sjb007

A Gmail exploit which might be abused to allow domain hijacking has reared its ugly head once more.

The reported vulnerability revolves around the potential ability for hackers to create a malicious filter without needing to obtain the login credentials for a Gmail account. A flaw of this type hit web designer David Airey back in December 2007. Security watchers thought that Google had a handle on the problem, but now it seems that this confidence might have been misplaced.

The exploit kicks off by tricking surfers into visiting a maliciously constructed website. This site uses cross-site request forgery trickery to set up a filter on a targeted Gmail account which forwards email to a hacker's account while deleting it from a victim's inbox. The exploit involves stealing a cookie and creating a fake iFrame with a URL containing the variables that instruct Gmail to create a filter, as explained in greater detail here.

The creation of a malicious filter means, for example, that if a Gmail address is used as the contact details for domain registration then black hats can use a domain host's password reset features to hijack an account. The host sends account recovery instructions to a compromised account which forwards these emails to a hacker. Marks are left none the wiser, because the malicious filter means that tell-tale emails are deleted from their account before they get a chance to read them.

Full article here - http://www.theregister.co.uk/2008/11/24/gmail_exploit/