There’s a hole in my Gmail
p2pnet.net News:- "It all started about 3 days ago when MrYowler and I were working on a mailing list script to send out a batch of newsletters for a free hacker-friendly shell service we operate," says a Unix community HBX Networks post. "We made the decision to keep it simple; a Perl script based upon the Net::SMTP CPAN module. Being the Perl guru that MrYowler is (shut up! people will start having expectations of me! ;-P), he had one whipped up in about 20 minutes. In the course of testing the script, we cranked out 10 newsletters to our GMail inboxes. We were a little shocked with that happened next.
"MrYowler opened up his mailbox, and noticed the email had arrived just fine. He clicked on the subject line, and as expected, the message showed correctly. However, when he clicked the ‘Show options’ link, the ‘Reply To’ field in the email header that GMail displayed contained what appeared to be HTML code! Upon further inspection, we realized that it was the message body of another person’s HTML-formatted email message."
Oops.
Google says it’s patched the hole, states Silicon.com. "A source at the company said on Wednesday that Google acknowledged the problem and had fixed it by the end of the day. Since the problem originated in the application on the company’s servers, the fix immediately plugged the leak for all users, the source said."
But as MrYowler and pal point out:
"We did not explore GMail for additional such errors, but based upon the nature of this one, we are confident that such exploration would bear interesting fruit. (Note to GMail’s development teams: we are available for hire! Cheaply! ;-P)
"If you are a regular GMail user – or someone that corresponds with one – you might want to either rethink the privacy of your communications, or perhaps make some noise with the folks at Google’s email service. And don’t forget to tell them that MrYowler and I need jobs… ;-P (Note that we are using a GMail address, so any job offers are probably not going to be well-kept secrets… ;-P)"
===================
See:-
HBX Networks post – GMail Messages are Vulnerable to Interception, HBX Networks, January 12, 2005
patched – Google fixes Gmail flaw, Silicon.com, January 13, 2005
