Gmail zero-day flaw allows attackers to steal messages

'Game over' if hackers use simple and silent exploit, says researcher

Accounts on Google's Gmail can be easily hacked, allowing any past -- and future e-mail messages -- to be forwarded to the attacker's own in-box, a vulnerability researcher said this week.

Dubbed a "cross-site request forgery" (CSRF), the Gmail bug was disclosed Tuesday by Petko Petkov, a U.K.-based Web vulnerability penetration tester who has made a name for himself of late. In the past two weeks, Petkov has publicly posted information about critical, zero-day bugs in Apple Inc.'s QuickTime, Microsoft's Windows Media Player and Adobe Systems' Portable Document Format (PDF).

According to Petkov, who declined to release details about the vulnerability, attackers can use Gmail's filtering feature to exploit the bug. An attack, he said, would start with a victim visiting a malicious Web site while also still logged into his Gmail account. The malicious site would then perform what Petkov called a "multipart/form-date POST" -- an HTML command that can be used to upload files -- to one of the Gmail application programming interfaces, then inject a rogue filter into the user's filter list.

Petkov posted a series of screenshots on the Gnucitizen.org site that illustrated one possible attack. "In the example, the attacker writes a filter, which simply looks for e-mails with attachments and forwards them to an e-mail of their choice," Petkov said. "This filter will automatically transfer all e-mails matching the rule.

"Keep in mind that future e-mails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google," he added.

Google did not immediately reply to questions about whether it had confirmed the vulnerability, and if so, when it would patch the problem.

At least one user commenting on Petkov's posting, however, claimed that a Firefox extension could block exploits of the Gmail bug. Giorgio Maone, the creator of the popular NoScript add-on, said that his extension blocks CSRF attacks from untrusted sites, which a malicious page likely would be. (NoScript blocks JavaScript, Java, other scripting and executable content from running from untrusted sites; Firefox users can download it from the Mozilla add-on site.)

As he did last week when he disclosed a major bug in Adobe's pervasive PDF file format, Petkov again defended his decision to post information about the Gmail flaw without first reporting the vulnerability to Google. The reasoning, however, was oblique: "Let's say that it is just one of my social experiments."

Jeremy Grossman, the chief technology officer at San Jose-based WhiteHat Security, said that the Gmail flaw is "especially scary." In an entry to his blog, Grossman explained further: "Web mail accounts are in many ways more valuable than a banking account because they maintain access to many other online accounts (blog, banking, shopping, etc.). [Attacks exploiting this vulnerability would be] simple, silent and extremely clever."

Petkov added his own two cents on the bug's implications. "In an age where all the data is in the cloud, it makes no sense for the attackers to go after your box," he said. "It is a lot simpler to install one of these persistent backdoor/spyware filters. Game over! They don't own your box, but they have you, which is a lot better."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?