Gmail Bug Exposes E-mails to Hackers
By Ed Oswald, BetaNews
January 12, 2005, 3:23 PM
UPDATE Google has squashed a bug discovered by UNIX developers HBX Networks within Gmail that allows access to other users' personal e-mails. By altering the "From" address field of an e-mail sent to the service, hackers could potentially find out a user's personal information, including passwords.
Quick to respond, Google acknowledged the problem late Wednesday and has since corrected the problem for all users, a company source said.
HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field. The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.
"Regardless of the specific failure, the result is a compromise of the privacy of communications over Gmail," the organization said. "Usually, this only permits an attacker to examine recently-arrived spam in random user's inboxes - but message content does occasionally become more interesting."
The group urged Gmail users to contact Google and demand the problem be fixed, and warned about using the service for personal communications.






Add a Comment (11 Comments)
BetaNews reserves the right to remove any comment at any time for any reason. Please keep your responses appropriate and on topic. Foul language and personal attacks will not be tolerated.