Recently, a Pakistani student and CEO of Security Fuse, Ahmed Mehtab was listed in Google’s Hall of Fame for discovering a major flaw in Gmail which allows anyone to hack any email account.
However, qualifying for Google’s VRP is never going to be easy so it becomes vital that the vulnerability/flaw is identified in any of these categories mentioned:
Gmail allows users to set forwarding address so the emails which users receives are also sent to the another added the email address.
However, qualifying for Google’s VRP is never going to be easy so it becomes vital that the vulnerability/flaw is identified in any of these categories mentioned:
- Cross-site scripting,
- Cross-site request forgery,
- Mixed-content scripts,
- Authentication or authorization flaws,
- Server-side code execution bugs.
Gmail allows users to set forwarding address so the emails which users receives are also sent to the another added the email address.
Ahmed Mehtab said:
These two modules were actually vulnerable to authentication or verification bypass. It’s similar to account takeover but here I as an attacker can hijack email addresses by confirming the ownership of email and was able to use it for sending emails.
Ahmed Mehtab Said in his blog Security Fuse that any email address could be hacked if it matches any of the following cases-
- If recipients SMTP is offline
- If recipient has deactivated his email
- If recipient does not exist
- If recipient exists but has blocked us\
- Cases could be even more
- Attacker try’s to confirm ownership of xyz@gmail.com
- Google sends email to xyz@gmail.com for confirmation
- xyz@gmail.com is not capable of receiving email so email is bounced back to Google
- Google gives attacker a failure notification in his inbox with the verification code
- Attacker takes that verification code and confirms his ownership to xyz@gmail.com
Ahmed Mehtab also posted a video that was recorded at the time when it was vulnerable. However, he mentioned that he was not awarded for such a serious security issue but they listed him in Google’s Hall Of Fame for his contribution.