Cloud // Software as a Service
06:34 PM
Connect Directly

Google Gmail, Other Apps, Vulnerable To Attack

Security researchers alert the company to a bug that could let hackers use Google Maps to infiltrate Google, Google Mail, or Google Apps accounts.

Google's online applications are vulnerable to attack, two security researchers claimed Friday.

Google Gmail, for example, is vulnerable to a frame injection attack that could be used to phish login credentials from Google users.

Adrian 'pagvac' Pastor, a security researcher with, on Friday posted proof-of-concept code that can inject a third-party page -- a fake login page in Pastor's example -- while the user's browser address bar still displays the Google domain. This could dupe the user into entering login details.

"The beauty of frame injection attacks is that the attacker is able to impersonate a trusted entity without needing to bypass XSS/HTML filters or even break into the target server," Pastor explained on the GNUCitizen site.

In a related blog post on Friday, security researcher Aviv Raff explained that Google is vulnerable to "a cross-domain Web-application sharing security design flaw."

The vulnerability reportedly affects other applications beyond Gmail. According to Raff, applications in Google's subdomains --,,,, and -- are affected. This means, for example, that Google Maps can be used to hijack Google, Google Mail, or Google Apps accounts.

Raff says he notified Google about the problem shortly after he identified it in April and that Google said the issue was being investigated.

"Today, after not getting any further response from the Google security team about this issue, and after Adrian published his proof-of-concept, I've decided to reveal this information in a hope that this security design flaw will be fixed by Google as soon as possible," said Raff.

In reference to the proof-of-concept, a Google spokesperson said, "We're aware of the potential for this kind of behavior when services are hosted across multiple domains, and we take steps to restrict it where we believe it may have security consequences."

Comment  | 
Print  | 
More Insights
8 Steps to Modern Service Management
8 Steps to Modern Service Management
ITSM as we know it is dead. SaaS helped kill it, and CIOs should be thankful. Hereís what comes next.
Register for InformationWeek Newsletters
White Papers
Current Issue
Increasing IT Agility and Speed To Drive Business Growth
Learn about the steps you'll need to take to transform your IT operation and culture into an agile organization that supports business-driving initiatives.
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.