Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gmail Vulnerability May Expose User Information

Posted by Zonk on from the that's-not-so-good dept.

An anonymous reader writes "A cross-site scripting vulnerability may mean bad news for Gmail users. The ethical hacking group GNUCitizen has developed a proof-of-concept program that deftly steals contact information and emails from the popular web-based mail service. At the moment there are no 'wild' exploits for this vulnerability. The article discusses how lax security makes holes like this a problem for corporate IT houses as well as Google. '"People do use private accounts to store work information," IBRS security analyst James Turner said. "I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal. "In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point. The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included."'" This, just a few days after a search-based exploit was discovered.

28 of 94 comments (clear)

  1. Encrypt it by aedan · · Score: 3, Funny

    With ROT 26

    1. Re:Encrypt it by smittyoneeach · · Score: 2, Insightful

      No, on the grounds of excessive CPU overhead.
      A simpler approach would be to have the UN put out a resolution asking everyone to be nice.
      Oh, and another resolution asking people not to send spam, pretty please, would also be helpful.

      --
      Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
  2. Online apps by Romancer · · Score: 5, Insightful

    So who didn't see this thing comming?

    Online apps are only going to get more and more popular. Webmail is like the gateway drug of internet apps. It starts off innocently enough. Going from an in house email system that is only intranet. Then you need to give employees the ability to send outside email, no problem, but your servers can still filter out attachments both ways and give the company a security and intellectual property barrier. Then the online apps start looking appealing, no maintenance, no servers, just internet access. A lot of cost savings for the company. What could go wrong? Then Microsoft and the other big players start talking about making Office an online application and hyping the benifits of such a new age system. The benifits are described in beautiful powerpoint presentations to the execs and the IT departments warnings are just plain text. What's going to happen to the companies that fall for this new online paradigm? I think more of the same. Information leaks, database vulnerabilities, simple password guessing, general hacks, etc. And all the information accessed through these new online applications is going to be out there for the taking. Ease of use and availability on a new level, to the hackers.

    --


    ) Human Kind Vs Human Creation
    ) It'd be interesting to see how many humans would survive to serve us.
    1. Re:Online apps by betterunixthanunix · · Score: 4, Insightful
      Another problem is the users themselves. People like the convenience of a web interface, and don't want to be tied to one computer using an email client. I try to get people to encrypt confidential emails, but as soon as I say, "So you need to set up Thunderbird..." I am met with skepticism. One friend of mine was worried that someone might be reading her emails (because she had used a predictable password); I set up Thunderbird with GPG for her, but within a few weeks she was back to the web interface.

      When it comes to convenience vs. privacy or security, people will choose convenience.

      --
      Palm trees and 8
  3. Of course by teknopurge · · Score: 3, Interesting

    People wonder why I recommend getting a private email account. Sure we could have the same issues, but the core webmail software we use is almost a decade old, and I gather that it has had more users then GMail currently has.

    In short: ditch the free and go with a service provider that provides service. GMail is ok for your Grandpa, but do you really want those million-dollar business contracts and project bids on it?

    --
    Website Hosting
    1. Re:Of course by ShatteredArm · · Score: 3, Informative

      Google does offer services to large organizations whereby they can use gmail and still use their own domain. Just a few years ago, my university ditched its in-house email servers in a "partnership" with gmail, and gmail became the mail service for the entire university. They said it would save all kinds of money on maintenance, and they were probably right.

      So I guess my point is, even if they have the professional-looking email, it doesn't mean they're not using gmail. ;)

    2. Re:Of course by gd2shoe · · Score: 2, Insightful

      "but do you really want those million-dollar business contracts and project bids on it?"

      To think, people actually do this across any email... **shudder**

      Seriously, all potentially sensitive business should be conducted in person (perhaps by a representative). Anybody not smart enough to realize this should not be running a "million-dollar business".

      (Yes, I _realize_ that it happens.)

