Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

New Google bugs empower phishermen

by Marianna Schmudlach Oct 10, 2008 5:58AM PDT

Domain vuln + frame injection = dead ringer spoof pages

By Dan Goodin in San Francisco ? Get more from this author

Posted in Security, 10th October 2008

Google's Gmail service suffers from security flaws that make it trivial for attackers to create authentic-looking spoof pages that steal users' login credentials, a security expert has demonstrated. Google Calendar and other sensitive Google services are susceptible to similar tampering.

A proof-of-concept (PoC) attack, published by Adrian Pastor of the GNUCitizen ethical hacking collective, exploits a weakness in the google.com domain that allows him to inject third-party content into Google pages. The result is this page, which allowed him (at time of writing, anyway) to display a fraudulent Gmail login page that displayed mail.google.com in the browser's address bar.

More: http://www.theregister.co.uk/2008/10/10/google_cross_domain_bug/

Discussion is locked