Feeds

Google plugs brace of GMail security flaws

Trouble comes in pairs

  • alert
  • submit to reddit

SANS - Survey on application security programs

Google fixed a brace of security holes to its web-based services last week. Each posed a serious risk for users of its popular GMail service.

A flaw in Froogle, Google's price-comparison service, created a means for attackers to swipe cookies used to access GMail accounts. Israeli hacker Nir Goldshlager demonstrated how users fooled into executing script by clicking a link pointed at Froogle could be redirected to a site that steals usernames and passwords for the "Google Accounts" centralised log-in service. Google has fixed the vulnerability, preventing further theft. But Goldshlager warns that data from already stolen cookies can still be used even if the password of compromised accounts is changed.

"The system authenticates the hacker as the victim, using the stolen cookie file. Thus no password is involved in the authentication process. The victim can change his password as many times as he wants, and it still won't stop the hacker from using his box," Goldshlager said, eWeek reports.

Last week Google fixed a separate bug in its GMail email service that allowed attackers to snoop on users' email or obtain passwords. The security flaw was uncovered by Unix community group HBX Networks in developing code to send batches of newsletters.

Email sent using this PERL code accidentally malformed the 'From' field in such a way as to confuse GMail's systems into embeding portions of someone else's HTML message in test emails. Some of these leaked messages contained GMail usernames and passwords; so it's just as well that Google acted quickly to plug the security hole to its popular service (still officially undergoing beta testing). Google fixed the bug by adopting its service to reject the type of malformed message demonstrated by HBX Networks. ®

Related stories

Gmail accounts 'wide open to exploit' - report
Google finally fixes Desktop security vuln
Google Desktop privacy branded 'unacceptable'
Google's Gmail: spook heaven?

SANS - Survey on application security programs

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.