      --
      I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
  4. Close sites off by default by Enlarged+to+Show+Tex · · Score: 2, Insightful

    We talk about shutting down any unnecessary services and closing ports down by default in operating systems and firewalls. Why wouldn't one want to do the same with Web browsing? Lock down (or lock out) anything that can cause harm to corporate systems, and then open up things only as required. Not only does it improve productivity, it also improves security at the same time...

  5. Ideal situation? by oahazmatt · · Score: 4, Insightful

    People do use private accounts to store work information
    And companies with information that is valuable to other companies should enforce regulations opposing this.

    I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal.
    It's less than optimal to fix the mail server?

    In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point.
    Really? My company does that. My training materials aren't allowed to leave the building.

    The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included
    If they share corporate information through Facebook, do you need that employee?
    --
    Those who believe the Internet is private,
    find their privates are on the Internet.
  6. Always GMail by bostons1337 · · Score: 3, Insightful

    Why is it that we always see these exploits with GMail? I can't even remember the last time a Yahoo Mail or Hotmail, etc. exploit came out. There about equally popular among the public.

  7. Yet another "we hate Gmail article"? by SplatMan_DK · · Score: 5, Insightful

    With all respect, why continue this crusade against Google/Gmail?

    Sure, they are a key player in the market, but so is Yahoo, Hotmail, and a number of others.

    From a technical perspective, cross-site scripting (XSS) vulnerabilities isn't exactly a new thing. Nor are they isolated to Gmail.

    The article is not wrong - so I am not attempting to protect Google. On the other hand, this problem is fairly general in nature, and probably applicable to a ton of websites. In fact, the "cookie grabbing technique" is one of the oldest tricks in the areas of XSS.

    With this in mind, the article (and in general the constant rampage against Google) seems ... a tiny bit one-sided. Not only is that unfair for Google (I am not a stockholder, so I will survive) but it also takes away the focus from the real issue: XSS is a big deal, and has do be dealt with. By everybody ... not just by Google.

    :-)

    - Jesper

    --
    My security clearance is so high I have to kill myself if I remember I have it...
    1. Re:Yet another "we hate Gmail article"? by SplatMan_DK · · Score: 3, Insightful

      why try to hack ObscureMail if you can get access to MILLIONS of accounts hacking GMail? You don't think sites such as Amazon, Hotmail, Yahoo Groups, e-Bay, LinkedIn, Facebook, MySpace, YouTube, etc. would provide access to just as many accounts?

      In fact, the total nightmare-scenario for the end-users (and the total wet-dream for XSS hackers) would be to gain access to an ad-server. Imagine the XSS hacks you could do if you managed to compromise a DoubleClick server? Millions of users could be targeted, across thousands of sites where your compromised ad-server would even be white-listed for all sorts of crap? In that case, the popularity of the sites themselves would be of no consequence. As long as it displayed ads from your compromised server.

      Hmmm... come to think of it, that is a pretty clever idea. I just might wanna take a look at the scripting used in streaming video ads ...

      ;-)

      - Jesper
      --
      My security clearance is so high I have to kill myself if I remember I have it...
    2. Re:Yet another "we hate Gmail article"? by Niten · · Score: 2, Informative

      From a technical perspective, cross-site scripting (XSS) vulnerabilities isn't exactly a new thing. Nor are they isolated to Gmail.

      From what I gather about this exploit (and contrary to what the CNET article has to say about it) this is actually a cross-site reference forgery (CSRF) attack rather than XSS. The attack takes advantage of the fact that a malicious Web site's clients may have persistent GMail cookies in their web browsers: The attacking site directs the victim's web browser, (possibly, but not necessarily) using JavaScript, to make a POST request to GMail which creates a mail filter to copy all messages to an email address under the attacker's control. No JavaScript needs to be injected into GMail itself, so I don't really think it counts as XSS; in fact, the attacker never sees the actual session cookie or recovers the account password. Still, this is a huge threat, especially considering that so many people have their (Facebook|MySpace|AIM|whatever) accounts set up to send their password to their GMail accounts in case the password is "forgotten".

