Slashdot Mirror
Gmail Vulnerability May Expose User Information
An anonymous reader writes "A cross-site scripting vulnerability may mean bad news for Gmail users. The ethical hacking group GNUCitizen has developed a proof-of-concept program that deftly steals contact information and emails from the popular web-based mail service. At the moment there are no 'wild' exploits for this vulnerability. The article discusses how lax security makes holes like this a problem for corporate IT houses as well as Google. '"People do use private accounts to store work information," IBRS security analyst James Turner said. "I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal. "In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point. The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included."'" This, just a few days after a search-based exploit was discovered.
Javascript does have a sandbox security model based on the domain name of the javsacript/html source.
Displaying the html mail in its own internal frame that pulls from a different domain name than the rest of the application should solve the problem you're referring to. Something like mail.googlecontent.com would work nicely.
If moderation could change anything, it would be illegal.
If this is really a cross-site scripting vulnerability, NoScript might help protect against it (if you're using FireFox).
NoScript should prevent this exploit. It can be annoying to have to constantly give permission to sites to allow scripting, but it beats being hacked.
I'm also wondering if running Gmail over SSL would make any difference...
-Laz
Google does offer services to large organizations whereby they can use gmail and still use their own domain. Just a few years ago, my university ditched its in-house email servers in a "partnership" with gmail, and gmail became the mail service for the entire university. They said it would save all kinds of money on maintenance, and they were probably right.
;)
So I guess my point is, even if they have the professional-looking email, it doesn't mean they're not using gmail.
From what I gather about this exploit (and contrary to what the CNET article has to say about it) this is actually a cross-site reference forgery (CSRF) attack rather than XSS. The attack takes advantage of the fact that a malicious Web site's clients may have persistent GMail cookies in their web browsers: The attacking site directs the victim's web browser, (possibly, but not necessarily) using JavaScript, to make a POST request to GMail which creates a mail filter to copy all messages to an email address under the attacker's control. No JavaScript needs to be injected into GMail itself, so I don't really think it counts as XSS; in fact, the attacker never sees the actual session cookie or recovers the account password. Still, this is a huge threat, especially considering that so many people have their (Facebook|MySpace|AIM|whatever) accounts set up to send their password to their GMail accounts in case the password is "forgotten".
If this is how the attack works, then Firefox's NoScript extension should protect you as long as you don't have the attacking web site whitelisted, even if the CSRF POST vector isn't JavaScript based.
You're absolutely correct in stating that this isn't strictly a GMail problem, but rather a fundamental problem with using the Web as an application platform. In fact, I'd argue that CSRF attacks are an even more deeply rooted and difficult to deal with problem than any type of XSS. My friends might think I'm outdated, but this is why I still use fetchmail and mutt to grab my GMail messages by POP, staying logged out of the GMail web site as much as possible.
No. The cookies are stolen upon transfer. You need to transfer your login data and save a cookie to receive the subsequent responses (viewing more then one message).
It explains how the exploit works, how developers would/should avoid it and how users could protect themselves: http://hackademix.net/2007/09/26/gmail_csrf/
There's a browser safer than Firefox, it is Firefox, with NoScript
If you are not encrypting your email you are as exposed as your grandpa, so your recommendation is based in wishful thinking and not in actual hard technical facts.
email is not a secure mechanism to transmit information, unless it is encrypted. End of the history.
And as in regard to all those valuable contracts and what have you, I would like to inform you that email is not a guaranteed delivery mechanism, it works in a "best effort" to deliver basis. So I will not be sending any urgent information by email any time soon.
IANAL but write like a drunk one.
Some interesting points