Cloud // Software as a Service
News
10/10/2008
06:34 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Gmail, Other Apps, Vulnerable To Attack

Security researchers alert the company to a bug that could let hackers use Google Maps to infiltrate Google, Google Mail, or Google Apps accounts.

Google's online applications are vulnerable to attack, two security researchers claimed Friday.

Google Gmail, for example, is vulnerable to a frame injection attack that could be used to phish login credentials from Google users.

Adrian 'pagvac' Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page -- a fake login page in Pastor's example -- while the user's browser address bar still displays the Google domain. This could dupe the user into entering login details.

"The beauty of frame injection attacks is that the attacker is able to impersonate a trusted entity without needing to bypass XSS/HTML filters or even break into the target server," Pastor explained on the GNUCitizen site.

In a related blog post on Friday, security researcher Aviv Raff explained that Google is vulnerable to "a cross-domain Web-application sharing security design flaw."

The vulnerability reportedly affects other applications beyond Gmail. According to Raff, applications in Google's subdomains -- maps.google.com, images.google.com, news.google.com, mail.google.com, and google.com -- are affected. This means, for example, that Google Maps can be used to hijack Google, Google Mail, or Google Apps accounts.

Raff says he notified Google about the problem shortly after he identified it in April and that Google said the issue was being investigated.

"Today, after not getting any further response from the Google security team about this issue, and after Adrian published his proof-of-concept, I've decided to reveal this information in a hope that this security design flaw will be fixed by Google as soon as possible," said Raff.

In reference to the proof-of-concept, a Google spokesperson said, "We're aware of the potential for this kind of behavior when services are hosted across multiple domains, and we take steps to restrict it where we believe it may have security consequences."

Comment  | 
Print  | 
More Insights
8 Steps to Modern Service Management
8 Steps to Modern Service Management
ITSM as we know it is dead. SaaS helped kill it, and CIOs should be thankful. Hereís what comes next.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Apps will make or break the tablet as a work device, but don't shortchange critical factors related to hardware, security, peripherals, and integration.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.