Slashdot Mirror
G-Archiver Harvesting Google Mail Passwords
Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."
Oh, wait...
"The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in [CC] the product."
Right. And I have a bridge I'd like to sell you too.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Maybe _this_ is why I'm getting more spam in my gmail account lately?
If it isn't, surely someone had a boner after reading the article and is coding as we speak...
If you're debugging, you already have the account details. What possible reason could you have to email them to yourself?
Trust me, trust me not, trust me, trust me not.
Oh damn, there goes my password.
Do you believe the developer? What debug code needs to send an email containing user account information?
Trying to become famous by taking photos. Visit my homepage please.
If this was a big company, they would have denied it and gone after him under the DMCA. At least the admitted to something and pulled to product.
You don't have to work in IT to know that there is no reason for G-Archiver to send the password to anyone but Google. This guy deserves to be prosecuted under anti-hacking statutes.
Good intentions and all, but I'm sure Mr. Brooks just opened himself up to "hacking" charges.
Looks like someone got caught with their pants down in the cookie jar. That's not nearly as hot as it sounds.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
You have 6.5 gig of space on redundant remote servers. What are you backing up? Perhaps I do not understand what this application does and who needs it...
Ask not what you can do for your country. Ask what your country did to you
what can be explained by incompetance?
Although in this case, that's some serious incompetance going on!
It doesn't mean much now, it's built for the future.
And this, children, is why you should never ever give the password to your account to someone else. Not even someone who claims to want to do something for you. Once you've given it to them, you have no control over what they do with it.
I'm almost willing to believe the G-Archive excuse that its debug code. From the screenshots posted online of the inbox (before it was deleted) I only see e-mails marked as unread. If the entire inbox is filled with unread e-mails then I'm willing to believe it was a throw-away e-mail account used for testing/debugging. Also this kind of "bug" seems really blatant and certainly headed for an easy discovery. I'd expect a more obfuscated means of transmitting the username and password, were one so inclined to bug the software.
However 1,777 seems a bit small for "popular software" if this represents every install since the bugged software was released. Furthermore, how does e-mailing a password to a random account help in debugging the software?
I'm almost willing to believe in human stupidity as the reason this happened, but not quite.
Suppose you want to harvest all users' emails by simply mailing them to your own account. Why on h^Hearth do you need the password of this account to be written in the source code?
My first program:
Hell Segmentation fault
So why did the binary program also have the password for the gmail account? One would assume that the email address would have been enough. After all, sending someone email doesn't require their password.
how about that guy who modified the login program to give him a backdoor hard-coded password and username? then he modified the compiler to recognize when it was compiling login and automatically insert the code, and deleted that code from login so it wouldn't be apparent in a code review. then he modified the compiler to recognize when it was compiling itself, and insert the code to modify both itself and login, and then deleted that code from the compiler as well. now there ain't no code to do that in the source code no more, but it does it anyway. eh?
Isn't the whole freakin point of GMail that you don't have to backup?
10 ?"Hello World" life was simple then
Maybe I'm getting old, but this seems like a pretty clear case of "oh crap, I'm an idiot", rather than "mwuahahah, my plan for global domination proceeds apace!". According to the posting on codinghorror, the guy who found the issue (Dustin Brooks) found that the creator, John Terry, of the G-Archiver software had left his own email information in the code. Yes, the G-archiver forwarded a record of the account information of everyone who used the app to that mailbox, but if you look at the screenshot, none of those emails has been flagged as read by gmail (but maybe that's an artifact of a POP connection?).
Either way, this just smacks to me of a novice developer doing something incredibly dumb, rather than incredibly malicious. If he actually wanted to just collect other people's account information, why leave his own in the source code? He could have just as easily forwarded the information to an anonymized email account, or simply an account for which the login information was not present in source.
Just my opinion, I reserve the right to be wrong.[...]
Google's statement continues. "We are investigating this incident, the underlying activities of which violate Gmail Program Policies. We have suspended the suspect account, and are in the process of notifying the owners of those accounts whose passwords may have been compromised. It's unfortunate that fraudsters continue to use email for these purposes. We have phishing detection capabilities built into Gmail, so we were able to act quickly to limit the impact of this particular attack." I have never read Google's Privacy Policy but am slightly concerned that they appear to be able to access emails after their deletion.
"Madness is something rare in individuals - but in groups, parties, peoples, ages it is the rule." -- Nietzsche
I stopped using shareware and only use open source software. You never know what kind of crap the programmer might have stuck in there unless you can read the source yourself.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
by using a protocol analyzer to recover my OWN login and password for my side of the company's intranet. Turned out that the web software we used (can't remember the name, but it was not front phage, but it was indeed popular at the time) was harvesting or retaining ALL USER ACCOUNTS names and passwords. I became scared shitless because I was not sure how IT would feel. But I was former IT in the company and felt obligated to warn them that the vendor was conducting shitty coding processes and put not only OUR company at risk but other companies as well. If they had any diagnostic or call-home code in their web site building software, then potentially a corrupt employee in their company could gain some limited or full access to many companies' intranets if they gained physical access to the building. And, we all know about piggy-backing, where thieves waltzed in behind other employees, then proceeded to lift laptops, purses, keys, wallets, documents, whatever they could steal.
..
DAMN, I wish I could recall the name. I may
Here we go... I'm PRETTY damned sure it was NetObjects Fusion. Just googled "Year 1999 web building applications intranet web" and they were at the top of the list... I preferred it over front phage, but...
