Google Gmail, Other Apps, Vulnerable To Attack - InformationWeek
IoT
IoT
Cloud // Software as a Service
News
10/10/2008
06:34 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Gmail, Other Apps, Vulnerable To Attack

Security researchers alert the company to a bug that could let hackers use Google Maps to infiltrate Google, Google Mail, or Google Apps accounts.

Google's online applications are vulnerable to attack, two security researchers claimed Friday.

Google Gmail, for example, is vulnerable to a frame injection attack that could be used to phish login credentials from Google users.

Adrian 'pagvac' Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page -- a fake login page in Pastor's example -- while the user's browser address bar still displays the Google domain. This could dupe the user into entering login details.

"The beauty of frame injection attacks is that the attacker is able to impersonate a trusted entity without needing to bypass XSS/HTML filters or even break into the target server," Pastor explained on the GNUCitizen site.

In a related blog post on Friday, security researcher Aviv Raff explained that Google is vulnerable to "a cross-domain Web-application sharing security design flaw."

The vulnerability reportedly affects other applications beyond Gmail. According to Raff, applications in Google's subdomains -- maps.google.com, images.google.com, news.google.com, mail.google.com, and google.com -- are affected. This means, for example, that Google Maps can be used to hijack Google, Google Mail, or Google Apps accounts.

Raff says he notified Google about the problem shortly after he identified it in April and that Google said the issue was being investigated.

"Today, after not getting any further response from the Google security team about this issue, and after Adrian published his proof-of-concept, I've decided to reveal this information in a hope that this security design flaw will be fixed by Google as soon as possible," said Raff.

In reference to the proof-of-concept, a Google spokesperson said, "We're aware of the potential for this kind of behavior when services are hosted across multiple domains, and we take steps to restrict it where we believe it may have security consequences."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Digital Transformation Myths & Truths
Transformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll