Feeds

Google plugs brace of GMail security flaws

Trouble comes in pairs

  • alert
  • submit to reddit

Intelligent flash storage arrays

Google fixed a brace of security holes to its web-based services last week. Each posed a serious risk for users of its popular GMail service.

A flaw in Froogle, Google's price-comparison service, created a means for attackers to swipe cookies used to access GMail accounts. Israeli hacker Nir Goldshlager demonstrated how users fooled into executing script by clicking a link pointed at Froogle could be redirected to a site that steals usernames and passwords for the "Google Accounts" centralised log-in service. Google has fixed the vulnerability, preventing further theft. But Goldshlager warns that data from already stolen cookies can still be used even if the password of compromised accounts is changed.

"The system authenticates the hacker as the victim, using the stolen cookie file. Thus no password is involved in the authentication process. The victim can change his password as many times as he wants, and it still won't stop the hacker from using his box," Goldshlager said, eWeek reports.

Last week Google fixed a separate bug in its GMail email service that allowed attackers to snoop on users' email or obtain passwords. The security flaw was uncovered by Unix community group HBX Networks in developing code to send batches of newsletters.

Email sent using this PERL code accidentally malformed the 'From' field in such a way as to confuse GMail's systems into embeding portions of someone else's HTML message in test emails. Some of these leaked messages contained GMail usernames and passwords; so it's just as well that Google acted quickly to plug the security hole to its popular service (still officially undergoing beta testing). Google fixed the bug by adopting its service to reject the type of malformed message demonstrated by HBX Networks. ®

Related stories

Gmail accounts 'wide open to exploit' - report
Google finally fixes Desktop security vuln
Google Desktop privacy branded 'unacceptable'
Google's Gmail: spook heaven?

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.