XSS, CSRF grants Gmail passwords

By

Bug fixed.

Google has fixed a security issue in its Gmail password recovery process which could leave users' passwords vulnerable to theft via social engineering.

XSS, CSRF grants Gmail passwords

Researcher Oren Hafif discovered the bug and demonstrated how to exploit it in a video.

Google's security team fixed the issue in 10 days.

By sending a victim a phishing email, designed to look like a password reset email from Google, an attacker could easily lead users to a malicious URL, setting the stage for exploit.

Hafif showed how a cross-site request forgery attack, followed by a cross-site scripting attack, could prompt Google to actually allow users to reset

their passwords under the watchful eyes of a saboteur.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Log In

  |  Forgot your password?