Slashdot Mirror
G-Archiver Harvesting Google Mail Passwords
Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."
Oh, wait...
"The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in [CC] the product."
Right. And I have a bridge I'd like to sell you too.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
If you're debugging, you already have the account details. What possible reason could you have to email them to yourself?
If this was a big company, they would have denied it and gone after him under the DMCA. At least the admitted to something and pulled to product.
It only did send them to Gmail :)
what can be explained by incompetance?
Although in this case, that's some serious incompetance going on!
It doesn't mean much now, it's built for the future.
So why did the binary program also have the password for the gmail account? One would assume that the email address would have been enough. After all, sending someone email doesn't require their password.
Today's Sesame Street was brought to you by the number e.
Possibly by some ridiculous interpretation of the law, Mr. Books was "hacking." However, he purchased the rights to use G-Archiver, and he did not recompile the program in a different way and label it his own. He used information that the program (to which he has the rights to use, unless otherwise stated in some bullsheet EULA) used, found out that this program acted like a Trojan virus and submitted private information to an individual's e-mail account, and subsequently removed his information and disallowed any new information to be read.
Granted, he probably shouldn't have deleted everything and changed the password (morally: yes, legally: no), so it's likely he may face charges because of this. That's our legal system, folks.
Yeah, I was logged into your account and noticed that too....very strange!
Maybe I'm getting old, but this seems like a pretty clear case of "oh crap, I'm an idiot", rather than "mwuahahah, my plan for global domination proceeds apace!". According to the posting on codinghorror, the guy who found the issue (Dustin Brooks) found that the creator, John Terry, of the G-Archiver software had left his own email information in the code. Yes, the G-archiver forwarded a record of the account information of everyone who used the app to that mailbox, but if you look at the screenshot, none of those emails has been flagged as read by gmail (but maybe that's an artifact of a POP connection?).
Either way, this just smacks to me of a novice developer doing something incredibly dumb, rather than incredibly malicious. If he actually wanted to just collect other people's account information, why leave his own in the source code? He could have just as easily forwarded the information to an anonymized email account, or simply an account for which the login information was not present in source.
Just my opinion, I reserve the right to be wrong.Oh, by the way, you realize that lots of people are paid to audit OSS code before they deploy it in their company, right? The ability to do this is actually a selling point for a lot of companies. (and unless the software has got a built-in ansible, that should be good enough for almost all applications.) What are you talking about?
weirdest thing I ever saw: scientology advertising on slashdot.