Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/20/2008
06:50 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Security Researcher Defends Plan To Release Gmail Hacking Tool

The software could affect many SSL-secured Web sites, including Amazon, Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks.

Just over a week ago, security researcher Mike Perry presented information at the DEFCON security conference about a vulnerability that affects many SSL-secured Web sites, including Amazon, Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks.

The attack works something like this: As Perry explained at DEFCON, a Gmail user might login to Gmail using the ostensibly secure URL https://mail.google.com. If subsequently surfing CNN.com, for example, via an open wireless connection, an attacker could inject a Gmail image URL and prompt the user's browser to transmit an unprotected Gmail 'GX' cookie in conjunction with the image fetch operation. The attacker could then 'sniff' the unprotected cookie and later use that file to access the victim's Gmail account.

Perry is planning to release a tool that makes HTTPS cookie hijacking easy. And he defends his plan to do so.

Revealing security flaws isn't popular among those that have to patch affected systems. The Massachusetts Bay Transit Authority, for example, recently obtained a temporary gag order -- lifted on Tuesday -- that prevented three MIT students from presenting information about security problems in the transit agency's fare card system.

But Perry maintains making security problems public is necessary.

"Being quiet or not disclosing full details would only promote ignorance and a false sense of security among the general populace, but it still provides full understanding to the adversary, who is considerably more knowledgeable," he explained in a recent blog post. "Remaining silent also gives developers an excuse not to implement what is at the end of the day a very simple fix. I pity them, because I don't like being forced to do work or spend money either, but those are the breaks."

Indeed, tales of foot dragging by companies that have been informed of problems abound in the security industry. For example, Perry says that he told Google about how Gmail was vulnerable last year, nothing happened. He says it was not until he announced that he would be presenting information about the vulnerability and releasing a tool to exploit it that Google took action -- action Perry argues is insufficient -- by offering an option to only connect securely.

Perry's post continues, "I firmly believe that human readable program code very much qualifies as speech, and should be protected at all costs, even if it is exploit code or instruction that causes people in power some inconvenience."

As an assessment of the security industry, InformationWeek has published its 2008 Strategic Security Study, which quizzed nearly 2,000 IT professionals about their plans and priorities for securing their companies' assets. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19594
PUBLISHED: 2019-12-05
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
CVE-2019-19595
PUBLISHED: 2019-12-05
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
CVE-2019-3690
PUBLISHED: 2019-12-05
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.
CVE-2013-0243
PUBLISHED: 2019-12-05
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
CVE-2018-10021
PUBLISHED: 2019-12-05
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate c...