How you can get hacked if you are using iPad/Safari/gmail

#1

Post by bevenky » Mon, Jul 30, 2012, 10:11 PM UTC

How you can get hacked if you are using iPad/Safari/gmail
blog.secpanel.com

Re: How you can get hacked if you are using iPad/Safari/gmail

#2

Post by alagu » Mon, Jul 30, 2012, 10:19 PM UTC

I guess all this article is trying to say is to use https://google.com/ in iPad. Is there anything else I'm missing here?

Re: How you can get hacked if you are using iPad/Safari/gmail

#3

Post by rudhir-secpanel » Mon, Jul 30, 2012, 10:23 PM UTC

alagu wrote: post #2

I guess all this article is trying to say is to use https://google.com/ in iPad. Is there anything else I'm missing here?

The google search tab on the right top in Safari/iPad is what a user tends to search in, instead of opening up a new browser tab. This opens up http://google.com, which is the issue.

Re: How you can get hacked if you are using iPad/Safari/gmail

#4

Post by Sidnicious » Mon, Jul 30, 2012, 10:29 PM UTC

Can the session information sent to non-secure Google sites be used on Gmail?

Re: How you can get hacked if you are using iPad/Safari/gmail

#5

Post by rudhir-secpanel » Mon, Jul 30, 2012, 10:38 PM UTC

Sidnicious wrote: post #4

Can the session information sent to non-secure Google sites be used on Gmail?

Yes. When one is logged in as a gmail user, any google search is done as that user. Therefore the requests will carry session information just as if one were using gmail with http.

Re: How you can get hacked if you are using iPad/Safari/gmail

#6

Post by Splines » Mon, Jul 30, 2012, 10:41 PM UTC

rudhir-secpanel wrote: post #3

alagu wrote: post #2

I guess all this article is trying to say is to use https://google.com/ in iPad. Is there anything else I'm missing here?

The google search tab on the right top in Safari/iPad is what a user tends to search in, instead of opening up a new browser tab. This opens up http://google.com , which is the issue.

Is that the workaround? After viewing google on https, close the tab and start a new one for searching?

Or should I always avoid http://google.com while logged into a google property on untrusted networks?

Re: How you can get hacked if you are using iPad/Safari/gmail

#7

Post by catch23 » Mon, Jul 30, 2012, 10:48 PM UTC

does safari leak ssl-only cookies?

Re: How you can get hacked if you are using iPad/Safari/gmail

#8

Post by munin » Mon, Jul 30, 2012, 10:49 PM UTC

a better option: use the iOS mail app (with imaps), and use application-specific passwords. don't log in to your app account from safari. you then get two benefits:

1. session cookie hijacking not possible

2. the iOS mail app supports encrypted email

Re: How you can get hacked if you are using iPad/Safari/gmail

#9

Post by philiphodgen » Mon, Jul 30, 2012, 10:49 PM UTC

I wonder (he said, sitting in the Minneapolis airport with an iPhone in hand) whether Safari exhibits the same flaw on an iPhone?

Re: How you can get hacked if you are using iPad/Safari/gmail

#10

Post by eridius » Mon, Jul 30, 2012, 10:50 PM UTC

As long as gmail uses Secure cookies, then this article is completely wrong. I just checked my own cookie storage and about half of the cookies for mail.google.com are marked as Secure, but I don't know which ones are required to identify your session.