News for hackers. Stuff that matters.

A comment on Gmail Account Hijacking Vulnerability.

Re:Gmail Account Hijacking Vulnerability by antoncohen on Sunday November 06, 2016 @02:33PM (#12886644)
There is no account hijacking vulnerability here. The researcher was able to send email as a non-existed Gmail account, they could have just as easily registered that Gmail account. The only place this becomes a vulnerability is if the account doesn't exists and you aren't allowed to register it (like [email protected]), or if there is a temporary bounce from a legitimate account.

Either way, it isn't a hijack, you can just send email from the "hijacked" account through Google's servers, you can't receive email sent to the account.

[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by hobarrera on Sunday November 06, 2016 @02:40PM (#12886681)
As mentioned in the article, you can hijack accounts if the recipient has blocked you.
[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by antoncohen on Sunday November 06, 2016 @02:58PM (#12886757)
It still isn't a hijack, it only allows you to send email as that user through Google's servers. It is always possible to send email as anyone you want, just change the From address in your mail client [1]. Google attempts to prevent unauthenticated From addresses going through their servers. So it is a vulnerability because it bypasses intended restrictions (in some edge cases), it just isn't a hijack as the post's title says.

[1] Yes, you have SPF and DMARC to contend with.

[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by willvarfar on Sunday November 06, 2016 @04:22PM (#12887100)
We have different definitions of "hijack" then. I think "hijack" is broad enough to include sending mail as someone, rather than just spoofing them.
[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by jlgaddis on Sunday November 06, 2016 @04:41PM (#12887209) 

  $ telnet localhost 25
  Trying 127.0.0.1...
  Connected to localhost.
  Escape character is '^]'.
  220 localhost.localdomain ESMTP
  EHLO jlgaddis
  250-localhost.localdomain
  250-PIPELINING
  250-SIZE 26214400
  250-ETRN
  250-STARTTLS
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 DSN
  MAIL FROM:<[email protected]>
  250 2.1.0 Ok
  RCPT TO:<[email protected]>
  250 2.1.5 Ok
  DATA
  354 End data with <CR><LF>.<CR><LF>
  From: President Barack Obama <[email protected]>
  To: willvarfar <[email protected]>
  Subject: LOLOL

  This is an account hijack!

  -BO
  .
  250 2.0.0 Ok: queued as 6AE031F5FE
  QUIT
  221 2.0.0 Bye
  Connection closed by foreign host.
  $
[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by revicon on Sunday November 06, 2016 @05:10PM (#12887371)
The difference between your example and the article's is that in the article's example the emails are signed with DKIM and SPF by google which marks them as legit emails vs your example which is not signed.
[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by gcr on Sunday November 06, 2016 @06:04PM (#12887611)
DKIM and SPF are intended only to authenticate the originating saver, not the actual user account from the originating saver. To my knowledge, there is no reliable mechanism (beyond PGP and the web of trust) for authenticating that a certain sender actually sent an email message.
[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by xoa on Sunday November 06, 2016 @06:22PM (#12887684)
>To my knowledge, there is no reliable mechanism (beyond PGP and the web of trust) for authenticating that a certain sender actually sent an email message.

You can use S/MIME as well, which has its own tradeoffs like all PKI but also somewhat more widespread and mildly more seamless support. But your basic, unless the e-mail is cryptographically signed in some manner there's no significant authentication for email. If cryptographic signing was more widespread then issues with spam, phishing/spearphishing, etc could be significantly reduced simply by virtue of elimination of spoofing. That day does not seem likely to come any time in the foreseeable future however, given that if anything end-to-end cryptography in email (be it for signing or encryption) seems to be going backwards, not forwards. It'll remain an irritating situation for a long time to come.

[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by discreditable on Sunday November 06, 2016 @06:52PM (#12887819)
DMARC utilizes DKIM/SPF to validate the From: account. In short, if I send from [email protected], then my message must also pass their SPF/DKIM policy.

https://en.wikipedia.org/wiki/DMARC

[ Parent | on HN ]
Re:Gmail Account Hijacking Vulnerability by gcr on Sunday November 06, 2016 @10:25PM (#12888577)
(pardon, meant to write "originating server" above)
[ Parent | on HN ]