Security hole found in Gmail

[cloasters]

According to: http://net.nana.co.il/Article/?ArticleID=155025&sid=10 a major security flaw allows full access to a user's account.

[robbie]

Good thing I don't really use mine all that much then eh?
Rob

[danrok]

Just got one a few fays back, thanks to Mooky.

I find it is very good for notifications from AOA, because it automatically threads messages.

Still use my other account for more secure stuff. This is hosted by a small local company, so I feel it is more secure and I can contact the provider easily if needed.

Gmail is still beta, so it is still in its test phase.

[Aedan]

Er, how come they're picking on Gmail? The idea that stealing a cookie from someone's system and knowing their username is hardly a new one. Many webmail systems will happily allow you in if you have a valid session cookie. I know from personal testing that a number of other webmail systems simply require you to present a valid cookie to log you in.

In terms of being able to obtain the cookie, it's usually easiest to use a flaw in a browser to obtain such information. Cross site scripting is also a good attack to use to obtain such information.

[chrisbard]

Can you explain that in detail ?

[Aedan]

The Gmail attack is reliant on cross site scripting. Cross site scripting is where another site effectively "injects" some HTML code into the page you want to view. The code that is injected is commonly used to steal the session cookie. Session cookies are the reference that the web servers use to keep track of you!

That said, I've never actually heard of someone sucessfully using a cross site scripting attack against a user except in a lab environment.