Security Researcher Defends Plan To Release Gmail Hacking Tool

Just over a week ago, security researcher Mike Perry presented information at the DEFCON security conference about a vulnerability that affects many SSL-secured Web sites, including Amazon, Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks.

The attack works something like this: As Perry explained at DEFCON, a Gmail user might login to Gmail using the ostensibly secure URL https://mail.google.com. If subsequently surfing CNN.com, for example, via an open wireless connection, an attacker could inject a Gmail image URL and prompt the user's browser to transmit an unprotected Gmail 'GX' cookie in conjunction with the image fetch operation. The attacker could then 'sniff' the unprotected cookie and later use that file to access the victim's Gmail account.

Perry is planning to release a tool that makes HTTPS cookie hijacking easy. And he defends his plan to do so.

Revealing security flaws isn't popular among those that have to patch affected systems. The Massachusetts Bay Transit Authority, for example, recently obtained a temporary gag order -- lifted on Tuesday -- that prevented three MIT students from presenting information about security problems in the transit agency's fare card system.

But Perry maintains making security problems public is necessary.

"Being quiet or not disclosing full details would only promote ignorance and a false sense of security among the general populace, but it still provides full understanding to the adversary, who is considerably more knowledgeable," he explained in a recent blog post. "Remaining silent also gives developers an excuse not to implement what is at the end of the day a very simple fix. I pity them, because I don't like being forced to do work or spend money either, but those are the breaks."

Indeed, tales of foot dragging by companies that have been informed of problems abound in the security industry. For example, Perry says that he told Google about how Gmail was vulnerable last year, nothing happened. He says it was not until he announced that he would be presenting information about the vulnerability and releasing a tool to exploit it that Google took action -- action Perry argues is insufficient -- by offering an option to only connect securely.

Perry's post continues, "I firmly believe that human readable program code very much qualifies as speech, and should be protected at all costs, even if it is exploit code or instruction that causes people in power some inconvenience."

As an assessment of the security industry, InformationWeek has published its 2008 Strategic Security Study, which quizzed nearly 2,000 IT professionals about their plans and priorities for securing their companies' assets. Download the report here (registration required).