Google working to patch Gmail message-forwarding flaw

Powered by SC Magazine
 

A flaw in Gmail can allow an attacker to forward all messages with attachments to another email address.

An attacker must force a potential victim, logged into their Gmail account, to visit a malicious page that injects a filter into the victim's filter list, according to researcher Petko Petkov of Gnucitizen. The filter sends emails with attachments to an address of the attacker's choice.

Classifying exploitation a cross-site request forgery, Petkov warned that even if Google releases a fix for the flaw, messages would still be forwarded to the third-party address because the filter is still present.

Petkov on Tuesday urged other researchers not to disclose details of the flaw until Google fixes it, saying the vulnerability is “extremely nasty if you ask me” on the Gnucitizen blog.

“If you find this vulnerability, please do not disclose it. Let Google fix it first and then blog about it,” he said. “In an age where all the data is in the cloud, it makes no sense for the attackers to go after your box. It is a lot simpler to install one of these persistent backdoor/spyware filters. Game over! They don't own your box, but they have you, which is a lot better.”

Petkov told SCMagazineUS.com today that Google replied to him, saying that they have “confirmed the vulnerability and now they are looking for ways to fix it.”

Google today released a statement saying that the company would issue a fix shortly.

“Google takes the security of our users' information very seriously, and we are working on a fix to the recently reported vulnerability, which we expect to be implemented shortly,” the Mountain View, Calif.-based search giant said in a statement.

Petkov this month also discovered a flaw in QuickTime and Firefox, and a vulnerability in Adobe Reader – both fixed by vendors last week.

See original article on SC Magazine US

Copyright © SC Magazine, US edition


Google working to patch Gmail message-forwarding flaw
 
 
 
Top Stories
Westpac committed to core banking plan
[Blog post] Now with leadership.
 
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1143

Vote