7 ms·

Is Gmail Safe? How do you protect yourself from these kind of attacks?

36 points by arunsharma 18y ago

Do you trust your gmail ? How do you protect yourself from these kind of attacks ?

dc2k08 18y ago
His advice is good and probably worth implementing. one thing though.. > Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration < I thought some WHOIS services offered the ability to view cached pages of all previous contact details, no ?
- josefresco 18y ago
  Yeah, I read that the other day ... blanking on the site/url but I remember it being possible. I guess you're screwed either way.
- tortilla 18y ago
  Yeah, for a fee, you can find historical registration info and other goodies: http://www.domaintools.com/ http://www.domaintools.com/
rksprst 18y ago
Can one of the google employees here ask one of their gmail buddies about this?
syntax-case 18y ago
I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else. http://support.mozilla.com/en-US/kb/Managing+profiles http://support.mozilla.com/en-US/kb/Managing+profiles
- technoguyrob 18y ago
  And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem. EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page: <script>var SECURITY_KEY = "918028cd79a5ba47e83e6ba68d036ca3";</script> And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail. Really, this doesn't seem like a very hard problem to solve...couple lines of code...
  - kwamenum86 18y ago
    Is this solution scalable though? Are you saying that they should store this key on the server side for each instance of gmail and then check every single AJAX request to see if the key is present?
    - immad 18y ago
      That doesn't sound unscalable. It's pretty linear scaling, they already store information per logged in user anyway.
      - kwamenum86 18y ago
        They store information per logged in user but are they performing some type of lookup information for every single AJAX request? I opened up a chat box and 7 HTTP requests fired off. I have no clue what these are for, but are each one of those validated and could they be quickly? During typical gmail usage several requests are fired off in the background for simple and seemingly trivial user actions like the one mentioned above. EDIT: ...and after I was done typing the message above I returned to gmail and 15+ more requests has been fired off without me doing anything. The message took well under a minute to type. Seems like a lot of validation would have to be done.
- pasbesoin 18y ago
  Could this be done by running e.g. a portable instance of Firefox alongside a regular install? I read that a while back some people were doing this to use/test Firefox 2 and 3 concurrently, but I never gave it a try. Currently, I keep a clean Opera installation solely for high-importance secure transactions, but I like some of the features that (I know, I have to trust them) Firefox extensions add to Gmail. I also don't want to be running Gmail through that clean Opera installation; I want to restrict my use of the latter to access to known sites and trusted content.
arunsharma 18y ago
http://blogs.zdnet.com/security/?p=554 http://blogs.zdnet.com/security/?p=554 It looks like the gmail team has created a fix and pushed the fix. It suggests that you keep checking your filters to see if you been rigged as the fix wouldn't fix it (pun intended).
- m0nty 18y ago
  That's from a year ago. I think TFA is speculating about the same kind of vulnerability, but active now. It is just speculation, though.
- kwamenum86 18y ago
  I would be curious to know how they fixed it in the first place.
ramchip 18y ago
"...including 2 malware monitors, an antivirus and 2 firewalls" In case the attack is too strong for the first firewall?
- arunsharma 18y ago
  :D 2 firewall wouldn't help at all. Use one - the best one .
bedarkened 18y ago
Seems like the simple solution would be for Google to require authentication/SSL to create a filter.

36 points by arunsharma 18y ago

Do you trust your gmail ? How do you protect yourself from these kind of attacks ?

His advice is good and probably worth implementing. one thing though.. > Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration < I thought some WHOIS services offered the ability to view cached pages of all previous contact details, no ?

josefresco 18y ago
Yeah, I read that the other day ... blanking on the site/url but I remember it being possible. I guess you're screwed either way.
tortilla 18y ago
Yeah, for a fee, you can find historical registration info and other goodies: http://www.domaintools.com/ http://www.domaintools.com/

rksprst 18y ago

Can one of the google employees here ask one of their gmail buddies about this?

syntax-case 18y ago

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else. http://support.mozilla.com/en-US/kb/Managing+profiles http://support.mozilla.com/en-US/kb/Managing+profiles

technoguyrob 18y ago
And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem. EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page: <script>var SECURITY_KEY = "918028cd79a5ba47e83e6ba68d036ca3";</script> And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail. Really, this doesn't seem like a very hard problem to solve...couple lines of code...
- kwamenum86 18y ago
  Is this solution scalable though? Are you saying that they should store this key on the server side for each instance of gmail and then check every single AJAX request to see if the key is present?
  - immad 18y ago
    That doesn't sound unscalable. It's pretty linear scaling, they already store information per logged in user anyway.
    - kwamenum86 18y ago
      They store information per logged in user but are they performing some type of lookup information for every single AJAX request? I opened up a chat box and 7 HTTP requests fired off. I have no clue what these are for, but are each one of those validated and could they be quickly? During typical gmail usage several requests are fired off in the background for simple and seemingly trivial user actions like the one mentioned above. EDIT: ...and after I was done typing the message above I returned to gmail and 15+ more requests has been fired off without me doing anything. The message took well under a minute to type. Seems like a lot of validation would have to be done.
pasbesoin 18y ago
Could this be done by running e.g. a portable instance of Firefox alongside a regular install? I read that a while back some people were doing this to use/test Firefox 2 and 3 concurrently, but I never gave it a try. Currently, I keep a clean Opera installation solely for high-importance secure transactions, but I like some of the features that (I know, I have to trust them) Firefox extensions add to Gmail. I also don't want to be running Gmail through that clean Opera installation; I want to restrict my use of the latter to access to known sites and trusted content.

arunsharma 18y ago

http://blogs.zdnet.com/security/?p=554 http://blogs.zdnet.com/security/?p=554 It looks like the gmail team has created a fix and pushed the fix. It suggests that you keep checking your filters to see if you been rigged as the fix wouldn't fix it (pun intended).

m0nty 18y ago
That's from a year ago. I think TFA is speculating about the same kind of vulnerability, but active now. It is just speculation, though.
kwamenum86 18y ago
I would be curious to know how they fixed it in the first place.

ramchip 18y ago

"...including 2 malware monitors, an antivirus and 2 firewalls" In case the attack is too strong for the first firewall?

arunsharma 18y ago
:D 2 firewall wouldn't help at all. Use one - the best one .

bedarkened 18y ago

Seems like the simple solution would be for Google to require authentication/SSL to create a filter.