G-Archiver Harvesting Google Mail Passwords

Thwomp writes "It appears that a popular Gmail backup utility, G-Archiver, has been harvesting users' Gmail passwords. This was discovered when a developer named Dustin Brooks took a look at the code using a decompiler. He discovered a Gmail account name and password embedded in the source code. Brooks logged in and found over 1,700 emails all with user account information — with his own at the top. According to a story in Informationweek, he deleted the emails, changed the account password, and notified Google. The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in the product."

Debug, Sure

[Archangel Michael]

"The creator of G-Archiver has pulled the software, stating that it was debug code and was unintentionally left in [CC] the product."

Right. And I have a bridge I'd like to sell you too.

That doesn't make sense.

[RandoX]

If you're debugging, you already have the account details. What possible reason could you have to email them to yourself?

DMCA

[yohaas]

If this was a big company, they would have denied it and gone after him under the DMCA. At least the admitted to something and pulled to product.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Nice move, but illegal?

[RandoX]

Good intentions and all, but I'm sure Mr. Brooks just opened himself up to "hacking" charges.

Re:This is why I backup my Gmail with G-Archiver

[afidel]

Or simply use IMAP to archive your gmail account...

Never ascribe to malice

[Pope]

what can be explained by incompetance?

Although in this case, that's some serious incompetance going on!

Don't give out passwords

[Todd Knarr]

And this, children, is why you should never ever give the password to your account to someone else. Not even someone who claims to want to do something for you. Once you've given it to them, you have no control over what they do with it.

Re:Trust me, trust me not.

[Z00L00K]

I don't believe that for a moment.

This seems to be a clear case of privacy invasion and unauthorized access to private data. And I think that this should have been brought to the attention of the police for further investigation.

In this case the guilty will have time to cover his tracks and hide.

Try this approach the next time you see something as grave as this. The worst thing that can happen if you report it is that the case gets dismissed.

Re:Nice move, but illegal?

[San-LC]

Possibly by some ridiculous interpretation of the law, Mr. Books was "hacking." However, he purchased the rights to use G-Archiver, and he did not recompile the program in a different way and label it his own. He used information that the program (to which he has the rights to use, unless otherwise stated in some bullsheet EULA) used, found out that this program acted like a Trojan virus and submitted private information to an individual's e-mail account, and subsequently removed his information and disallowed any new information to be read.

Granted, he probably shouldn't have deleted everything and changed the password (morally: yes, legally: no), so it's likely he may face charges because of this. That's our legal system, folks.

Backup????

[spectrokid]

Isn't the whole freakin point of GMail that you don't have to backup?

No reason to read the body of the emails...

[Anonymous Coward]

There was no reason to read the emails as the username and password skimmed are in the subject line.

Re:Gmail Backups?

[Tony Hoyle]

Of course using this software virtually guarantees that your account *will* be stolen, because the author 'accidentally' kept a record of your username/password 'for backup purposes'.

Re:This is why I backup my Gmail with G-Archiver

[MBGMorden]

You still have to trust the IMAP client to not be logging your passwords. It all comes down to whether or not you trust where the software came from. Luckily for open source projects there's an easy audit trail (so long as you compile from that source - a premade binary distributed with source could still contain malicious code simply not included in the provided source). For closed source software you're stuck trying arcane trickery like this guy did in order to find out when a program is spying on you.

Doesn't look malicious to me

[Pogie]

Maybe I'm getting old, but this seems like a pretty clear case of "oh crap, I'm an idiot", rather than "mwuahahah, my plan for global domination proceeds apace!". According to the posting on codinghorror, the guy who found the issue (Dustin Brooks) found that the creator, John Terry, of the G-Archiver software had left his own email information in the code. Yes, the G-archiver forwarded a record of the account information of everyone who used the app to that mailbox, but if you look at the screenshot, none of those emails has been flagged as read by gmail (but maybe that's an artifact of a POP connection?).

Either way, this just smacks to me of a novice developer doing something incredibly dumb, rather than incredibly malicious. If he actually wanted to just collect other people's account information, why leave his own in the source code? He could have just as easily forwarded the information to an anonymized email account, or simply an account for which the login information was not present in source.

Just my opinion, I reserve the right to be wrong.