And, now that I Google "Year 1999 protocol analyzer sniffer packet" it seems to refresh my memory that I am PRETTY sure Sniffer Basic was the tool I used.
Of course, after that I never used any such tool on the LAN. But, being formerly in the IT department, and knowing what to look out for to help the company probably kept me out of trouble.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
What twisted, warped world do you live in where it is unethical to stop a crime-in-progress?
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
When you delete e-mails (even if you hit "Delete Forever"), GMail does not actually delete your e-mails right away. All that happens is you can't see them any more. Google has been rather forthright about this from day 1 of the Beta; it raised a big furor when GMail was first released.
From the GMail Privacy Policy: (which is blessedly short, and in English)
"You may organize or delete your messages through your Gmail account or terminate your account through the Google Account section of Gmail settings. Such deletions or terminations will take immediate effect in your account view. Residual copies of deleted messages and accounts may take up to 60 days to be deleted from our active servers and may remain in our offline backup systems."
SirWired
Have you read the summary? If you used the G-Archiver program then your details will have been leaked. If you just use Gmail then there is no concern.
He did it so he could more easily troubleshoot support calls on his new "Unix" operating system.
Cretin - a powerful and flexible CD reencoder
What happened was that a member of our development team had inserted coding used for testing G-Archiver in the debug version and forgot to delete it in the final release version.
Just a few suggestions:
1) Use source control and know how to use it. Know how to tag releases and when your code is 'frozen' and ready to ship. Communicate.
2) Know how to use your source control to ID recent changes. Review recent changes.
3) At least know how to use diff, for Christ's sake. Diff your code and look for recent changes.
4) Just a thought, you might want to move your soon to be released code to another repository. Just a thought.
5) LART any programmer touching the soon to be released code without communicating or following through (i.e. removing debug code). If the said programmer is a cowboy, move that programmer over to sales.
6) Dare I say it, QA and code reviews. Even short-cycle extreme programming has de facto code reviews in that 2 programmers check each other's work.
As projects get larger and more complex, version control get harder. But a few basic rules can help out.
putting the 'B' in LGBTQ+
Oh, by the way, you realize that lots of people are paid to audit OSS code before they deploy it in their company, right? The ability to do this is actually a selling point for a lot of companies. (and unless the software has got a built-in ansible, that should be good enough for almost all applications.) What are you talking about?
weirdest thing I ever saw: scientology advertising on slashdot.
Had any of the emails been looked at?
If they were all unread, and if the last login on that account was like forever ago, then maybe the developer's story is the truth.
But this is a key example of where open source wins, because most eula's will have a don't decompile clause.
"Never attribute to malice that which can be adequately explained by stupidity"
Although in this case I think stupidity might not be an appropiate term. Unless you have oversight (either peer or some other form) it's quite easy to accidently leave deubugging code in a release. I'll hold my hand up and say I've done it; any programmer who says they haven't done it - or at least something similar - is either delusional, hasn't noticed yet or is a downright liar.
Yeah, I had a sig once; I got bored of it.
As I read the comments attached to this article, I see that many slashdotters can't imagine why this debug code would be put into the software in the first place.
To those slashdotters: You people have no imagination.
Imagine you're a G-Archiver developer, and one of your customers calls you, saying "Your program doesn't work. It's saying something about an invalid user." In order to reproduce the problem, you ask the customer for his credentials. He tells you his username and password over the phone, and you try logging in yourself. It works fine.
After a while, you think the problem might be that the password being entered is different from the one you were given over the phone. Perhaps it has something to do with the customer's strange keyboard layout, or maybe the customer's keyboard has some flaky keys.
So what do you do? You give that one customer a special build of the software that emails you the username and password as entered.
Later, you accidentally check in the debug code for that special build. Oops.
Thanks!
I call:
- ms word ms blurb
- access abscess
- excel hexedcell
- x box hexed box
- outlook LOOKOUUUTTT!!!!
- powerpoint powerpointless
But, I'd have to say my faves are abscess and front phage...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
This is misleading. They should have fully disclosed the problem if they want to re-gain anyone's trust. It wasn't that they "may" have been revealed; they as a matter of fact "WERE" revealed. An admission that their program LOGGED AND TRANSMITTED PASSWORDS TO THE PARENT COMPANY would also have been nice.
"Question with boldness even the existence of a god." - Thomas Jefferson
I've written a lot of code in my time. I've never written a routine/method/function that saved user account names and passwords then emailed them to myself. Writing passwords to the local system is fine, but even that you have to do correctly (in a sufficiently encrypted form) and you must notify the user. I can't understand how he could possibly justify creating emails that transmit password information as simply a debugging accident. The debugging process probably shouldn't involve automatically creating emails. And if it does, it probably shouldn't include secure information. And if it does, it probably shouldn't include secure information from the user without notifying them.
I don't think this can be justified. You can't "accidentally" harvest account names and passwords. Bells go off in the head when you're writing code that says "create an email, send it to this address, and include the current user's username and password."
Turns out, I have actually oiled snakes. And I am not talking plumbing snakes.
I worked at a pet store that did some light animal care, and snakes were some of the animals we treated and kept. The oil was Linatone(tm). It helps snakes shed, and it is lightly anti-biotic and anti-microbial and anti-parasite. (it makes reptiles happy 8-).
So yes, snake oil for oiling snakes...
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press