Google cross domain frame injection vulnerability

Written by DP

Saturday, 11 October 2008

Dan Goodin wrote a good article on about the titled issue.

This is not really a new vulnerability. Stuarty first submitted this frame injection/redirect to our archive on July 2007. It is also known for more than 2 years as a method to hijack Google accounts.

Nevertheless, Adrian 'pagvac' Pastor from the GNUCitizen team provided a great demonstration on how attackers/phishers can exploit this bug  to steal users' cleartext authentication credentials with a fake Google account login page.

"The result is this page, which allowed him (at time of writing, anyway) to display a fraudulent Gmail login page that displayed in the browser's address bar." !!!DO NOT ENTER YOUR CREDENTIALS!!!


After a long long time...

"A Google spokesman said company security pros were looking into the reports."

C'mon Google security team! Please fix this bug for once again in record time!

More Google frame injections and open redirects HERE. 8-)

Thanks again to Adrian and Aviv for throwing light on this issue! ;-)

Related News/References:
"New Google bugs empower phishermen", Dan Goodin, TheRegister - 10 Oct 08
"Frame Injection Fun", Adrian "pagvac" Pastor, GNUCitizen - 10 Oct 08
"Sharing is not always a good thing",  Aviv Raff, Aviv.Raffon.Net - 10 Oct 08

Home | News | Articles | Advisories | Submit | Alerts | Links | What is XSS | About | Contact | Some Rights Reserved.