Gmail Accounts Vulnerable to XSS Exploit

Become a fan of Slashdot on Facebook

Gmail Accounts Vulnerable to XSS Exploit 232

Posted by michael on Friday October 29, 2004 @05:27PM from the ooooooops dept.

mallumax writes "A security hole in GMail has been found (an XSS vulnerability) which allows access to user accounts without authentication. What makes the exploit worse is the fact that changing passwords doesn't help. The full details of the exploit haven't been disclosed. The vulnerability was reported by Israeli news site Nana. They were tipped off by an Israeli hacker. Google has been notified and they are working to close the hole. The Register has the story here."

This discussion has been archived. No new comments can be posted.

Gmail Accounts Vulnerable to XSS Exploit

Search 232 Comments Log In/Create an Account

Comments Filter:

Oh no! (Score:5, Funny)

by scaaven ( 783465 ) writes: on Friday October 29, 2004 @05:28PM (#10667702)

My google stock. My poor google stock!

Share
twitter facebook
Oh my god! (Score:5, Funny)

by Zangief ( 461457 ) writes: on Friday October 29, 2004 @05:29PM (#10667715) Homepage Journal

Maybe some hacker will make a program to break into every gmail account, read their mail, and send them ads about what people are talking about in mails!!!

Share
twitter facebook
sweet grapes (Score:5, Funny)

by yahyamf ( 751776 ) * writes: on Friday October 29, 2004 @05:32PM (#10667744)

I waited so long to get a Gmail account, I don't care if it sucks now... I also like Doom3...

Share
twitter facebook
Re:Isn't it... (Score:5, Funny)

by moonbender ( 547943 ) writes: <moonbenderNO@SPAMgmail.com> on Friday October 29, 2004 @05:33PM (#10667755)

I guess they weren't kidding when they said it's still in beta...

Parent Share
twitter facebook
I must do my part to help. (Score:5, Funny)

by teamhasnoi ( 554944 ) writes: <teamhasnoi AT yahoo DOT com> on Friday October 29, 2004 @05:35PM (#10667774) Journal

The first person to fix the exploit will get a FREE GMAIL INVITE!

Share
twitter facebook
Good thing they are still in beta. (Score:5, Funny)

by bill_kress ( 99356 ) writes: on Friday October 29, 2004 @05:44PM (#10667856)

They caught this problem in beta, just as should be done! Bravo!

Brings some true professionalisim to an industry where companies actually ship/sell products with bugs like this all the time.

Share
twitter facebook
Re:doh (Score:1, Funny)

by LiquidCoooled ( 634315 ) writes: on Friday October 29, 2004 @05:44PM (#10667857) Homepage Journal

Sorry, google only allows usernames with 6 characters or more.

Please enter a longer name, or choose from the following selection:

Dodiddleyoh@gmail.com
Dangdiddleydoh@gmail.com
ArghhhhDoh@gmail.com

Parent Share
twitter facebook
Re:I must do my part to help. (Score:2, Funny)

by LiquidCoooled ( 634315 ) writes: on Friday October 29, 2004 @05:47PM (#10667882) Homepage Journal

I've already got a gmail account, can I have a free iPod instead ;)

Parent Share
twitter facebook
That sound you hear.... (Score:1, Funny)

by Anonymous Coward writes: on Friday October 29, 2004 @05:54PM (#10667944)

We forgive you google, we wuv google, googie does no wrong, WE FORGIVE U GOOGIE!!!

Share
twitter facebook
Wives (Score:5, Funny)

by mekanizer ( 823259 ) writes: on Friday October 29, 2004 @05:55PM (#10667954)

Time to read our wives e-mail to see if they are cheating or something.

Share
twitter facebook
Re:I got it (Score:5, Funny)

by Anonymous Coward writes: on Friday October 29, 2004 @05:57PM (#10667969)

Yeah, I agree. Your gmail account is the best mail I've ever used.

- Anonymous Cookie monster

Parent Share
twitter facebook
Re:Now everybody,not just Google,can read your ema (Score:5, Funny)

by iMaple ( 769378 ) writes: on Friday October 29, 2004 @06:07PM (#10668042)

what's the difference if a few Hackers get a hold of your account?

