Gmail flaw allows attackers to steal messages

September 26, 2007 (Computerworld) -- Accounts on Google Inc.'s Gmail can be easily hacked, allowing any past -- and future e-mail messages -- to be forwarded to the attacker's own in-box, a vulnerability researcher said yesterday.

http://www.computerworld.com/action/...=NLT_PM&nlid=8

[blackpearl]

Originally Posted by ankitsagwekar

September 26, 2007 (Computerworld) -- Accounts on Google Inc.'s Gmail can be easily hacked, allowing any past -- and future e-mail messages -- to be forwarded to the attacker's own in-box, a vulnerability researcher said yesterday.

http://www.computerworld.com/action/...=NLT_PM&nlid=8

How?

[gary4gar]

In the example, the attacker writes a filter, which simply looks for e-mails with attachments and forwards them to an e-mail of their choice," Petkov said. "This filter will automatically transfer all e-mails matching the rule

Keep in mind that future e-mails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google," he added.

Google confirmed the vulnerability and said it is working on a fix, but did not give a timetable for patching Gmail, saying only that "we expect [it] to be implemented shortly."

Given in provided link itself

[piyush gupta]

^^Its being fixed by google...
see last comment on same post

also i tried this its fixed by google but people who are already affected have to check for their filters....

[ax3]

oooh ....... many mail providers bt very LESS security .......

[Garbage]

I didn't know, this will be a news !!

I was able to send FUTURE mails from GMail since last year.

Let me tell u the procedure.... (Only thing is that u have to enable POP access to ur GMail account)

Configure your Microsoft Office Outlook with GMail account.
Change ur system date to any future day.
Now, send the mail.

And thats all...

GMail server takes local system date and NOT server date !!

[mahendraraut]

no need to do this also, its a simple telnet concept.

[Garbage]

^^ So, u think, Telnet is easier to use than Microsoft Outlook Express !!