Slashdot Mirror
A Good Reason To Go Full-Time SSL For Gmail
Ashik Ratnani writes with this snippet from Hungry Hackers: "A tool that automatically steals IDs of non-encrypted sessions and breaks into Google Mail accounts has been presented at the Defcon hackers' conference in Las Vegas. Last week, Google introduced a new feature in Gmail that allows users to permanently switch on SSL and use it for every action involving Gmail, not just authentication. Users who did not turn it on now have a serious reason to do so, as Mike Perry, the reverse engineer from San Francisco who developed the tool, is planning to release it in two weeks."
Or else someone could hijack my accBILL GATS SI TEH DEVLI!!!!!!!!!
Is there any reason to not use SSL every time one sends a password?
Unfortunately, the general public still seems entirely uneducated about SSL, figuring that passwords must be secure because they appear as bullets on the screen, right?
Once you're signed into Gmail: Settings -> Always use https -> Save changes
For info on the new setting and how to enable it, see the Gmail blog post.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
Mike Perry did a great public service by making this tool and making it available.
This attack also works against yahoo mail, hotmail, etc. Just Yahoo, hotmail, etc don't even OFFER SSL, so well, if you use them, your FSCKed.
And Google has known about this problem for a LONG time. EG, see my blog post from last february!.
Google waited for a year before even giving users the OPTION to be protected when SSL is used, and notice that it was only after they found out about Mike Perry's talk that the option was even added.
Also, as I argue, they got it wrong. The checkbox is good, but most users don't know about it. But if a user MANUALLY enters https://mail.google.com/ I argue that google should INFER that the user wants to be SSL-only, at least until they explicitly log out.
Test your net with Netalyzr
Is this the road we're going down? Pseudo-homophones of idiomatic phrases?
Yeah, yeah, grammar pedantry is bad. Nevertheless, this stuff hurts to read.
Can you be Even More Awesome?!
What is a "reverse engineer?"
A very specialized transmission engineer in Detroit.
Intron: the portion of DNA which expresses nothing useful.
Until Google added the option, it never actually set the GX cookie as secure, so you could do an active-hijack of any OTHER connection they make so that it does a redirect to http://mail.google.com/ and spits out the cookie in the clear for the attacker to capture.
Test your net with Netalyzr
Unless you SET THE PREFERENCE, you are insecure, even if you MANUALLY type in https://mail.google.com/ always.
Because unless you SET THE PREFERENCE, google does NOT set the session cookie to be SECURE.
This is what Mike Perry's tool does: it takes any of your OTHER connections, redirects it to http://mail.google.com/ so your browser spits out the session cookie anyway, and then can redirect you back (so you don't know what happened).
Google's SSL mode for gmail, UNLESS YOU SET THE PREFERENCE, offers you NO protection against an active adversary. And since someone snooping your traffic at starbucks can just as easily inject packets, IT OFFERS NO PROTECTION EVEN IF YOU MANUALLY TYPE IN HTTPS ALL THE TIME, UNLESS YOU SET THE PREFERENCE!!!!
Test your net with Netalyzr
Selecting 'Always use https' breaks Gmail Notifier. Luckily Google has released a patch for this. Here is a link: http://mail.google.com/support/bin/answer.py?hl=en&answer=9429
It's someone who manufactures a problem using only working solutions.
You might also know them as: "politicians".
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
I can understand that back in the web's "stone age" (mid 1990s), having HTTPS for every web site would have seriously slowed down all the computers due to CPU usage, but nowadays is there any real good reason that the whole web can't be HTTPS?
With all the government and ISP snoopings going on, I'm surprised that at least some sites haven't gone that way.
(or is it that embedded browsers like on cell phones can't do SSL?)
TDz.
Karma: Excellent. 15 moderator points expire sometime.
Mike Perry's site might (or might not) be a better source than some random blog post that doesn't even link to it.
I mean it's Google Mail, Google stores your e-mails till all ethernity and will surely hand it out to any dictator waving something which looks like an official document.
It doesn't matter much how secure the login is as the service itself is designed to be a gapping security hole.
Yes, this is a vulnerability. But it isn't like every person out there on the internet is going to be able to steal your session cookies in two weeks when the tool is released.
In order to execute this attack, a person would have to be able to sniff your packets and steal the cookies. And since the vast majority of people on the internet have no ability to intercept your traffic, this means in practice, the average person is pretty safe without having to worry about all this.
http://lkml.org/lkml/2005/8/20/95
I don't understand why does someone need to prove a security vulnerability by releasing the tool?
