Google Fixes Serious Vulnerability in Gmail

Outsmart Malicious Hackers


Google started the new year by fixing a serious vulnerability in Gmail.

This was quite an interesting case and once again (as everything relating to web apps seems to be nowdays) it was an XSS flaw that allowed malicious attackers to steal your contact list, leading to some pretty bad information leakage.

Google has fixed a vulnerability in its popular GMail web mail service that creates a means for hackers to steal users’ contact lists.

The cross-site scripting flaw stemmed from the decision by GMail to store contact lists in a JavaScript file. GMail always saves contact lists as JavaScript code using the same URL, so a script featuring this URL can read out the fields of a users’ contact list. GMail failed to check what sites were attempting to run this “callback” function.

There was a previous very similar flaw on Google which effected computers with multiple Gmail users.

As a result users logged into GMail, or other Google services sharing the same login, are liable to hand over their contact list to spammers or other miscreants providing they are tricked into visiting a maliciously constructed website. Exploitation would have been as simple as fooling users into visiting a hostile website through spam messages sent to users’ email accounts.

Coders failed to take into account that it was a bad idea to save sensitive data as JavaScript, under predictable URLs, a problem Google watchers spotted shortly after Google made the coding changes last week

I do like Google though, they tend to fix things pretty fast!

Source: The Register

Posted in: Exploits/Vulnerabilities, Web Hacking

, , , , , ,


Latest Posts:


What You Need To Know About KRACK WPA2 Wi-Fi Attack What You Need To Know About KRACK WPA2 Wi-Fi Attack
The Internet has been blowing up in the past week about the KRACK WPA2 attack that is extremely widespread and is a flaw in the Wi-Fi standard itself.
Spaghetti Download - Web Application Security Scanner Spaghetti Download – Web Application Security Scanner
Spaghetti is an Open-source Web Application Security Scanner, it is designed to find various default and insecure files, configurations etc.
Taringa Hack - 27 Million User Records Leaked Taringa Hack – 27 Million User Records Leaked
The Taringa hack is actually one of the biggest leaks of the year with 27 million weakly hashed passwords breached, but it's not often covered in the West.
A2SV - Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed
A2SV is a Python-based SSL Vulnerability focused tool that allows for auto-scanning and detection of the common and well-known SSL Vulnerabilities.
VHostScan - Virtual Host Scanner With Alias & Catch-All Detection VHostScan – Virtual Host Scanner With Alias & Catch-All Detection
VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
Equifax Hack Blamed On Single Employee Equifax Hack Blamed On Single Employee
We wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn't been patched.


Comments are closed.