Deleted the emails

[gorre]

From the Information Week article:

Brooks said he then deleted the presumably stolen account information, changed the password on the account, and notified Google.
[...]
Google's statement continues. "We are investigating this incident, the underlying activities of which violate Gmail Program Policies. We have suspended the suspect account, and are in the process of notifying the owners of those accounts whose passwords may have been compromised. It's unfortunate that fraudsters continue to use email for these purposes. We have phishing detection capabilities built into Gmail, so we were able to act quickly to limit the impact of this particular attack."

I have never read Google's Privacy Policy but am slightly concerned that they appear to be able to access emails after their deletion.

Re:DMCA

[yohaas]

He reversed engineered the program, that would probably be banned under the DMCA. http://www.chillingeffects.org/reverse/ [chillingeffects.org]

Re:Doesn't look malicious to me

[AdamTrace]

I agree. There's a lot of high and mighty programmers here who are calling this guy "incompetent", but I'd be shocked if we haven't all accidentally sent debug code to production at some point or another.

It's either an honest mistake, or a REALLY poor hack attempt. Unless I've given further information, I'm inclined to think it was an honest mistake.

Adamn

Re:This is why I backup my Gmail with G-Archiver

[Hatta]

For closed source software you're stuck trying arcane trickery like this guy did in order to find out when a program is spying on you.

The upshot of this case is that the app in question was written with .Net which is fairly easy to decompile [aisto.com]. If he had chosen C++, there's a good chance no one would have bothered to pore over the assembly and find this out.

Re:Many Laws Broken , No Ehics

[MightyYar]

What twisted, warped world do you live in where it is unethical to stop a crime-in-progress?

Re:Hmmm

[jeepee]

he deleted the emails
But did he make a backup first?

He tried but it caused an infinite loop.

Re:This is why I backup my Gmail with G-Archiver

[mmkkbb]

Sure, but someone could have checked the net activity just as easily.

Re:Deleted the emails

[L0rdJedi]

Why? Because they happen to keep backups of email, like everyone else on the planet?

Re:That doesn't make sense.

[harry666t]

Assuming that this code was really just some debugging stuff accidentaly left there... It might have been there in only a few particular versions or something like that...

Re:That doesn't make sense.

[sholden]

Doesn't make any sense. Why would you go through the process of sending an email with the information when you could just print it to a file, or throw it in a dialog box.

A developer wanting to collect people's usernames and passwords and realising that since the program talks to gmail already doing so over gmail would make it much less likely to be noticed by people monitoring network connections for "phone home" behaviour, seems the most likely explanation. Of course there mightn't be any malicious intent, just a "cool, look at all the accounts I collected" thing - like those people who get a warez copy of every piece of software ever released without ever actually using any of them...

Re:This is why I backup my Gmail with G-Archiver

[bberens]

Not really JUST as easily. You fully expect the G-Archiver to be transmitting encrypted (ssl) data to google. A few extra packets aren't going to raise any red flags.

Re:Even the courts aren't this daft

[Anonymous Coward]

Anonymous Coward is not a synonym for insightful.

Re:Gmail Backups?

[LLKrisJ]

Well... I recently came across a situation where I wanted to migrate some emails from one account to another. So I could understand the need for some type of backup and restore software.

However, you already have software like Imapsize to make backups using imap.gmail.com and even without that; one can easily move GMail messages to your local machine using Thunderbird or most other mail clients.

So indeed, this must be the most redundant piece of software I have ever seen. Either the devs are quite stupid or they really were out to get account info of people...

Re:Don't give out passwords

[gnick]

And this, children, is why you should never ever give the password to your account to someone else. Not even someone who claims to want to do something for you.

This is a little bit different than the standard "give your password out" case. I give my e-mail password to Thunderbird. I give Firefox a few of my passwords. Because those applications need those passwords to authenticate with remote servers so that they can "do something for me." For folks who were using it, the same goes with G-archiver. In some applications, you just have to decide whether the service being rendered is worth you taking the risk that the application may be malevolent. (Or putting a lot of effort into being reasonably sure that it's kept in check.)

Your e-mails haven't ever been actually deleted

[sirwired]

When you delete e-mails (even if you hit "Delete Forever"), GMail does not actually delete your e-mails right away. All that happens is you can't see them any more. Google has been rather forthright about this from day 1 of the Beta; it raised a big furor when GMail was first released.

From the GMail Privacy Policy: (which is blessedly short, and in English)
"You may organize or delete your messages through your Gmail account or terminate your account through the Google Account section of Gmail settings. Such deletions or terminations will take immediate effect in your account view. Residual copies of deleted messages and accounts may take up to 60 days to be deleted from our active servers and may remain in our offline backup systems."