You know its not just as simple as you think. I mean I dont care if a few hackers read my email, but what if they decide to use sensitive info in it or delete it.

I run an e-business from Nigeria and earn some money in the process. People email me their bank account numbers, creditcard numbers ,SSNs and what not (I am creative). Now if some immoral hacker got hold of that data , the poor users would be duped twice, and I would feel really bad abt it (I mean I could have got twice the money myself if I wanted). So I request Gmail to help the Nigerian revolution and our fight against AIDS and dictators and fix the bug as soon as possible.

Parent Share
twitter facebook
I wuv you too /. (Score:1, Funny)

by Anonymous Coward writes: on Friday October 29, 2004 @06:12PM (#10668090)

"We forgive you google, we wuv google, googie does no wrong, WE FORGIVE U GOOGIE!!!"

Thanks /.! Rest assured that your little darling is sorry for this collossal blunder! I will try harder next time not to expose every single bit of information that you store in me.

And thanks for not crucifying me the way you did Hotmail and others. Seriously, I appreciate all your double-standards, really I do. Now I can be just as exploit-ridden as Samba, OpenSSL, and Firefox and still know that you will always put a spin on it and somehow blame M$.

I wuv you too /.
Signed,
Your Googlie Woolgie

Parent Share
twitter facebook
Re:Isn't it... (Score:2, Funny)

by downbad ( 793562 ) writes: on Friday October 29, 2004 @06:15PM (#10668123)

It will always "still" be in beta for 2 reasons. One is so they don't have any liability when things like this happen; after all they never said it was stable or secure, it's a work in progress.
like every project on freshmeat and sourceforge. ;)

Parent Share
twitter facebook
Re:Wives (Score:1, Funny)

by Anonymous Coward writes: on Friday October 29, 2004 @06:57PM (#10668501)

I'm not worried about that... I keep my wife happy :P Can you say the same?
Yes, I keep your wife happy too.

Parent Share
twitter facebook
Re:Need more than just the username (Score:1, Funny)

by daft_one ( 532587 ) writes: on Friday October 29, 2004 @06:58PM (#10668505)

Especially not all those people at my local college, who returned to find their hotmail was in Mandarin Chinese.

Parent Share
twitter facebook
Re:Google needs to toss its cookies... (Score:3, Funny)

by mccrew ( 62494 ) writes: on Friday October 29, 2004 @08:22PM (#10669073)

What I don't like about it is that it doesn't use SSL after you log in.
...which is important, because I want to read my mail over an encrypted link even though it travelled through several ISPs' data centers, many networks, a backbone or two, and probably even the FBI's scanners, IN THE CLEAR!!!

Parent Share
twitter facebook
If the hackers access my account... (Score:2, Funny)

by parliboy ( 233658 ) writes: <parliboy@gm[ ].com ['ail' in gap]> on Saturday October 30, 2004 @03:20AM (#10670820) Homepage

Could you guys at least have the courtesy of deleting all of those ads for mortgage applications? I'm sick of doing it myself.

Share
twitter facebook

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

Gmail Accounts Vulnerable to XSS Exploit 232

Gmail Accounts Vulnerable to XSS Exploit More Login

Gmail Accounts Vulnerable to XSS Exploit

Oh no! (Score:5, Funny)

Oh my god! (Score:5, Funny)

sweet grapes (Score:5, Funny)

Re:Isn't it... (Score:5, Funny)

I must do my part to help. (Score:5, Funny)

Good thing they are still in beta. (Score:5, Funny)

Re:doh (Score:1, Funny)

Re:I must do my part to help. (Score:2, Funny)

That sound you hear.... (Score:1, Funny)

Wives (Score:5, Funny)

Re:I got it (Score:5, Funny)

Re:Now everybody,not just Google,can read your ema (Score:5, Funny)

I wuv you too /. (Score:1, Funny)

Re:Isn't it... (Score:2, Funny)

Re:Wives (Score:1, Funny)

Re:Need more than just the username (Score:1, Funny)

Re:Google needs to toss its cookies... (Score:3, Funny)

If the hackers access my account... (Score:2, Funny)

Related Links Top of the: day, week, month.

Slashdot Top Deals

Slashdot