BBC Watchdog is British TV program that investigates viewers’ reports of problematic experiences with traders, retailers, and other companies around the UK. A recent investigation has discovered that wi-fi hot spots across the country are not secure – leaving tens of thousands of users at risk of fraud.
In this particular case they reveal how easy it is to hack into someones GMail account over Wifi, sending emails and changing their password. According to Danny Sullivan who shared the link on Twitter, if he’d signed via secure https, he’d probably have been safe – can anyone verify?
If you can’t see the video below, watch it here.
I don’t understand… signing into gmail uses https: to sign in. As an option I also use the gmail setting to use https: all the time so the entire session is encrypted. I wonder if the point of this is that the user didn’t have https: option on. I guess I am wondering what makes using the hot spot un-secure. I think with https on all the time then you are safe.
I think Gmail doesn’t use https all the time by default. Shame!
There sharing not many details as, did he got his pw?
It would be nice if they included more technical details, but I bet this wouldn’t be possible if the connection were over https. You can turn off unencrypted http access in your gmail settings, which will force the more secure https. But it’s probably not hacker-proof.
Its a scare tactic video made for the majority of the population who are dumber than a box of rocks. That’s why they included ZERO technical details.
Google Mail blog recently recommended using HTTPS. Easy to set up in Gmail settings, General tab.
Link to blog post:
http://gmailblog.blogspot.com/2009/10/gmail-account-security-tips.html
Watchdog programme notorious for over-hypeing issues, but this should be addressed.
This attack is indeed possible using sidejacking. I’ve written the details up in a short post (referring back to this one): http://cpbotha.net/2009/11/01/your-gmail-account-can-be-hacked-over-insecure-wifi/
Cookie sniffing (using kismet)
Then move the cookie into your cookie folder and browse google and your auto logged in!
You also get access to all of googles services, eg. you could upload illegal stuff or send abusive comments.
Sessions last a whole hour!
http://xeesoft.com/books/Hacking.W.N.pdf
Damn, is it 2003 all over again? Unsecure wifi, is unsecure. Who knew?
http or https, makes no difference, because it’s a man in the middle attack (using either dsniff or wsniff), I’ll bet my a** on it. It’s known for years, wake up people.
Apparently GMail has plugged this specific one by also tagging the GX auth cookie as secure, in SSL mode it can only cross via SSL.
See this post from Robert Graham’s blog: http://erratasec.blogspot.com/2008/08/google-vs-sidejacking-round-7.html
Using https improves things but doesn’t solve the problem which is inherent in the way many web2.0 sites have been built with ajax. Details can be found here: http://arstechnica.com/business/news/2008/02/report-google-mail-vulnerable-to-sidejacking-despite-ssl.ars
Reynhardt van Blommenstein
Hacking Google G-mail e-mail accounts at will.
He is Hacking Google G-mail e-mail accounts at will.
Reynhardt van Blommenstein – Great Brakriver – Garden Route South Africa
Email: reynhardtvb.photography@yahoo.com
Contact Number: Fax: +27 44 696 6364 Tel: +27 82 798 6268
This author made many complaints with no response.
Reynhardt van Blommenstein is Hacking a Google G-mail e-mail accounts at will.
He is employed by Millers Attorneys (George & Cape Town) – Western Cape to do so and getting paid for it – Lefevré Joubert – 083 447 1269 – +27 (0)44 874 1140 – van Blommenstein – Great Brakriver – Garden Route South Africa.
Millers Attorneys (George & Cape Town) – Western Cape.
I have complained to Google, Millers Attorneys, Mweb, South African Police, Reynhardt van Blommenstein, Law Society of South Africa no joy.
it’s not! but u can set it 2 b encrypted for every session..