Slashdot Mirror
Google Corrects Gmail Security Flaw
0110011001110101 writes "Google said Wednesday it has fixed a problem in its widely used email program that allowed hackers to break into peoples Gmail accounts to read messages and pose as legitimate email users. Security researchers in Spain exposed a flaw in the way Google authenticates its users, allowing the breach in the system that counts more than 5 million users. The process for exploiting Gmail was posted to a hacker web site." From the article: "Google spokesperson Sonya Boralv said only users who supplied information to the hackers were potentially vulnerable. 'We looked into this quickly and learned that it can only occur if a user knowingly provides their credentials,' Ms. Boralv said. 'Nevertheless, we have made some modifications to Gmail to help prevent these kinds of issues.'"
Google does NOT read every email. It goes through a computerised filter to supply ads. No different than a spam filter. How come no one complains about Yahoo, MSN, and 99% of other email providers, free or not?
...they could alter the URLS they serve up such that httpS is used instead of crappy old http. The former works if you remember to edit it manually every time you log in, but that's tedious.
Then again, its a spanish language site, so I give them kudos for finding someone whose English isn't terrible to write it up for them.
[Fuck Beta]
o0t!
Say what you will about Google, but 4 days is fast. I think Microsoft takes weeks, if not months to fix problems. As a matter of fact, I bet there are vulnerabilities that are years old. Not to mention that M$ gets angry whenever a security group points out a bug.
gasmonso http://religiousfreaks.com/So hackers can't get in now if I give them my credentials?
Gee, I hope that no one was able to see that I store my SS#, CC#, and username/passwords for every site that I use. This could really be bad! The last time I checked, this was Beta software anyway, and if it was a concern, realize that most people weren't concerned when they got google eyed for a 2GB account. Get serious, who in the their right mind would send sensitive information over e-mail anyway???
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
The site says Google fixed the problem on October 18, four days after a security researcher called ANELKAOS alerted the company to the problem. Google didn't make a public announcement about the problem. Companies such as Microsoft typically alert their users to security flaws in their software.
So I am to believe that when someone makes a security flaw known to Microsoft they immediately make it public? They don't try to fix it or even shush the person who lets them know? The news is full of stories about security researchers who try to let Microsoft know about a problem only to see it not fixed for a long time. Then if the researcher lets the public know Microsoft goes berserk.
4 days seems like a pretty good time to patch a flaw that sounds as low risk as this one did.
Nobody writes perfect software
from TFA:
"OK, it's a Beta version, and they don't have to report anything. But if they would have recognized it and published a thank you note, this information wouldn't had been published. We have 3 ways to get to the same result, the others 2 are quite easier, and because of that easily we can deduce that it's a multibug, and a design error. With all these clues, they will not take too much to discover new methods."
The only reason we're seeing this is because Google didn't give 'em credit for finding the bug. Shame on Google, because apparently this problem might get worse before it gets better.
[Fuck Beta]
o0t!
AIM mail gives you 2 GB of free space and IMAP access so you can use it from a real mail client. All you need is an AIM screen name.
For my personal mail I use Fastmail, IMAP mail with excellent server-side filtering. They had a brief outage last weekend, but aside from that they've been rock-solid for the last 2 years. They don't offer you enough storage space to make a warez repository out of your inbox, but it would take me a decade to fill up my 600 MB account.
For more information, click here.
The good thing about this is that now, everyone benefits from the fixes. Instantly.
No more issuing patches, fixes, service packs, or whatever, like there is with distributed packages.
That's amazing. I got the same combination on my luggage.
See, up until now, if you knowingly gave hackers your credentials, they'd be able to log on to your account with them. But now Google's refined their system to the point that even if you give out your personal information, hackers can't get in!
It's really very simple. They simply cycle through every Google ad you've ever clicked on (to find potential phishers), geo-locate the IP trying to log on and cross-reference it to the "From" location in most of your Google Maps directions searches, attempt to visually identify you from any webcam pictures they may have cached, calculate the speed in which the username/password was typed in compared to the "keyboard profile" they have on file from all your searches, and compare the logon time to your typical usage times for GMail and Google Talk.
Perfect security. At least, from everybody but Google.
I support the separation of oil and state.
FTFA
"We looked into this quickly and learned that it can only occur if a user knowingly provides their credentials," Ms. Boralv said. "Nevertheless, we have made some modifications to Gmail to help prevent these kinds of issues."
Fix:
From: Google
To: Gmail users
Subject: Security Bug
To all Gmail users:
Please do not give out your user name and password.
Thank you. That is all.
If I'm reading this correctly, the security researcher thinks that Google has fixed only one of the three bugs that open up this door...thus the public pronouncement.
"But if they would have recognized it and published a thank you note, this information wouldn't had been published. We have 3 ways to get to the same result, the others 2 are quite easier, and because of that easily we can deduce that it's a multibug, and a design error. With all these clues, they will not take too much to discover new methods."
No, you need a different Google hack for that.
How can a post be modded "overrated" or "underrated" when it hasn't been rated yet?
I completely disagree with EPIC's privacy analysis of Gmail's "content extraction" techniques.
First off, whether the ECPA extends to Internet e-mail has NOT been established. The ECPA was written in 1986 and at that time, most people's idea of an 'e-mail' service involved CompuServe or other proprietary mail services.
I doubt that anyone could have a reasonable expectation of privacy in regards to Internet e-mail. Mail can pass through so many servers and routers and such and ANY of those hosts along the way could grab your mail, which is, unless YOU encrypt it, pretty much transmitted in clear text, with very rare exceptions. Any of those hosts could store and analyze your mail, too. There's nothing stopping them. It's a direct result of the Internet's decentralized nature.
Anyone who expects that unencrypted Internet e-mail is private is very sadly mistaken.
My blog
The default behavior IS to log a user out when the browser is closed. The only way your girlfriend's account would stay logged in after closing the window is if she checked "Remember me on this computer" when logging in.
Up until today, I was including that info in my sig!!
For what, exactly? Gmail doesn't provide your mail to any third parties - no, not even the context-dependent ad do that. Sure, there's a database of your emails somewhere... but every single email service has a database of your email. How is gmail a threat to your privacy?
I don't read either Spanish or Hackerspeak very well, so I may have misunderstood their explanation, but it sounded like the exploit requires the attacker to gain access to the source code of the login screen for a user who already has a valid Gmail cookie. In other words, Gmail sends (or used to send?) stealable authentication info in the html. Is that accurate? If so, I'd have to agree that's not Best Practices for web security.
Their screenshot walkthrough seemed like a mess. Which browser (and which URL) was associated with each of those source views?
It's true, my wife's paypal account was hijacked last week by someone looking her her gmail account, probably by this very exploit. Luckily, the kid was a moron who immediately started forwarding all her mail to his own yahoo.it box. A sojourn through the gmail trashcan turned up a paypal receipt for an IRC hosting package. Needless to say panicked overreaction ensued, passwords were changed, credit cards cancelled, another windows install was replaced with Ubuntu. It's nice to know now, maybe/probably, what the problem was and the limits of our exposure. I also did, during this period, suddenly realize that keeping everything on gmail means keeping EVERYTHING on gmail. We've not used paypal in at least a year, but still, there it was in the archive.
"Google's move towards a single Google Account for multiple services exacerbates the problem, as the same account used by the Google Base site can also be used to access financially sensitive services such as AdWords and AdSense, and Google's GMail webmail service."
RichM
Data Center Knowledge