Hacked!

[piccolomondo]

Gmail Hacked!

WARNING: If you use Gmail, it's absolutely vital that you check your account settings now.



Check ALL your filters to ensure your account hasn't been hacked like this designer's. Google has fixed the vulnerability, but if you were exposed before the fix, the filter could still exist in your Gmail account.

[amalgamate]

So in order not to get hacked, just make sure the forwarding option is disabled?

[Bent_Bladi]

how scary

[amalgamate]

5-minute guide to protecting identity

Here are 16 steps to protect yourself and six ways to clean up things if you are a victim of identity theft.



The Basics
Your 5-minute guide to protecting identity

Your phone may be under attack
Diagnosis: Identity Theft
Don't take your passwords to the grave
Lock your credit away from ID thieves

[Bent_Bladi]

whoa... i'll read that once i finish eating dinner

[piccolomondo]

So in order not to get hacked, just make sure the forwarding option is disabled?

Check ALL your filters to ensure your account hasn't been hacked... Google has fixed the vulnerability, but if you were exposed before the fix, the filter could still exist in your Gmail account.

There are two different kinds of attack, both involving the "Forwarding" option:

1. via CSRF (Cross-Site Request Forgery), injecting evil filters on Gmail. CSRF attacks transmit unauthorized commands from a user the website trusts. (If you are curious, you can start reading its wiki page.)


2. via a Gmail vulnerability (already fixed) as Fernando Muñoz, the guy who discovered the vuln, says:

"the second one will make Gmail forward all new received emails to another email account, no user interaction required" ...

"To reverse my attack, you have to disable Forwarding,
and for pdp's
you have to remove evil filters from your filters list."

This way, you'll 'close the doors and the windows'. Ecco!
;-)
Here is a fictitious sample:



I could not take the change on these days, attacking my 'beautiful self' just to test that guy's code and if the vuln was really fixed. But I checked ALL my filters for any evil injection.

Hope this post answered your question and raised our awareness of the endless vulns we are exposed.

[piccolomondo]

5-minute guide to protecting identity

Nice intro article from MSN.
Our ID is our ID, online or OFF.
Shukran.