Security Researcher Defends Plan To Release Gmail Hacking Tool

The software could affect many SSL-secured Web sites, including Amazon, Facebook, Gmail,, most Drupal sites, and many online merchants and banks.

Thomas Claburn, Editor at Large, Enterprise Mobility

August 20, 2008

2 Min Read

Just over a week ago, security researcher Mike Perry presented information at the DEFCON security conference about a vulnerability that affects many SSL-secured Web sites, including Amazon, Facebook, Gmail,, most Drupal sites, and many online merchants and banks.

The attack works something like this: As Perry explained at DEFCON, a Gmail user might login to Gmail using the ostensibly secure URL If subsequently surfing, for example, via an open wireless connection, an attacker could inject a Gmail image URL and prompt the user's browser to transmit an unprotected Gmail 'GX' cookie in conjunction with the image fetch operation. The attacker could then 'sniff' the unprotected cookie and later use that file to access the victim's Gmail account.

Perry is planning to release a tool that makes HTTPS cookie hijacking easy. And he defends his plan to do so.

Revealing security flaws isn't popular among those that have to patch affected systems. The Massachusetts Bay Transit Authority, for example, recently obtained a temporary gag order -- lifted on Tuesday -- that prevented three MIT students from presenting information about security problems in the transit agency's fare card system.

But Perry maintains making security problems public is necessary.

"Being quiet or not disclosing full details would only promote ignorance and a false sense of security among the general populace, but it still provides full understanding to the adversary, who is considerably more knowledgeable," he explained in a recent blog post. "Remaining silent also gives developers an excuse not to implement what is at the end of the day a very simple fix. I pity them, because I don't like being forced to do work or spend money either, but those are the breaks."

Indeed, tales of foot dragging by companies that have been informed of problems abound in the security industry. For example, Perry says that he told Google about how Gmail was vulnerable last year, nothing happened. He says it was not until he announced that he would be presenting information about the vulnerability and releasing a tool to exploit it that Google took action -- action Perry argues is insufficient -- by offering an option to only connect securely.

Perry's post continues, "I firmly believe that human readable program code very much qualifies as speech, and should be protected at all costs, even if it is exploit code or instruction that causes people in power some inconvenience."

As an assessment of the security industry, InformationWeek has published its 2008 Strategic Security Study, which quizzed nearly 2,000 IT professionals about their plans and priorities for securing their companies' assets. Download the report here (registration required).

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights