Giant Security leak with google emails

[Weeman]

Facebook would probably just consider this a feature, but the rest of us will definitely consider this a big security hole. The creator of http://guntada.blogspot.com (don’t visit that site just yet) emailed us this morning to explain.

 

If you’re already logged in to any Google account (Gmail, etc.), and visit that site, he’s harvested your Google email. And proves it by emailing you immediately.

 

And it even works in “incognito†mode (also known as porn mode).

 

What is the exploit? We don’t know, and Google has yet to respond to us about it. We note that the site doing the exploiting is on Google’s own blogging platform. One developer we spoke with was confused as well, saying:

 

i have no idea what this is exploiting but there’s a decent chance it has something to do with Friend Connect and the way it passes data between iFrames (ie yes, it very well could be opensocial related). whatever is going on it’s an extremely serious security and privacy violation and i am confident google will address this in moments counted in minutes.

 

i can’t recall ever having seen anything like this on a major IdP’s website. it’s scary stuff.

 

If you insist on trying this yourself (hey, I did), the email to you will likely be in your spam filter.

 

This isn’t a particularly dangerous exploit, but it sure is something a lot of people would love to have on their own sites. The ability to harvest emails from anyone already signed into Google, not to mention just see exactly who’s visiting the site, is extremely valuable. See the second comment thread here for a related issue with App Engine a month ago.

 

Update: The site is now down. Here’s what it looked like:

 

Update 2: Email from Vahe, the man behind this:

 

Hi Mr. Arrington,

I see you have already shared the news. It’s good that google got it down, I really don’t want people to know about how that was done (if Google contacts I will definitely tell them – they just don’t answer my emails). Problem relies solely on Google.

Problem is I asked a lot of people, and most of them don’t really understand and care about this kind of things and big companies act like they all really protect our privacy and such, but they see that people don’t care and don’t do anything really.

 

Regards,

Vahe G. (Armenian 21yrs guy whom Google doesn’t wanted to even talk to)

 

Update 3: From Google: “We take potential security issues very seriously, and our team is actively investigating this one. We’ll share more information soon.†I suggest Google contact Vahe directly, he seems like he’d love to talk to them.

Update 4: Google says the issue is now resolved: “We quickly fixed the issue in the Google Apps Script API that could have allowed for emails to be sent to Gmail users without their permission if they visited a specially designed website while signed into their account. We immediately removed the site that demonstrated this issue, and disabled the functionality soon after. We encourage responsible disclosure of potential application security issues to [email protected].â€Â

 

I think the owner of that blog is gonna get hired at google now lol.

[Jake]

I think the owner of that blog is gonna get hired at google now lol.

 

Or a nice fat check haha

[enigma#]

So it sounds like a XSS issue?? =S

Bye bye, logging into pages with my account =(

[bort]

lol @ google's PR department being like "WE'RE ON THIS!"

 

The whole point of the guy doing this and emailing everyone is b/c he already went to google and they ignored him.