Gmail accounts threatened by vulnerability

from ComputerWorld UK 25/9/2007
Website: http://www.computerworlduk.com

Google's Gmail can be easily hacked, allowing any past and future emails to read by hackers, according to a vulnerability researcher.

A "cross-site request forgery" (CSRF) bug was disclosed by Petko Petkov, a UK-based web vulnerability tester who has made a name for himself of late. In the past two weeks, Petkov has publicly posted information about critical, zero-day bugs in Apple's QuickTime, Microsoft's Windows Media Player and Adobe's Portable Document Format (PDF).

According to Petkov, who declined to release details about the vulnerability, attackers can use Gmail's filtering feature to exploit the bug. An attack, he said, would start with a victim visiting a malicious website while also still logged into his Gmail account. The malicious site would then perform what Petkov called a "multi-part/form-date POST" - an HTML command that can be used to upload files - to one of the Gmail application programming interfaces, then inject a rogue filter into the user's filter list.

Petkov posted a series of screenshots on the Gnucitizen.org site that illustrated one possible attack. "In the example, the attacker writes a filter, which simply looks for emails with attachments and forwards them to an email of their choice," Petkov said. "This filter will automatically transfer all emails matching the rule.

"Keep in mind that future emails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google," he added.

Google did not immediately reply to questions about whether it had confirmed the vulnerability, and if so, when it would patch the problem.

As he did last week when he disclosed a major bug in Adobe's pervasive PDF file format, Petkov again defended his decision to post information about the Gmail flaw without first reporting the vulnerability to Google. The reasoning, however, was oblique: "Let's say that it is just one of my social experiments."

Jeremy Grossman, the chief technology officer at WhiteHat Security, said that the Gmail flaw is "especially scary." In an entry to his blog, Grossman wrote: "Webmail accounts are in many ways more valuable than a banking account because they maintain access to many other online accounts (blog, banking, shopping, etc.). [Attacks exploiting this vulnerability would be] simple, silent and extremely clever."

Petkov added his own two cents on the bug's implications. "In an age where all the data is in the cloud, it makes no sense for the attackers to go after your box," he said. "It is a lot simpler to install one of these persistent backdoor/spyware filters. Game over! They don't own your box, but they have you, which is a lot better."