Gmail Messages Are Vulnerable To Interception

Michael Wally writes "GMail messages are vulnerable to interception. An attacker has only to transmit malformed test messages to himself, and information left over in memory, from previous messages destined for other people, will appear with the test messages, in the attacker's inbox. Sometimes, this information may include usernames and passwords... Do you use GMail? Are your communications private? Should they be? Well, here's what we figured out about the issue, that may or may not help you - or perhaps GMail, if anyone can get ahold of their developers, to tell them about it." Update: 01/12 22:21 GMT by T : Good news for Gmail users; those malformed messages are no longer being accepted; read below for a message from Chris DiBona.

chrisd writes "Just so you know, at 10:15am PST mails with the problematic formatting as described in your previous story stopped being accepted into Gmail. Previous emails that had this problem will also no longer will be accessible. If you don't mind, I'd like to take the time to remind Slashdot readers that they can send bugs that may have a security aspect into security@google.com. If they like, they should feel free to cc me at cdibona@google.com. We appreciate your patience and we're sorry about the bug."

Comments

Wow

[bperkins]

Did any of this "left over" information happen to be spurious commas?

Re:Wow

[TedCheshireAcad]

,,,, no, ret,u,rn to yo,ur work. ,,
,do,not,,worry abou,t t,he com,mas.

Security Category in Gmail Bugs List?

[dolo666]

Is it just me or do you find it strange that in the list of known Gmail bugs, there is no catagory for Security? I'm trying to find out if this bug is one of the known bugs, but I'm guessing it's not? And I'm also guessing that Security is not a concern for Google at this point, which is a very bad thing, IMHO. People are relying on Gmail because of its awesome features, but if someone can read insecured data directly from memory, it's a really big problem -- perhaps even a global design flaw of the system. No wonder Google plays their cards so close to their chest... I just hope they take some amazing measures to prevent these types of bugs in the future... like when somone does >>> or >>>> etc...

I use Gmail and this bug sort of disturbs me. Aren't they using a proper preg check to see if the fields are enclosed with < > ? I'm not even sure how this bug could exist in any normal computing system. I guess the gmail system is a hybrid of some kind? This is indeed very telling...

But it doesn't make me want to stop using Gmail. It's a random security breech that looks like they could fix it in an hour if they wanted to. Time to stop checking my email for a while until this is fixed...

Re:Security Category in Gmail Bugs List?

[TrippTDF]

This is just a shot in the dark, but I'm willing to bet Google left Security off the list on purpose. a security flaw becomes a lot harder to exploit if the general public does not know it is there.

I don't hold this against Google at all. I'm glad they are not telling the world how to break into my account...

Re:Security Category in Gmail Bugs List?

[PhilHibbs]

What do you mean, "I'm not even sure how this bug could exist in any normal computing system"? Buffer overruns are everywhere. Although the classic buffer overrun involves getting the app to write beyond the buffer's bounds and into the stack, this one is getting it to read beyond the point that it should. Unless the system has memory protection built in (and that is only possible on very recent processors) then this is entirely unsurprising. "Some kind of hybrid"? You're not making sense.

Re:Security Category in Gmail Bugs List?

[isomeme]

People are always saying that, but it just isn't true. Relying only on obscurity for security is probably a bad idea, but as part of a complete security solution, it can be very helpful.

People will not successfully exploit a vulnerability they do not know about, or attack a system they do not know is there. Even if some fraction of people are in the know, you've reduced your potential attacker count by the fraction of them who are not in the know.

One Key Word

[wcitechnologies]

BETA. It is unlike google to release half-assed web services. Keep in mind GMail is still being offered as a preview, you can't even sign up unless you know somebody else who has it.

Google will work out the kinks, they always do.

Re:One Key Word

[Anonymous Coward]

Next up on Slashdot: the Google apologists vs. the Apple apologists in a brown nose-off...

Re:One Key Word

[MightyMartian]

> Google will work out the kinks, they always do.

Let me know when they fix the disaster known as Google Groups 2. They've buggered up a ton of archive references, and don't exactly seem to responding in a stellar fashion to the problems.

Re:One Key Word

[phats garage]

I disagree.

I know that its everyones darling, Google, but its not any less of a privacy spilling bug. Look at everyone who jumped on gmail already. Look at the bug itself, their servers trust the email client to terminate a string.

Never trust an internet client to provide properly formatted strings. Google blew it. (Besides, they're on my bad list for screwing up the usenet archives anyways, they're turning evil.)

Beta..

[ackthpt]

Beta...beta... Golly, I wonder what that means.

Oh, sure, it means ready to be shipped/used in production by some companies, but has that line gotten to fuzzy for some people?

"that's not a feature, that's a bug"

Re:Beta..

[ad0gg]

news.google.com has been in beta for 3 years now. Same with google groups, same with froogle. Pretty much the only thing that google hasn't labeled beta is their main search engine.

Email isn't secure

[krog]

and should never be treated as such. If you want security, use strong encryption.

This is as it was 10 years ago, 5 years ago, now, and in the future. Plaintext should be treated as though you were sending a postcard in the mail.

