Gmail Hijacking On Mobiles

In the last days, there has been lots of talking about weak security of Google ‘cloud’ services: after the authentication on encrypted protocol (HTTPS), all data exchange between user and Google servers takes place on plain HTTP, thus allowing for easy attack or eavesdropping. Wired reports that, for this reason, several security experts signed a public petition to ask Google to protect complete user sessions with SSL. From our mobile enviroment perspective, we cannot but to completely agree.

The abusing of the OMA provisioning mechanism, supported by a great extent of modern mobile devices, as we pointed out, demonstrates beyond any doubt how concrete the risk is. Ironically, while provisioning protocol makes abusing mobile devices configuration so easy, many sites do use secure (SSL) protocols, but not when accessed by mobile devices; probably because, given their reduced computational power, these are considered unfit to cope with encryption in an effective way.

Continuing our exploration of what the consequences of Data Session Hijacking could be, we went a step further. In Proxy Fun we reported that hijacking by means of remote proxy configuration only affects HTTP traffic (and HTTPS as well), that could be considered as a limitation but, by contrast, allows for some HTTP-specific hijacking techniques more easily than a remote DNS configuration.
Actually, the original attack we presented at BH Europe 2009, based on DNS configuration, was still unable to intercept and handle HTTPS connections, thus still being ineffective with sites that used this protocol for authentication.
Proxy configuration makes hijacking effective on a new mobile site category: those (email providers, social network, e-commerce) that use HTTPS protocol for logging in, and then switch to HTTP protocol for the rest of the session. Exactly like Google – that, by the way, is still more secure than several services that make no use of SSL whatsoever; we have found several ones.

So, hijacking by means of a proxy configuration means passing HTTPS authentication without interception by CONNECT method, then getting the session cookie (called GX for Gmail) from subsequent HTTP requests and using it to hijack the user session – a technique called “sidejacking”. You don’t have to think that only exchanged data is at risk; the attacker gets authenticated to the server and can operate on the server as if he was the user. An attacker, for example, could write, send and delete mails on behalf of the victim user or delete the user’s documents.

Sidejacking, or using the victim session cookies to impersonate him, was demonstrated by the founders of Errata Security at BlackHat Usa 2007. Also an evolution of this technique has been proposed, called forced sidejacking, that makes use of ‘HTTP 302 Temporarily moved’ web pages for collecting victim cookies.

In the following video we show how remotely configuring an LG KM900, in order to force it to go through an evil proxy server, looks like; then the attacker easily grabs the GX cookie released within a Gmail mobile session and uses it in his browser to hijack the mobile session.

Leave a Reply