[Duhavid]

There is a major motion picture by that name, and the Earth is afraid of the lawsuit.

I don't get it

[pbrammer]

Throw it to bugtraq if you want exposure and to get it noticed. Not Slashdot.

It's not a buffer overrun anyway.

[Ayanami Rei]

It's a data parsing error (missing that closing < makes it read stuff from other mailboxes and print that back inappropriately)
Why it can even read past the end of your message is a mystery to me. They might be using very specialized memory managers in their codebase that use buffers in specific ways, however, which would make this possible.
I wouldn't call that a buffer overrun. It's a parsing error which exposes read access to some kind of application-managed memory in an unexpected way.

didn't do a good job hiding the info

[adpowers]

In picture number 2, they didn't do a very good job hiding the info. If you do a google search for <inurl:akienm>, you get just a few results. Just by looking at the snippet from the first result (without actually traveling there), you can see his domain is weirdness.org. From this you look back at the message and deduce that the login URL is http://weirdness.org/akienm/checkpointjob. The username starts with ak, so it is probably akienm. The password starts with bi. This dramatically reduces the amount of work needed to brute force his password. Hopefully akienm will change his password soon.

Andrew

I'm Impressed

[DarkKnightRadick]

I'm very impressed that Google (or more to the point Chris Dibona) responded and the bug was fixed so quickly. Can we expect more of this from Google in the future? I sure do hope so.

Re:Are you communications private?

[MrYowler]

That was my fault. As I have indicated in several other replies, I was the 'editor' in our little research team (I used to teach English to ESL students, some 20 years ago), but I honestly did not think that this would ever see a reader.

Sorry for the minor boo-boo. I'll try to be more grammatically correct, in the future... ;-P

Re: If they would have sent it to Google

[MrYowler]

Yep. We did.

In fact, the 'report a bug' link did not appear, in my GMail account. I had to use one of NSA Wally's other accounts, just to find out what the link was.

Re:This was more about their 15 minutes than Googl

[MrYowler]

CyberArmy? Who said that?!

Yes, I'm that same MrYowler... :) Of course, that says nothing about my many professional information technology and information security credentials, but if you've already made up your mind that I'm an idiot, then there isn't much point in me trying to change your opinion. Remember, though, that your opinion says a great deal more about you than it does about me... ;-)

Re:This was more about their 15 minutes than Googl

[MrYowler]

Oh yes. Sue.

NSA Wally makes slightly more than $300 per month working for his uncle, and I make about $450 per month putting cans of beets on grocery store shelves.

Take it all! Start with our crushing personal debts, and then you can have this flu that I have neither been able to shake, nor do I have medical coverage to get help with.

Yes, sue. Take us for all we're worth. That should amount to slightly less than nothing... ;-P

gmail team sent me this.

[linedpaper242]

Hello, Thank you for your message. Today, Google was alerted to a security vulnerability affecting Gmail, and our engineers quickly resolved the issue. A very small number of Gmail users were affected, and all Gmail accounts are now protected from this vulnerability. Google has the highest regard for the security of our users' information and we apologize for any concern this issue may have caused. Thank you for taking the time to contact us. Sincerely, The Gmail Team

Re:This was more about their 15 minutes than Googl

[jdgeorge]

Yes, sue. Take us for all we're worth. That should amount to slightly less than nothing... ;-P

A word of caution:

Don't taunt the animals. If you have ever been involved in or observed divorce proceedings, you should already be aware that the legal process is frequently used by its participants as a means of punishment, rather than a source of revenue. The fact that you don't currently have money doesn't protect you from being the victim of some well-funded person or lawyer with a desire for retribution.

If you're interested...

[jmcmunn]

I submitted this bug (as thousands of slashdot users probably did) and here is the response I got from Google.

Hello,

Thank you for your message. Today, Google was alerted to a security
vulnerability affecting Gmail, and our engineers quickly resolved the
issue. A very small number of Gmail users were affected, and all Gmail
accounts are now protected from this vulnerability.

Google has the highest regard for the security of our users' information
and we apologize for any concern this issue may have caused. Thank you for
taking the time to contact us.

Sincerely,

The Gmail Team

Re:This was more about their 15 minutes than Googl

[MrYowler]

:) Eh. I know how to file bankruptcy. Frankly, at this stage of the game, the only thing keeping me from doing so, is that I have no assets to protect.

The point is well-made, however, and I'd be likely to take it more seriously if I were not already an excellent candidate to go insane with a high-powered rifle in a bell tower, somewhere... ;-P

That, however, is part of the point of psuedonymity - it makes the rich fellow's job at least slightly more difficult, and the lack of reward, at the end, makes the effort essentially pointless. Better to pursue me for criminal action, as so frequently is the case when a vulnerability is publicly reported. Even that, though, just gets me three hots and a cot, and all the luvin' I can't handle... :-P

Never forget; death ends the pain. And the man who believes that he has nothing left to lose, is the most dangerous of all.

Hopefully, it doesn't come to that, and the tiny bit of rope that still has me connected to my sanity, will hold.

Bad Fix

[ahdeoz]

Google is going down the wrong route. This is like fixing a remote exploit by filtering traffic for the IP of the guy that rooted you. If your program is insecure, fix it, don't firewall suspicious messages. It's only a matter of time before a similar exploit is written unless gmail is engineered so that malformed messages don't get cached data.

There is still hope then!

[Snaller]

That they fix those awfull new groups...