      If this is how the attack works, then Firefox's NoScript extension should protect you as long as you don't have the attacking web site whitelisted, even if the CSRF POST vector isn't JavaScript based.

      You're absolutely correct in stating that this isn't strictly a GMail problem, but rather a fundamental problem with using the Web as an application platform. In fact, I'd argue that CSRF attacks are an even more deeply rooted and difficult to deal with problem than any type of XSS. My friends might think I'm outdated, but this is why I still use fetchmail and mutt to grab my GMail messages by POP, staying logged out of the GMail web site as much as possible.

  8. Javascript needs a sandbox/security model by MobyDisk · · Score: 2, Interesting

    I can open HTML email in a standalone application (Thunderbird, Eudora, whatever) with very little concern about someone getting my login information. That's because there is an implicit barrier between the application state and the HTML page. But it is more difficult with web-based email: If you display HTML messages, then they are being displayed on the same page that has access to your login credentials.

    It seems to me that the most foolproof solution is to display the HTML email inside a sandbox that does not have access to the cookies (or any other part) of the enclosing page. There may be some way(s) to do this with browsers as they are today, but it seems like ultimately, such a sandbox should be designed-in to HTML and/or Javascript. Something like a chroot command.

    This would eliminate the constant cat & mouse game of scrubbing the HTML for something dangerous, then a new HTML/browser feature being used to get around it, etc.

    1. Re:Javascript needs a sandbox/security model by Bluesman · · Score: 4, Informative

      Javascript does have a sandbox security model based on the domain name of the javsacript/html source.

      Displaying the html mail in its own internal frame that pulls from a different domain name than the rest of the application should solve the problem you're referring to. Something like mail.googlecontent.com would work nicely.

      --
      If moderation could change anything, it would be illegal.
  9. Insecure by Default by Anonymous Coward · · Score: 2, Interesting

    Ummm - isn't this what /. always says about Microsoft?

    Trusting Google with you data is like playing Russian Roulette with an Automatic pistol, bad things will happen to your data

    Google says it is so easy to keep all your information online - and it is - where they can search it

    Google is the new Microsoft, more interested in profit than anything else (security, privacy, user rights)

    But hey, they use Linux, so I guess it is ok

    1. Re:Insecure by Default by pushing-robot · · Score: 5, Interesting

      Google is the new Microsoft, more interested in profit than anything else (security, privacy, user rights)

      This is a XSS browser exploit, which basically means that one site you're visiting can talk to other sites you're logged into. It's not Google's fault; nothing is breaking in to their servers, it's just malicious code running on your computer hijacking the connection you made to Google. It's your browser's fault for not sandboxing sites properly.

      Or to use an real-world analogy, it's like blaming Google because you forgot to log out at an internet cafe and then somebody else sat down and read your email.

      --
      How can I believe you when you tell me what I don't want to hear?
  10. Another reason to use NoScript by GroundBounce · · Score: 3, Informative

    If this is really a cross-site scripting vulnerability, NoScript might help protect against it (if you're using FireFox).

    1. Re:Another reason to use NoScript by IonOtter · · Score: 2, Informative

      I'll second and confirm this.

      I've had NoScript on my machine for almost a year now, and it's been getting better and better every month, especially now that they've included NoXSS. I've seen the XSS warning mostly on "news" sites, such as FoxNews, CNN and various big-name newspapers, and every time I saw it, NoScript had nixed it.

      I've seen the XSS warning in Gmail three times in all, always when clicking on a spam email, and each time it was stopped cold. I didn't dig too deep into it, but not long afterwards there were blurbs on the net about people getting PWN3D by an XSS-enabled email that their anti-virus software had cleared.

      Thanks to NoScript, I wasn't one of them.

