[ insider_reports_insider ]
Beware The Gmail Filter Attack
David Utter
Staff Writer
2007-09-26
 Insider Reports RSS Feed
An issue with Google's Gmail service could lead to one's email with attachments being quietly forwarded to a third party.
 | | Beware The Gmail Filter Attack |  |
UPDATE!: A Google spokesperson contacted us to advise everyone the CSRF problem has been corrected:
"Google takes the security of our users' information very seriously. We worked quickly to address the recently reported vulnerability, and we rolled out a fix. We have not received any reports of this vulnerability being exploited."
***
The problem stems from a cross-site request forgery, according to the post on GNU Citizen by hacker PDP. When exploited, it adds a filter to Gmail that will persist even after Google fixes the problem.
Gmail users can check under Settings > Filters to make sure they don't have a filter in place. The exploit can happen when a logged-in Gmail user visits a malicious website that delivers the attack.
The only way someone might catch this would be to regularly check the Filters for any changes. That would quickly prove tedious for the typical user, which is why the exploit poses a danger: most people won't think to check their Filters frequently.
WhiteHat Security CTO Jeremiah Grossman said on his blog that the Gmail exploit "is especially scary because...WebMail accounts are in many ways more valuable than a banking account."
He cited an example detailed at the Washington Post, where Brian Krebs described a Hotmail user's experience with an extortionist. The criminal held the person's email account for ransom.
The Hotmail user had used that email address and the same password to register on several other websites. That's not a good idea, and it appears he was able to make changes and save his other accounts from being accessed by the extortionist.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
