G-Archiver Harvesting Google Mail Passwords

Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."

This is why I backup my Gmail with G-Archiver

Oh, wait...

Re:This is why I backup my Gmail with G-Archiver

Or simply use IMAP to archive your gmail account...

Re:This is why I backup my Gmail with G-Archiver

You still have to trust the IMAP client to not be logging your passwords. It all comes down to whether or not you trust where the software came from. Luckily for open source projects there's an easy audit trail (so long as you compile from that source - a premade binary distributed with source could still contain malicious code simply not included in the provided source). For closed source software you're stuck trying arcane trickery like this guy did in order to find out when a program is spying on you.

Re:This is why I backup my Gmail with G-Archiver

For closed source software you're stuck trying arcane trickery like this guy did in order to find out when a program is spying on you.

The upshot of this case is that the app in question was written with .Net which is fairly easy to decompile [aisto.com]. If he had chosen C++, there's a good chance no one would have bothered to pore over the assembly and find this out.

Debug, Sure

"The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in [CC] the product."

Right. And I have a bridge I'd like to sell you too.

Re:Debug, Sure

I did something similar I once picked up the wrong keys yet when I went to take them back to the person I decided to let myself in and accidentally walked out with a new TV.

Re:Debug, Sure

Right. And I have a bridge I'd like to sell you too.

Why do you feel the need to hurt the reputation and business of us legitimate bridge sellers?!?

That doesn't make sense.

If you're debugging, you already have the account details. What possible reason could you have to email them to yourself?

Hmmm

he deleted the emails

But did he make a backup first?

DMCA

If this was a big company, they would have denied it and gone after him under the DMCA. At least the admitted to something and pulled to product.

Even the courts aren't this daft

You don't have to work in IT to know that there is no reason for G-Archiver to send the password to anyone but Google. This guy deserves to be prosecuted under anti-hacking statutes.

Re:Even the courts aren't this daft

It only did send them to Gmail :)

Re:Even the courts aren't this daft

This guy deserves to be prosecuted under anti-hacking statutes.

Exactly. I mean, he was using a debugger! Doesn't he know that violates the DMCA? No doubt he'll be hearing from the G-Archiver lawyers AND the DoJ soon. It's time to show this clown that, in America, we don't put up with these kinds of shenanigans. And somebody call the copyright lobby. This is exactly the story they've been looking for to justify increasing the penalties for violating copyright to capital punishment.

Re:Even the courts aren't this daft

I actually found a few links that should be useful in cases like this:

• FBI NATIONAL COMPUTER CRIME SQUAD [emergency.com] (May be outdated)
• FBI Tampa Cyber Crime squad [fbi.gov] (you may have your own local version of this)
• Internet Crime Complaint Center (IC3) [ic3.gov]
• CERT [cert.org]
• Forum for Incident Response and Security Teams [first.org]
• Swedish IT incident Center [sitic.se] (sitic at pts dot se)

Of course you may have your own national version of IT incident reporting.

So if we really want to avoid having the police hunt us for petty crimes of downloading files - give them something real. :-)

Nice move, but illegal?

Good intentions and all, but I'm sure Mr. Brooks just opened himself up to "hacking" charges.

Re:Nice move, but illegal?

Possibly by some ridiculous interpretation of the law, Mr. Books was "hacking." However, he purchased the rights to use G-Archiver, and he did not recompile the program in a different way and label it his own. He used information that the program (to which he has the rights to use, unless otherwise stated in some bullsheet EULA) used, found out that this program acted like a Trojan virus and submitted private information to an individual's e-mail account, and subsequently removed his information and disallowed any new information to be read.

Granted, he probably shouldn't have deleted everything and changed the password (morally: yes, legally: no), so it's likely he may face charges because of this. That's our legal system, folks.

Caught

Looks like someone got caught with their pants down in the cookie jar. That's not nearly as hot as it sounds.

Never ascribe to malice

what can be explained by incompetance?

Although in this case, that's some serious incompetance going on!

Don't give out passwords

And this, children, is why you should never ever give the password to your account to someone else. Not even someone who claims to want to do something for you. Once you've given it to them, you have no control over what they do with it.

Just wondering...

So why did the binary program also have the password for the gmail account? One would assume that the email address would have been enough. After all, sending someone email doesn't require their password.

Re:Just wondering...

GMail requires you to authenticate with their SMTP servers to send mail. His choices were to include the account password, implement his own SMTP server and build it into the program, or use an open SMTP server. That last will often get your mail dropped as spam. The second one would have been better-secured, but the guy was obviously dumb enough to include a phishing function in a backup program, so it's obvious why he went with option number one.

Doesn't look malicious to me

Maybe I'm getting old, but this seems like a pretty clear case of "oh crap, I'm an idiot", rather than "mwuahahah, my plan for global domination proceeds apace!". According to the posting on codinghorror, the guy who found the issue (Dustin Brooks) found that the creator, John Terry, of the G-Archiver software had left his own email information in the code. Yes, the G-archiver forwarded a record of the account information of everyone who used the app to that mailbox, but if you look at the screenshot, none of those emails has been flagged as read by gmail (but maybe that's an artifact of a POP connection?).

Either way, this just smacks to me of a novice developer doing something incredibly dumb, rather than incredibly malicious. If he actually wanted to just collect other people's account information, why leave his own in the source code? He could have just as easily forwarded the information to an anonymized email account, or simply an account for which the login information was not present in source.

Just my opinion, I reserve the right to be wrong.

Deleted the emails

From the Information Week article:

Brooks said he then deleted the presumably stolen account information, changed the password on the account, and notified Google.
[...]
Google's statement continues. "We are investigating this incident, the underlying activities of which violate Gmail Program Policies. We have suspended the suspect account, and are in the process of notifying the owners of those accounts whose passwords may have been compromised. It's unfortunate that fraudsters continue to use email for these purposes. We have phishing detection capabilities built into Gmail, so we were able to act quickly to limit the impact of this particular attack."

I have never read Google's Privacy Policy but am slightly concerned that they appear to be able to access emails after their deletion.

Re:Trust me, trust me not.

I don't believe that for a moment.

This seems to be a clear case of privacy invasion and unauthorized access to private data. And I think that this should have been brought to the attention of the police for further investigation.

In this case the guilty will have time to cover his tracks and hide.

Try this approach the next time you see something as grave as this. The worst thing that can happen if you report it is that the case gets dismissed.

Re:A-ha!

Yeah, I was logged into your account and noticed that too....very strange!