The reason this vulnerability exists is due to the strong tie-ins between GMail and all of Google’s other services, such as Google Calendar, Blogger, and Google Code AND the strong desire for Google Apps to be able to share data with people. This isn’t the first time, the second time, or the last time the strong tie-ins have produced interesting results, see my post on Billy Rios’s Google Code exploit, Billy’s taking ownership (pwnership) of content attacks against Google Spreadsheets, Billy and I stealing documents from Google Docs, and see my talk at Black Hat for more. The steps to accomplish this are as follows: Ok, big deal right? Well, yeah, it’s not earth shattering, but it is extremely interesting from what could be done with it. As soon as I saw this I could only think about Nitesh Dhanjani and Billy Rios’s talk on Phishing, which will be at Black Hat Vegas again, and you should definitely go see it. The talk centered around getting into the underground of identity theft and phishing. One thing that was clearly demonstrated was the lack of intelligence of a number of Phishers. This could give up the full names of some of those Phishers. Go see Billy and Nitesh’s talk this year, I’d be surprised if they haven’t used this to their advantage.