By releasing this tool he will make it available for anyone with bad intentions to implement it. Weeks later we will have issues all over the place because we did not teach our grandparents to enable the checkbox in gmail; or the vulnerability is exploited in other webmail clients. By then, the botnets will be hijacking Gmail accounts to send Spam to everybody
So, really, who benefits of the release of this tool?
I reed slashdot, witch is why I spell gooder than any won els.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Now that I've read this tidbit, I'm sure this is how my Gmail account was compromised.
Last week, I noticed some logins from a Blackberry IP, accessing my Gmail via POP3, which I never use. Someone had apparently gone into my account, turned on POP, then set up their phone accordingly. Now, I have to say, my password is completely unguessable (think along the lines of something like %sprTres3005!). Furthermore, my password is not written down anywhere, and has never been used anywhere except Gmail and a couple banking web sites I use. NEVER used on forums, or bullshit misc. online services. Yet, somehow, someone got into my account. I'm convinced this aforementioned tool was how they did it.
I wonder if the Google Notifier for Mac OS doesn't use secure channels, and that's how they got me. The Google Reader Notifier actually does have an option "Always use https" which is good. I don't see that option in the Gmail Notifier, though.
One thing that I find somewhat counterproductive is that browsers do not save files sent over SSL in their caches.
It's sensible, I suppose, to assume that if something's sent over an SSL channel that it's sensitive and therefore shouldn't be saved, but it would give a speed and bandwidth efficiency hit which would deter usage of SSL for everyday browsing.
You could, of course, have the HTML transmitted over SSL and the supporting images over plain HTTP, but then the browser will scare people by warning that not all content on the page is secure..
I think browsers should start looking at encrypting their cache files, so that stuff such as SSL can be accommodated without breaking caching.
mutt -f imaps://imap.gmail.com
The summary (and many, many replies) have it all wrong. The point is not that you need to be encrypting all of your traffic to Gmail (for example) with SSL.
The need for SSL-encrypting your session was known with sidejacking. If you use SSL for credential exchange but not for the whole session, your session cookie is transmitted in the clear, and an attacker can sniff it and use your session (as the cookie acts temporarily as a credential). Encrypting the whole session with SSL prevents this. This is well-known at this point.
The subject of this talk was not sidejacking. If the site (Gmail) does not set the secure bit on the session cookie, then your session cookie can be transmitted in the clear, even if all of your intentional communication with Gmail is over SSL! An attacker need only inject a link to the appropriate domain (e.g., mail.google.com) in some other page you request, and the cookie will be sent with that request over HTTP. Only by marking the cookie as secure will the browser refuse to send it over HTTP.
The author of this post seems to be really, really confused. There were multiple presentations on ways to hack your Google accounts and Google security flaws, etc.
There was a presentation on howto exploit Google Gadgets (which have access to your local javascript), a few presentations on Cross-Site Request Forgery (CSRF)(which you can do to send your own HTTP requests as the visitor if you have your own image or iframe on the page), and a presentation on hijacking your sessions if you ever access a site over plain-text (non-SSL), and putting the password page on SSL doesn't help (this requires the attacker to be on your local network!!!!!!!).
The title of the post sounds like they're talking about The Middler, a Ruby-based proxy by Jay Beale for intercepting all user data on a shared network, such as a coffee shop, where you can get users to go through your proxy.
If the author is talking about The Middler ... that attacker has to be on your network!!! This is only an issue on untrusted networks.
Jay Beale's talk was the one the mentioned SSL the most, so I'm gonna guess that the author is talking about that, even tho the article seems to mix everything up.
To see the descriptions of the actual talks and whatnot, visit the DEFCON schedule: https://www.defcon.org/html/defcon-16/dc-16-schedule.html
Look under "Settings" --> "General" then at the very bottom it says "Always use https". (It doesn't mention SSL so searching the page for SSL turns up nothing).
"Last week, Google introduced a new feature in Gmail that allows users to permanently switch on SSL and use it for every action involving Gmail, not just authentication."
Unfortunately not available for anyone who has their own domain's email hosted at google :(
Using SSL for everything is too expensive in terms of computing resources. Gmail gets a staggering amount of traffic as it is, I don't know that they could handle all of it being run through the SSL hardware. I'm just happy the setting is there at all.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Intents and Purposes. Sounds redundant and in fact it is. After the Norman Conquest of Britain, it became customary to use both the Norman (French derived) and Saxon words in certain phrases so everyone would understand. It lingers on to this day especially in legal terms. Cease and Desist. Will and Testament. Intents and Purposes.
None of them can see the clouds; The polished wings don't care.
"Cease" and "desist" do not mean the same thing. Neither do "will" and "testament," nor do "intents" and "purposes." Use a dictionary to verify.
To start you off: "cease" means "to stop" while "desist" means "to refrain from doing."
blog