      --
      [End Of Line]
  11. A good reason to use NoScript and Firefox by Lazarus_Bitmap · · Score: 2, Informative

    NoScript should prevent this exploit. It can be annoying to have to constantly give permission to sites to allow scripting, but it beats being hacked.

    I'm also wondering if running Gmail over SSL would make any difference...

    --
    -Laz .:change is inevitable -- growth is optional:.
  12. because by everphilski · · Score: 3, Insightful

    Because some of us don't spend the $5-$10 to go out to lunch ( I pack a lunch, saves money, healthier, etc), and prefer to spend our lunch hour checking the news online? Sure, during business hours while working that makes sense, maybe, but during my breaks and lunch (both of which I'm free to take when I want) I like to go online and do stuff. So that becomes problematic. Honestly the solution is education. Having good enough resources on the local network so that your users don't have to use gmail or a ftp site is key, and making sure they know how to use them.

    You can say tough shit, and I'd agree, employer has that right. But then I'd counter by saying I'd probably be keeping an eye open for a new employer :)

  13. Because gmail is better by quintessentialk · · Score: 3, Interesting

    I'll second the comment that this shouldn't suprise anyone. Where I work there are laws which require proper security, but in most other places I've been gmail was used widely. This is because 1. Gmail was more reliable than the 'official' email system 2. The search feature in gmail was way faster and smarter than the 'official' email system (e.g. outlook; squirrelmail) 3. The 'keep everything/multiple tags' model of gmail was less onerous than the maintenance the company expected (e.g.: keep your mailbox under a certain size; manually roate things to local storage; sort things by some directory system you'll probably be confused by when you look at it a year later...) What I'd like to see is more people using those intranet-sized google search and email servers I hear about. I hate my company's crappy intranet search engine, and the only thing good about outlook is its meeting-scheduling system. Using google technology, but on a company-controlled server, would seem the best of both worlds. But... I'm not an IT person. Maybe this would be horrible.

  14. httponly by Spy+der+Mann · · Score: 4, Informative

    In fact, the "cookie grabbing technique" is one of the oldest tricks in the areas of XSS.
    ... and this is the reason why the "httponly" cookie extension was created. Firefox 3 will support it, and I already modified my PHP framework to use this for the session cookies.
  15. Re:Avoidable? by PlusFiveTroll · · Score: 2, Informative

    No. The cookies are stolen upon transfer. You need to transfer your login data and save a cookie to receive the subsequent responses (viewing more then one message).

  16. Not XSS by requeth · · Score: 3, Interesting

    You dont need to use cross site scripting, it sends the user's entire email list, telephone numbers, alt emails, etc right after login for the googletalk applet. Run a packet dump, they turn off the encryption and then send all of the private data (negating userid/password). I sent in two support tickets on this in January but only received the generic autoreplies. To keep up with security news find a local hacker group.

  17. Much More Informative Article Here by Giorgio+Maone · · Score: 5, Informative

    It explains how the exploit works, how developers would/should avoid it and how users could protect themselves: http://hackademix.net/2007/09/26/gmail_csrf/

    --
    There's a browser safer than Firefox, it is Firefox, with NoScript
  18. That is inane. by jotaeleemeese · · Score: 2, Informative

    If you are not encrypting your email you are as exposed as your grandpa, so your recommendation is based in wishful thinking and not in actual hard technical facts.

    email is not a secure mechanism to transmit information, unless it is encrypted. End of the history.

    And as in regard to all those valuable contracts and what have you, I would like to inform you that email is not a guaranteed delivery mechanism, it works in a "best effort" to deliver basis. So I will not be sending any urgent information by email any time soon.

    --
    IANAL but write like a drunk one.
  19. A link to the ACTUAL article - and some FACTS! by Monkier · · Score: 3, Informative
    Google GMail E-mail Hijack Technique

    Some interesting points

    • nothing to do with cookies - it is google not correctly validating a form submitted from an 'evil' website
    • nothing to do with XSS - the ARTICLE calls it "Cross-site request forgery".