October 1st, 2007

GMail backdoor patched, time to check your filters

Posted by Ryan Naraine @ 9:36 am

Categories: Botnets, Browsers, Data theft, Exploit code, Firefox, Google, Hackers, Mozilla, Open source, Passwords, Patch Watch, Pen testing, Privacy, Responsible disclosure, Spam and Phishing, Spyware and Adware, Viruses and Worms, Vulnerability research, Zero-day attacks

Tags: Google Inc., Google Gmail, E-mail Providers, Internet, Ryan Naraine

Google has confirmed — and I’ve verified — that a fix for GMail has been distributed to block a flaw that allows hackers to hijack e-mail messages.

The cross-site request forgery exploit, discovered and partially disclosed by GNUCitizen’s Petko D. Petkov, gave attackers an easy way to plant GMail filters to forward incoming mail to a third-party (hacker-controlled) e-mail address.

Even after Google’s fix, GMail users are strongly encouraged to check their filter lists because the patch does not remove the rigged filter.

[ SEE: Bullseye on Google: Hackers expose holes in GMail, Blogspot ]

Remember, GMail filters are not the same as labels, which appear on the left pane of the GMail interface.

First, click on Settings in the top-right corner and then the Forwarding and POP tab to ensure that e-mail forwarding is either disabled or not hijacked to send your e-mail elsewhere.

Then, in the Filters tab, look carefully for any strange filter that may compromise your mailbox.