Gmail Vulnerability May Expose User Information

An anonymous reader writes "A cross-site scripting vulnerability may mean bad news for Gmail users. The ethical hacking group GNUCitizen has developed a proof-of-concept program that deftly steals contact information and emails from the popular web-based mail service. At the moment there are no 'wild' exploits for this vulnerability. The article discusses how lax security makes holes like this a problem for corporate IT houses as well as Google. '"People do use private accounts to store work information," IBRS security analyst James Turner said. "I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal. "In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point. The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included."'" This, just a few days after a search-based exploit was discovered.

Comments

Online apps

[Romancer]

So who didn't see this thing comming?

Online apps are only going to get more and more popular. Webmail is like the gateway drug of internet apps. It starts off innocently enough. Going from an in house email system that is only intranet. Then you need to give employees the ability to send outside email, no problem, but your servers can still filter out attachments both ways and give the company a security and intellectual property barrier. Then the online apps start looking appealing, no maintenance, no servers, just internet access. A lot of cost savings for the company. What could go wrong? Then Microsoft and the other big players start talking about making Office an online application and hyping the benifits of such a new age system. The benifits are described in beautiful powerpoint presentations to the execs and the IT departments warnings are just plain text. What's going to happen to the companies that fall for this new online paradigm? I think more of the same. Information leaks, database vulnerabilities, simple password guessing, general hacks, etc. And all the information accessed through these new online applications is going to be out there for the taking. Ease of use and availability on a new level, to the hackers.

Re:Online apps

[betterunixthanunix]

Another problem is the users themselves. People like the convenience of a web interface, and don't want to be tied to one computer using an email client. I try to get people to encrypt confidential emails, but as soon as I say, "So you need to set up Thunderbird..." I am met with skepticism. One friend of mine was worried that someone might be reading her emails (because she had used a predictable password); I set up Thunderbird with GPG for her, but within a few weeks she was back to the web interface.

When it comes to convenience vs. privacy or security, people will choose convenience.

Close sites off by default

[Enlarged to Show Tex]

We talk about shutting down any unnecessary services and closing ports down by default in operating systems and firewalls. Why wouldn't one want to do the same with Web browsing? Lock down (or lock out) anything that can cause harm to corporate systems, and then open up things only as required. Not only does it improve productivity, it also improves security at the same time...

Ideal situation?

[oahazmatt]

People do use private accounts to store work information

And companies with information that is valuable to other companies should enforce regulations opposing this.

I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal.

It's less than optimal to fix the mail server?

In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point.

Really? My company does that. My training materials aren't allowed to leave the building.

The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included

If they share corporate information through Facebook, do you need that employee?

Always GMail

[bostons1337]

Why is it that we always see these exploits with GMail? I can't even remember the last time a Yahoo Mail or Hotmail, etc. exploit came out. There about equally popular among the public.

Yet another "we hate Gmail article"?

[SplatMan_DK]

With all respect, why continue this crusade against Google/Gmail?

Sure, they are a key player in the market, but so is Yahoo, Hotmail, and a number of others.

From a technical perspective, cross-site scripting (XSS) vulnerabilities isn't exactly a new thing. Nor are they isolated to Gmail.

The article is not wrong - so I am not attempting to protect Google. On the other hand, this problem is fairly general in nature, and probably applicable to a ton of websites. In fact, the "cookie grabbing technique" is one of the oldest tricks in the areas of XSS.

With this in mind, the article (and in general the constant rampage against Google) seems ... a tiny bit one-sided. Not only is that unfair for Google (I am not a stockholder, so I will survive) but it also takes away the focus from the real issue: XSS is a big deal, and has do be dealt with. By everybody ... not just by Google.

:-)

- Jesper

Re:Yet another "we hate Gmail article"?

[SplatMan_DK]

why try to hack ObscureMail if you can get access to MILLIONS of accounts hacking GMail? You don't think sites such as Amazon, Hotmail, Yahoo Groups, e-Bay, LinkedIn, Facebook, MySpace, YouTube, etc. would provide access to just as many accounts?

In fact, the total nightmare-scenario for the end-users (and the total wet-dream for XSS hackers) would be to gain access to an ad-server. Imagine the XSS hacks you could do if you managed to compromise a DoubleClick server? Millions of users could be targeted, across thousands of sites where your compromised ad-server would even be white-listed for all sorts of crap? In that case, the popularity of the sites themselves would be of no consequence. As long as it displayed ads from your compromised server.

Hmmm... come to think of it, that is a pretty clever idea. I just might wanna take a look at the scripting used in streaming video ads ...

;-)

- Jesper

Re:Encrypt it

[smittyoneeach]

No, on the grounds of excessive CPU overhead.
A simpler approach would be to have the UN put out a resolution asking everyone to be nice.
Oh, and another resolution asking people not to send spam, pretty please, would also be helpful.

because

[everphilski]

Because some of us don't spend the $5-$10 to go out to lunch ( I pack a lunch, saves money, healthier, etc), and prefer to spend our lunch hour checking the news online? Sure, during business hours while working that makes sense, maybe, but during my breaks and lunch (both of which I'm free to take when I want) I like to go online and do stuff. So that becomes problematic. Honestly the solution is education. Having good enough resources on the local network so that your users don't have to use gmail or a ftp site is key, and making sure they know how to use them.

You can say tough shit, and I'd agree, employer has that right. But then I'd counter by saying I'd probably be keeping an eye open for a new employer :)

Re:Of course

[gd2shoe]

"but do you really want those million-dollar business contracts and project bids on it?"

To think, people actually do this across any email... **shudder**

Seriously, all potentially sensitive business should be conducted in person (perhaps by a representative). Anybody not smart enough to realize this should not be running a "million-dollar business".

(Yes, I _realize_ that it happens.)