From: remko at elvandar.org (Remko Lodder)
Subject: Gmail Information Disclosure Vulnerability

Hi maarten, and the rest,
Maarten wrote:

> On Monday 05 July 2004 19:42, Eric LeBlanc wrote:
> 
>>On Mon, 5 Jul 2004, System Outage wrote:
> 
> 
>>I agree with "System Outage".  Gmail clearly told us that their website is
>>in BETA stage.
> 
> 
> Beta, alpha, released, yada yada.  Gmail is OPEN for the public, albeit you 
> need "an invitation".  Thus, enough reason to disclose security holes.

It's being used by others then gmail personel, so privacy and 
information that could be YOURS is at stake here. You just opened up a 
e-creditcard and got the numbers and information stolen, woeps, sorry, 
since it was vulnerable, now i have the codes as well. I need a car, i 
will use your creditcard. Thank you very much mister X, saved me a lot 
of money (ofcourse there can be other things in your mailbox as well...)

> 
> 
>>For me, when a software is in 'BETA' (or 'ALPHA'), we SHOULD expect that
>>this software MAY HAVE security holes.  That's why they want us to test
>>this site before going to the public release, and it's our job to notify
>>to the gmail team all bugs AND security holes we may find.  As long as
>>this website is in beta stage, all advisory that someone may send in this
>>list or elsewhere are NOT considered 'Security Advisory' for me.

I do consider them as Security-Advisory. It's being used in the wild, 
more and more people are using it, and more and more information is at 
risk. Disclosing a bug first to gmail and then to FD is a normal way of 
responding to bugs. That way we ALL profit from it.

>>The original author may not receive answers from the Gmail Team, but this
>>site is NOT IN PRODUCTION.  When gmail site will be official and when this
>>bug is still there, NOW you can publish your security advisory.

What exactly do you want to tell us? Wait until hunderd(s) people more 
are vulnerable for privacy disclosure? Some how i get the feeling you 
came from mars with happy campers that don't care about privacy and 
disclosing information that could risk your privacy.

>>Futhermore, the best people for testing the software (bugs and security
>>holes) is the public.  They can do many things which we will never
>>thought or imagined.

Indeed, that is why gmail is letting people in , and the group is 
getting bigger, finding bugs, reporting them to gmail and then disclose 
them is a normal way to follow.

>>BTW, I'm sure that the Gmail developers expect that the public will find
>>some security holes...
>>
>>If we must publish all security advisorys about beta software, this list
>>will be flooded...

Beta software is not always used by thousands of people which get larger 
every day...Still i like the disclosure so i know that there are bugs 
taken out of the system before production. I would get an  itch if i 
never heared of bugs of the application before. That means that with 
current state of coding and defense mechanism's there are a LOTS of bugs 
still present in the system. Now i would not use that ever in my life..

> 
> 
> The very reason to HAVE a beta test phase is to find and flush out bugs early. 
> Doing that, the released program can be as flawless as can be.  So when would 
> you suggest disclosing bugs is a good time ? Release date being too late... 

Exactly, disclose to gmail now, and then inform the public. Again and i 
repeat that again, it's a normal way of handling.


> 
> Maarten
> 

Cheers



-- 
Kind regards,

Remko Lodder                   |remko@...andar.org
Reporter DSINet                |remko@...net.org
Projectleader Mostly-Harmless  |remko@...tly-harmless.nl

Powered by blists - more mailing lists