Gmail Hacked

[thoreau]

For those of you that use Gmail - be careful.

The victim visits a page while being logged into GMail. Upon execution, the page performs a multipart/form-data POST to one of the GMail interfaces and injects a filter into the victim’s filter list. In the example above, the attacker writes a filter, which simply looks for emails with attachments and forwards them to an email of their choice. This filter will automatically transfer all emails matching the rule. Keep in mind that future emails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google.

WARNING: Google’s GMail security failure leaves my business sabotaged :: David Airey :: Graphic and Logo Designer

Read the post at the above website. Incredible stuff.

[ReadBird]

You might want to change the link to http://davidairey.co.uk/google-gmail-security-hijack/

[AlphaGeek]

..and the moral of the story is:

David Airey should have never entrusted his business email to a free web based service, and neither should you.

AG

[jjmatrix]

Absolutely!!! You want good security? For free??
It's not going to happen.

[mrproper]

Originally Posted by jjmatrix

Absolutely!!! You want good security? For free??
It's not going to happen.

Actually, it's: SECURITY, ACCESSIBILITY, CHEAPNESS. Pick two!