SirWired

Re:This is why I backup my Gmail with G-Archiver

[pipatron]

running a strong firewall

Wouldn't help a bit; the good and the bad parts of the software used the same port to the same server in the same way.

run a packet sniffer

Wouldn't help a bit; the good and the bad parts of the software used the same SSL channel, you won't get into that with a normal sniffer.

Re:Don't give out passwords

[gEvil (beta)]

And this, children, is why you should never ever give the password to your account to someone else. Not even someone who claims to want to do something for you. Once you've given it to them, you have no control over what they do with it.

I was looking at [finally] creating a facebook account the other day. On the account creation page, they have some fields where you supply your webmail address and the password to your webmail account, and it'll automatically look through your address book and find your friends who have facebook accounts. As soon as I saw that, I decided that I still don't really want a facebook account. I steer way clear of any site that asks me for my logins to other sites.

Re:Gmail Backups?

[hetfield]

You have 6.5 gig of space on redundant remote servers. What are you backing up? Perhaps I do not understand what this application does and who needs it...

Redundancy is never a replacement for backups.

http://slashdot.org/article.pl?sid=08/01/25/1535226 [slashdot.org]

To quote Hanlon's Razor...again.

[_Shad0w_]

"Never attribute to malice that which can be adequately explained by stupidity"

Although in this case I think stupidity might not be an appropiate term. Unless you have oversight (either peer or some other form) it's quite easy to accidently leave deubugging code in a release. I'll hold my hand up and say I've done it; any programmer who says they haven't done it - or at least something similar - is either delusional, hasn't noticed yet or is a downright liar.

Re:Trust me, trust me not.

[lukas84]

And did you build a bootstrap C compiler from scratch?

http://www.informit.com/articles/article.aspx?p=102181&seqNum=4 [informit.com]

Re:Deleted the emails

[BitZtream]

Considering when gmail started out there was no 'delete' functionality, it should not be suprising that the messages are never deleted.

Why are suprised that when you let someone other than yourself hold onto your data that they can access it even after you can't? Do you know what backups are?

For google, there are a number of reasons why they would want to retain the data, not that I think they should if they tell you its deleted. The amount of example emails they can run new code at to test various performance and reliability aspects of the code is the first thing that comes to mind. Feeding more data to their add targeting software is enough.

Finally, I've not read the license agreement fully myself, but I do seem to recall them stating pretty clearly that they may not delete your emails even after you mark them as deleted. They certainly aren't the only site that does this.

If you want complete control over your data retention policy, you need to run your own server, not outsource it to a free provider who has no liability to you at all.

I.E. ... if you don't want your private stuffs getting out on the internet, DON'T PUT IT ON THE INTERNET. duh.

Re:This is why I backup my Gmail with G-Archiver

[Spokehedz]

Umm... Gmail lets you use IMAP from their own servers. So, it would be your own client. On your own computer.

I'm failing to see how this is insecure.

The /. crowd has no imagination

[Dwonis]

As I read the comments attached to this article, I see that many slashdotters can't imagine why this debug code would be put into the software in the first place.

To those slashdotters: You people have no imagination.

Imagine you're a G-Archiver developer, and one of your customers calls you, saying "Your program doesn't work. It's saying something about an invalid user." In order to reproduce the problem, you ask the customer for his credentials. He tells you his username and password over the phone, and you try logging in yourself. It works fine.

After a while, you think the problem might be that the password being entered is different from the one you were given over the phone. Perhaps it has something to do with the customer's strange keyboard layout, or maybe the customer's keyboard has some flaky keys.

So what do you do? You give that one customer a special build of the software that emails you the username and password as entered.

Later, you accidentally check in the debug code for that special build. Oops.

Re:Debug, Sure

[IceD'Bear]

Girls?

On /.?

Re:The /. crowd has no imagination

[Tim Browse]

Later, you accidentally check in the debug code for that special build. Oops.

And you don't notice the 1,777 emails piling up in your inbox until someone investigates your code and calls you out on it.

I agree with the others - you interested in buying a bridge?

An Accident?

[Jekler]

I've written a lot of code in my time. I've never written a routine/method/function that saved user account names and passwords then emailed them to myself. Writing passwords to the local system is fine, but even that you have to do correctly (in a sufficiently encrypted form) and you must notify the user. I can't understand how he could possibly justify creating emails that transmit password information as simply a debugging accident. The debugging process probably shouldn't involve automatically creating emails. And if it does, it probably shouldn't include secure information. And if it does, it probably shouldn't include secure information from the user without notifying them.

