Gmail, Outlook.com and e-voting 'pwned' on stage in crypto-dodge hack

Once you enter, you can never leave logout

Combat fraud and increase customer satisfaction

Black Hat 2013 Security researchers say they have developed an interesting trick to take over Gmail and Outlook.com email accounts - by shooting down victims' logout requests even over a supposedly encrypted connection.

And their classic man-in-the-middle attack could be used to compromise electronic ballot boxes to rig elections, we're told.

Ben Smyth and Alfredo Pironti of the French National Institute for Research in Computer Science and Control (INRIA) announced they found a way to exploit flaws in Google and Microsoft's web email services using an issue in the TLS (Transport Layer Security) technology, which encrypts and secures website connections.

Full details of the attack are yet to be widely disseminated - but it was outlined for the first time in a demonstration at this year's Black Hat hacking convention in Las Vegas on Wednesday.

In short, we're told, it uses a TLS truncation attack on a shared computer to block victims' account logout requests so that they unknowingly remain logged in: when the request to sign out is sent, the attacker injects an unencrypted TCP FIN message to close the connection. The server-side therefore doesn't get the request and is unaware of the abnormal termination.

The pair explained:

In essence, we block encrypted messages that are sent over the network to de-synchronize authorisation: we force Gmail and Hotmail [Outlook.com] to display on your browser the page that announces that you have successfully signed-out, whilst ensuring that your browser maintains authorisation with Gmail and Hotmail [Outlook.com].

Given such an announcement, you should be assured that you are secure, in particular, a hacker should not be able to access your email, even if you [log out and] leave your computer unattended. However, we can violate this basic security premise and access your Gmail and Hotmail [Outlook.com] accounts just by reloading the web page.

The attack does not rely on installing malware or similar shenanigans: the miscreant pulling off the trick must simply put herself between the victim and the network. That could be achieved, for example, by setting up a naughty wireless hotspot, or plugging a hacker-controlled router or other little box between the PC and the network.

The researchers warned that shared machines – even un-compromised computers – cannot guarantee secure access to systems operated by Helios (an electronic voting system), Microsoft (including Account, Hotmail, and MSN), nor Google (including Gmail, YouTube, and Search).

"This blocking can be accomplished by a so-called 'man in the middle'," Pironti told El Reg.

"Technically, whatever piece of hardware is relaying data between you and Google could decide to stop relaying at some point, and do the [logout] blocking.

"In practice, this is very easy to do: with wireless networks (e.g. setting up a rogue access point) or with wired networks (e.g. by adding a router between your cable and the wall plug - alternatively this could be done with custom-built hardware, which could be very small)."

Block and tackle

Several attacks might be possible as a result of the vulnerability, according to Pironti.

"In the context of voting, a single malicious poll station worker could do the attack, voting at his pleasure for any voter. He sets up his man-in-the-middle, then waits for a designated victim to enter the voting booth. The man-in-the-middle device blocks the relevant messages. Then the malicious worker enters the voting booth (e.g. with the excuse to check that the machine is operational) and votes on the victim's behalf."

Webmail attacks on shared computers in settings such as libraries are also possible. An attacker simply needs to access a computer after a mark incorrectly believes she has signed out.

Unbeknown to the user, the hacker's hardware will have blocked the relevant messages, yet the user must be shown what appears to be a "you've signed out" page - the core element of the con. After that, it's easy for an adversary to use the computer to access the user's email.

"We believe this [problem] is due to a poor understanding of the security guarantees that can be derived from TLS and the absence of robust web application design guidelines. In publishing our results, we hope to raise awareness of these issues before more advanced exploits, based upon our attack vector, are developed," the researchers concluded.

The attack developed by INRIA is apparently possible thanks to a de-synchronisation between the user’s and server’s perspective of the application state: the user receives feedback that her sign-out request has been successfully executed, whereas, the server is unaware of the user’s request.

"It follows intuitively that our attack vector could be exploited in other client-server state transitions," Smyth and Pironti explained.

Mitigating the attack could be achieved by reliably notifying the user of server-side state changes. "Unfortunately, the HTTP protocol is unsuited to this kind of notification", we're told, so the researchers advocate the use of technologies such as the SPDY networking protocol and AJAX (asynchronous JavaScript and XML, a web development framework).

The two researchers shared their findings with Google and Microsoft; the web advertising giant acknowledged the discovery in its application security hall of fame.

Smyth and Pironti's presentation of their research was titled Truncating TLS connections to violate beliefs in web applications. The researchers were seemingly able to exploit the Helios electronic voting system to cast ballots on behalf of voters, take full control of Microsoft Live accounts, and gain temporary access to Google accounts.

Subtle reasons make Microsoft's webmail service more exposed than its Google equivalent, Pironti explained.

"Google happens to be less exposed for two reasons," Pironti told El Reg. "First, our attack relies on a de-synchronisation at the server side: it happens that Google ensures synchronisation every five minutes, which makes our attack [only] work within this five minutes window. Second, Microsoft allows you to change your password without re-typing the old one, so once we access the user account, we can change its password and get full control."

Pironti said the research didn't look at other popular webmail systems, such as Yahoo!'s, so he can't say for sure whether they are vulnerable or not.

"We suspect many other services are broken, but we didn't look into details," he said. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
BOFH: Oh DO tell us what you think. *CLICK*
$%%&amp Oh dear, we've been cut *CLICK* Well hello *CLICK* You're breaking up...
AMD's 'Seattle' 64-bit ARM server chips now sampling, set to launch in late 2014
But they won't appear in SeaMicro Fabric Compute Systems anytime soon
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
prev story


Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.