[ot] Gmail hit by zero-day
- From: pluto <pluto@xxxxxxxxxxxx>
- Date: Fri, 28 Sep 2007 08:01:13 +0800
27 September 2007
Gmail hit by zero-day
By Gregg Keizer, Computerworld
Google's Gmail can be easily hacked, allowing any past and future emails to be
read by hackers, according to a vulnerability researcher.
A "cross-site request forgery" (CSRF) bug was disclosed by Petko Petkov, a
UK-based web vulnerability tester who has made a name for himself of late. In
the past two weeks, Petkov has publicly posted information about critical,
zero-day bugs in Apple's QuickTime, Microsoft's Windows Media Player and Adobe's
Portable Document Format (PDF).
According to Petkov, who declined to release details about the vulnerability,
attackers can use Gmail's filtering feature to exploit the bug. An attack, he
said, would start with a victim visiting a malicious website while also still
logged into his Gmail account. The malicious site would then perform what Petkov
called a "multi-part/form-date POST" - an HTML command that can be used to
upload files - to one of the Gmail application programming interfaces, then
inject a rogue filter into the user's filter list.
Petkov posted a series of screenshots on the Gnucitizen.org site that
illustrated one possible attack. "In the example, the attacker writes a filter,
which simply looks for emails with attachments and forwards them to an email of
their choice," Petkov said. "This filter will automatically transfer all emails
matching the rule.
"Keep in mind that future emails will be forwarded as well. The attack will
remain present for as long as the victim has the filter within their filter
list, even if the initial vulnerability, which was the cause of the injection,
is fixed by Google," he added.
Google did not immediately reply to questions about whether it had confirmed the
vulnerability, and if so, when it would patch the problem.
As he did last week when he disclosed a major bug in Adobe's pervasive PDF file
format, Petkov again defended his decision to post information about the Gmail
flaw without first reporting the vulnerability to Google. The reasoning,
however, was oblique: "Let's say that it is just one of my social experiments."
Jeremy Grossman, the chief technology officer at WhiteHat Security, said that
the Gmail flaw is "especially scary." In an entry to his blog, Grossman wrote:
"Web mail accounts are in many ways more valuable than a banking account because
they maintain access to many other online accounts (blog, banking, shopping,
etc). [Attacks exploiting this vulnerability would be] simple, silent and
extremely clever."
Petkov added his own two cents on the bug's implications. "In an age where all
the data is in the cloud, it makes no sense for the attackers to go after your
box," he said. "It is a lot simpler to install one of these persistent
backdoor/spyware filters. Game over! They don't own your box, but they have you,
which is a lot better."
=====================================================
=====================================================[WHEN REPLYING TO MY XPOST PLEASE DELETE THE XPOST]
.
- Prev by Date: Foreign students: Overlooked and over here
- Next by Date: Burmese Military Cracks Down On Escalating Protests
- Previous by thread: Foreign students: Overlooked and over here
- Next by thread: Burmese Military Cracks Down On Escalating Protests
- Index(es):
Relevant Pages
|