I don't think this can be justified. You can't "accidentally" harvest account names and passwords. Bells go off in the head when you're writing code that says "create an email, send it to this address, and include the current user's username and password."

Re:The /. crowd has no imagination

[jopsen]

If there was 1,700 email it was probably a dummy account... If the developer wanted the mails, then why would he hardcode the password to the email account in his program, when he just as easily could have send the emails to the email account without logging into it, this would have been safer from package sniffers... That said... I agree that this is just yet another reason NOT to used closesource software...

Re:This is why I backup my Gmail with G-Archiver

[TheoMurpse]

What I want to know is, if he used this for debugging purposes and left it in by accident, why didn't he ever see thousands of Gmail passwords showing up in his inbox and realize the problem?

Re:This is why I backup my Gmail with G-Archiver

[dwater]

This is an interesting point. I wonder if the login history of the account shows that he hasn't bothered to log in for quite a while - perhaps it is an account specifically for this purpose rather than his usual account. That might give credence to his claim of it being debug code and having forgotten about it.

I suppose he could have had the passwords filtered in some way and not noticed the 'folder' (or whatever gmail has) filling up.

Re:This is why I backup my Gmail with G-Archiver

[Rabbi T. White]

From looking at the pictures on the blog of the guy who discovered this, there were over 1000 unread emails - all the ones on the initial page of the inbox were usernames and passwords, quite clearly unread. If we're giving him the benefit of the doubt, tt is likely that this was just a throw away account used for testing... or else he probably would've changed his own password, no?

Re:This is why I backup my Gmail with G-Archiver

[LrdDimwit]

How do you know those are his own login credentials, and not a red herring? That's the funny thing about trust ... once it's gone, it's a whole other ballgame. Here we have a company providing a nigh-useless "service" with broken English in their FAQ (weak circumstantial evidence only, but still evidence) and that employs coding practices either underhanded or dubious.

Does it really matter which it is? There's no compelling reason to ever use their product, and they've just demonstrated that they can't be trusted. Is it really any better if it's due to ineptness rather than maliciousness?

Re:This is why I backup my Gmail with G-Archiver

[Gareth Williams]

I see this particular misconception going around on /. all the time nowadays, and I'm rather tired of it. The claim is always something along the lines of: "there's no security advantage in using open source software unless you examine the source and compile everything yourself".

That holds true if you run around downloading random binaries from random websites (ie. the way your typical Windows user acquires all their software). But hardly anybody who has used an OS with a proper package manager for more than 10 minutes actually does this.

I get all my software from my distribution. Currently Ubuntu, for example. Yes, their package maintainers build my binaries, I don't build 'em myself. But it isn't unreasonable for me to trust Ubuntu. They supply my OS, after all, so if I can't even trust them then I'm already up the creek :) The same is true of every other OS on the planet. (yes yes, even Gentoo, and even if you hypothetically audited every application yourself before compiling it. Hopefully I don't need to explain this, many other posters have already linked to 'trusting trust'. Suffice to say that you have to trust someone at some point, even if it's the supplier of your C compiler, your processor microcode, etc).

Now, Ubuntu are presumably building from the publically released source code for each application (ie. the source code supplied by the original application author), the same as everyone else. So in the open source world, all the binaries floating around out there (at least from the people you trust!) DO match the available source code. And we don't all need to audit it - it only takes one person (maybe working at a company that pays them to audit open source programs, as other posters have suggested) to discover something nefarious, and we'd all drop it like a hot potato.

That isn't to say that it's impossible to sneak back doors into open source programs, or that package maintainers are all 100% trustworthy (they're only human. but so far they have an exceptional track record). But using an open source program supplied by your distribution is a damn sight safer than downloading and running some binary from Joe Random's obscure website (or company, for that matter).

Of course, there are still occasions where you need some program that isn't in the repositories, but those occasions seem to be becoming more and more rare these days. When this occurs I do actually tend to compile it myself (./configure; make; make install. really tricky eh?), but I can't remember the last time I needed to install something like this. 98% of what I need is in the repositories, and I'd wager 100% of what your average man-on-the-street needs.

Re:This is why I backup my Gmail with G-Archiver

[sonofusion82]

as i know, it is possible to download the emails using POP access and the mails remain as unread. so then the next question: is POP or IMAP access enabled for that account?