A Darker Shade of Grey Hat

[American AC in Paris]

When you find a bug like this, you should first and foremost submit it to the party responsible for the maintenance of the code. You should at least give the responsible party the opportunity to review/respond/repair before making vulnerabilities public knowledge.

Security exploits are a serious matter, and they need to be handled properly. Throwing this kind of thing out in the open willy-nilly is, at best, irresponsible. For one, it means that Google must now rush a fix for something which may have already been in the bugfix queue; rush jobs can disrupt the entire project and increases the odds of human error--which can lead to unnecessary security vulnerabilities.

As for these guys getting hired by Google--being smarmy twits about Google's code review practices probably isn't gonna help their case any. Shame, because a little tact and professional courtesy would have given them a damn good running start at it...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Newsflash

[hackstraw]

Speaking loudly in a public place can be intercepted!

Although this appears to be a valid bug in GMail (that is still beta mind you, and will probably be fixed very quickly), who in the world considers plain text communication secure?

I have no idea who at my ISP has root access (or others that can gain root access) to read my plaintext mailbox.

Nothing to see here... please move along.

Re:Newsflash

[Country_hacker]

Looks to me like they already fixed it, I tried sending an email without putting the end bracket on the address (Just like the guys in TFA) and it popped an error message. Those guys at Google are on the ball today. :-)

Well hey..

[sinner0423]

Google = best & brightest, right?

I mean, their aptitude tests & hiring policies makes me believe they've got a few nobel prize winners working there..

Shouldn't they be able to fix this during lunch break?

end of the world is coming!!

[jxyama]

headless $500 Mac and $99 iPod...

now Google messes up...

with all the natural disasters happening, i cannot think of a good reason why the world wouldn't end the day after tomorrow.

Re:All email is vulnerable.

[Carthag]

This exploit uses a flaw in Google's code that allows viewing of memory on Google's servers. Hardly an inherent flaw in email as such.

GMail vs Hotmail

[kevin_conaway]

Why is everyone brushing this off by saying "well you should have known that email isnt secure, tough luck!"

If Hotmail had this bug, everyone here would be up in arms.

Just because email isnt secure doesnt mean this isn't serious. I would hate to think of all the people reading my responses to craigslist postings :)

This was more about their 15 minutes than Google.

[EvilFrog]

Many other people have pointed out that GMail is still in beta, and that if they would have told Google first it probably would have gotten quietly fixed without any damage being done.

Of course, they acknowledge that, but they're arguing that they're helping protect people by making them aware of the problem.

I call bullshit. This is about them wanting recognition for finding the bug. If they would have sent it to Google, it would have been fixed and no one would care who discovered it. Because they went public with it they can boast that they were the ones who found the bug.

Of course, it swings both ways. Now if someone uses this exploit and steals your password (which is honestly rather unlikely), you know who to blame for making it public knowledge before Google had the chance to fix it.

or rather

[apparently]

#include <std/security_through_obscurity_rant.h hey moms, it's big poppa here! be looking to fly with you 2nite an' get a little stank on mah hanglow, dig-it?! It's gonna be a <B

Hacker Hubris

[Jtheletter]

Wow, are these guys full of themselves. I write complex automation code for a living, in an environment that demands rigorous QA practices and documentation, but guess what? We still create bugs, find latent bugs that have gone undiscovered for many builds, and even get some real DUH! headslappers from time to time. Fact of the matter is, when you've got a couple hundred thousand lines of code there are going to be errors and unintended consequences, mostly arising out of missed checks, such as this gmail problem (assuming they're right about the end tag check being the cause).

For these people to find a single issue in such a system, then say it's a shortcoming of gmail's QA process, and in the same breath ask for work - implying they've got the skills to even handle such a job - is insulting. Please, just because you're smart enough to expose a flaw once you stumbled onto it in no way means you are qualified to correct that or any other issue. Sometimes our QA team finds a flaw and even digs in the logs enough to pinpoint the problem but it can still take the developer who designed the code days to correct.

In other words, noticing that you're bleeding does not qualify you as a surgeon. Instead of publishing their finidings in a detailed how-to, these asshats should have forwarded the info to gmail and let them deal with it, and that's assuming that the gmail team didn't already have it in their list of bugs. I just don't understand why people feel the need to not only describe a security problem, but give every hacker on the net a roadmap as to just exactly how to use it and what illicit activity it might be good for.

A Job?

[jayloden]

lots of comments here are noting the hubris of these guys in asking for jobs.

I'd just like to add that not only are they criticizing the company's QA process and releasing the bug without having notified google first, as others pointed out...

They found the exploit by MISTAKE! It was a bug in their own code that caused the problem, something as stupid as a missing caret at the end of a line. So, in other words, they are looking for work looking for bugs in Google's software that they found solely because of a bug in the software they wrote.

On another note, bugs in software happen, no matter WHO you are, the trick is just to be able to fix them in a timely fashion and deal with the situation effectively. I believe that Google will do this, especially if the previous comment stating that it has been patched is true. Everyone is making too big a deal out of something that has happened to every developer on every software ever. The reason MS gets crap for it is simply because they continuously produce buggy code ridden with security issues, but deny this is the case, and often ignore security problems until they are found out by the general public.

-Jay