Security researchers alert the company to a bug that could let hackers use Google Maps to infiltrate Google, Google Mail, or Google Apps accounts.
Google's online applications are vulnerable to attack, two security researchers claimed Friday.
Google Gmail, for example, is vulnerable to a frame injection attack that could be used to phish login credentials from Google users.
Adrian 'pagvac' Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page -- a fake login page in Pastor's example -- while the user's browser address bar still displays the Google domain. This could dupe the user into entering login details.
"The beauty of frame injection attacks is that the attacker is able to impersonate a trusted entity without needing to bypass XSS/HTML filters or even break into the target server," Pastor explained on the GNUCitizen site.
In a related blog post on Friday, security researcher Aviv Raff explained that Google is vulnerable to "a cross-domain Web-application sharing security design flaw."
The vulnerability reportedly affects other applications beyond Gmail. According to Raff, applications in Google's subdomains -- maps.google.com, images.google.com, news.google.com, mail.google.com, and google.com -- are affected. This means, for example, that Google Maps can be used to hijack Google, Google Mail, or Google Apps accounts.
Raff says he notified Google about the problem shortly after he identified it in April and that Google said the issue was being investigated.
"Today, after not getting any further response from the Google security team about this issue, and after Adrian published his proof-of-concept, I've decided to reveal this information in a hope that this security design flaw will be fixed by Google as soon as possible," said Raff.
In reference to the proof-of-concept, a Google spokesperson said, "We're aware of the potential for this kind of behavior when services are hosted across multiple domains, and we take steps to restrict it where we believe it may have security consequences."
SaaS As Innovation Driver?Software as a service is the clear No. 1 way enterprises consume cloud. InformationWeek's SaaS Innovation Survey reveals three tips to get the most from SaaS: Make it a popularity contest. Have an escape plan. And remember that identity is the new perimeter.
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.