Slashdot Mirror
G-Archiver Harvesting Google Mail Passwords
Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."
I'm almost willing to believe the G-Archive excuse that its debug code. From the screenshots posted online of the inbox (before it was deleted) I only see e-mails marked as unread. If the entire inbox is filled with unread e-mails then I'm willing to believe it was a throw-away e-mail account used for testing/debugging. Also this kind of "bug" seems really blatant and certainly headed for an easy discovery. I'd expect a more obfuscated means of transmitting the username and password, were one so inclined to bug the software.
However 1,777 seems a bit small for "popular software" if this represents every install since the bugged software was released. Furthermore, how does e-mailing a password to a random account help in debugging the software?
I'm almost willing to believe in human stupidity as the reason this happened, but not quite.
It's useful in case your account get stolen, or if it ever gets deleted by accident (it's happened to gmail users before).
GMail requires you to authenticate with their SMTP servers to send mail. His choices were to include the account password, implement his own SMTP server and build it into the program, or use an open SMTP server. That last will often get your mail dropped as spam. The second one would have been better-secured, but the guy was obviously dumb enough to include a phishing function in a backup program, so it's obvious why he went with option number one.
REM Old programmers don't die. They just GOSUB without RETURN.
- FBI NATIONAL COMPUTER CRIME SQUAD (May be outdated)
- FBI Tampa Cyber Crime squad (you may have your own local version of this)
- Internet Crime Complaint Center (IC3)
- CERT
- Forum for Incident Response and Security Teams
- Swedish IT incident Center (sitic at pts dot se)
Of course you may have your own national version of IT incident reporting.So if we really want to avoid having the police hunt us for petty crimes of downloading files - give them something real. :-)
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
That was Ken Thompson, coinventor of UNIX.
Give me Classic Slashdot or give me death!
I'm on the fence. On one hand, sending them to your own account seems pretty stupid. One the other hand, if the software has been out there for a while I would think I would notice suddenly getting a bunch of usernames and passwords in my inbox. Perhaps it was a real "oh crap" moment and he figured that he could sneak the fix into a patch before someone else noticed what was going on. It doesn't look like the emails had to be read, incidentally, it looks like the username and password were on the subject line.
"It is a miracle that curiosity survives formal education." -Albert Einstein
Have you read the summary? If you used the G-Archiver program then your details will have been leaked. If you just use Gmail then there is no concern.
He did it so he could more easily troubleshoot support calls on his new "Unix" operating system.
Cretin - a powerful and flexible CD reencoder
Oh, by the way, you realize that lots of people are paid to audit OSS code before they deploy it in their company, right? The ability to do this is actually a selling point for a lot of companies. (and unless the software has got a built-in ansible, that should be good enough for almost all applications.) What are you talking about?
weirdest thing I ever saw: scientology advertising on slashdot.
This door would more than likely leave a copy of the message in the users 'sent' folder. The chances of someone detecting that are far more likely than the hoops this particular user jumped through to decompile the code.
Just another thing that points to the application author's malicious intent. By utilizing his own credentials he was able to authenticate to Gmail as himself and shoot himself an email with no trace in the end-user's sent box.
Launch every sig.
So? Somebody you trust can do it for you. Or, you can trust that there are enough people looking at the code that they'll find any big problems, and that news of these problems will find its way to you. With non-free software, the number of people looking at the code is much smaller.
http://outcampaign.org/
Stop me if I'm wrong, but Google previews the first line of the message, right next to the Subject header (as is evident in the screen shot). So there's no need to even "read" the message.
This is misleading. They should have fully disclosed the problem if they want to re-gain anyone's trust. It wasn't that they "may" have been revealed; they as a matter of fact "WERE" revealed. An admission that their program LOGGED AND TRANSMITTED PASSWORDS TO THE PARENT COMPANY would also have been nice.
"Question with boldness even the existence of a god." - Thomas Jefferson
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
man strings
Can't remember if strings is part of Microsoft's "Unix tools for Windows" though, but Cygwin32 will do the trick.
I was assuming the source does not match binaries case, and for a one-man project like G-Archiver.
How trivial is that to verify if I control both? Depending on the compiler/options you could get some different executables...
Easily could be a test email address that he uses for only that purpose. I'll give him the benefit of the doubt on this one. That doesn't mean I'll use the product however. You have two cases. Either (a) the coder is malicious -or- (b) the coder is sloppy. If I'm paying for a program (g-archiver's site says it's 29.95) then I expect the code to be of good quality ... and having debug code in does not count as good code in my opinion.
Also, I'm kinda interested in his market. Thunderbird has an option to download/sync to a local machine. I'm curious why you'd want to use yet another tool when a decent email client has the same basic feature.
Lack of planning on your part does not constitute an emergency on mine.
Yeah, logging; logging the usernames and passwords of every single user. Perfectly legitimate!
If something is collecting my login information (and thus access to every conversation made using that address), I expect a damn good reason and I expect it before someone else exposes it and potentially gains access to my account and countless others. For that matter, I expect it before the money leaves my hands.
I just read Slashdot for the articles.