Gmail Account Hijacking Vulnerability
blog.securityfuse.com
Gmail Account Hijacking Vulnerability
1–10 of 25 posts
Re: Gmail Account Hijacking Vulnerability
#2It is sad that the researcher didn't get paid anything, and that many other 'minor' reporters don't get paid anything either.
Presumably the researcher expended a lot of effort probing gmail and was that time not worth a paltry reward?
vulnerabilities should be better rewarded.
Re: Gmail Account Hijacking Vulnerability
#3It is sad that the researcher didn't get paid anything, and that many other 'minor' reporters don't get paid anything either. Presumably the researcher expended a lot of effort probing gmail and was that time not worth a paltry reward? vulnerabilities should be better rewarded.
I am 100% in support of bug bounty programs and the like but I can completely understand why they didn't pay for this one.
Re: Gmail Account Hijacking Vulnerability
#4It is sad that the researcher didn't get paid anything, and that many other 'minor' reporters don't get paid anything either. Presumably the researcher expended a lot of effort probing gmail and was that time not worth a paltry reward? vulnerabilities should be better rewarded.
I am 100% in support of bug bounty programs and the like but I can completely understand why they didn't pay for this one.
Can you elaborate?
Re: Gmail Account Hijacking Vulnerability
#5How is this a vulnerability?
1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they always contain a correct envelope-from header, so the emails will typically show up as 'Google (sent by: SuperHacker@gmail.com)', or something along those lines.
2) gmail.com doesn't have a forced-fail SPF record, so one could just send emails From: google@gmail.com using /any/ mail server, as long as the receiving mail server doesn't interpret softfail as fail -- and it shouldn't.
Re: Gmail Account Hijacking Vulnerability
#6There is no account hijacking vulnerability here. The researcher was able to send email as a non-existed Gmail account, they could have just as easily registered that Gmail account. The only place this becomes a vulnerability is if the account doesn't exists and you aren't allowed to register it (like google@gmail.com), or if there is a temporary bounce from a legitimate account.
Either way, it isn't a hijack, you can just send email from the "hijacked" account through Google's servers, you can't receive email sent to the account.
Re: Gmail Account Hijacking Vulnerability
#7There is no account hijacking vulnerability here. The researcher was able to send email as a non-existed Gmail account, they could have just as easily registered that Gmail account. The only place this becomes a vulnerability is if the account doesn't exists and you aren't allowed to register it (like google@gmail.com), or if there is a temporary bounce from a legitimate account. Either way, it isn't a hijack, you ca…
As mentioned in the article, you can hijack accounts if the recipient has blocked you.
Re: Gmail Account Hijacking Vulnerability
#8Re: Gmail Account Hijacking Vulnerability
#9There is no account hijacking vulnerability here. The researcher was able to send email as a non-existed Gmail account, they could have just as easily registered that Gmail account. The only place this becomes a vulnerability is if the account doesn't exists and you aren't allowed to register it (like google@gmail.com), or if there is a temporary bounce from a legitimate account. Either way, it isn't a hijack, you ca…
As mentioned in the article, you can hijack accounts if the recipient has blocked you.
It still isn't a hijack, it only allows you to send email as that user through Google's servers. It is always possible to send email as anyone you want, just change the From address in your mail client [1]. Google attempts to prevent unauthenticated From addresses going through their servers. So it is a vulnerability because it bypasses intended restrictions (in some edge cases), it just isn't a hijack as the post's title says.
[1] Yes, you have SPF and DMARC to contend with.