Google has fixed a vulnerability in their Gmail web based email service which would have allowed internet attackers to steal mail messages from users without being noticed.

The attack works by forcing a logged-in user to add a mail filter to their Gmail account, thereby allowing their mail to be forwarded to an external mail address controlled by the attacker. Because the Gmail service did not adequately verify the origin of such requests, it was possible for attackers to create their own web pages that used JavaScript to automatically make such requests on behalf of their victims. In essence, a Gmail user would visit one of these pages and have their account compromised without necessarily realising anything is awry. Only close inspection of the Filters tab in the Gmail Settings menu would reveal what had happened.

Proof of concept exploits used JavaScript to make a silent POST request to the Gmail service and add the attacker’s filter. With the results of the request hidden in an iframe, it is highly unlikely that a victim will have noticed that their Gmail account would have been compromised, particularly while they are browsing a completely different website. While this attack scenario would only be successful if the victim was logged in, many Gmail users remain constantly logged in throughout the day, thus increasing the likelihood of a successful attack.

The technique used by this exploit is known as CSRF (Cross-site Request Forgery) and is becoming an increasingly common method to attack web applications. If a web application is vulnerable to CSRF, it will allow unauthorised attackers to carry out arbitrary actions in the context of an authorised, logged in user of the application. Not only does this make a hacker’s life easier, but it also helps them to cover up their tracks, as malicious actions will appear to be carried out, unwittingly, by authorised users of the system.

Compromised webmail accounts are regarded as a valuable commodity by hackers, as they often contain information that would allow an attacker to gain unauthorised access to other systems, such as internet banking, and to harvest credit card details from online stores used by the victim. Because the attacker is now effectively in control of their victim’s email, they could also attack other accounts belonging to the victim by following “forgotten password” links and obtaining the relevant passwords via email.

Cross-site Request Forgery vulnerabilities are often difficult to identify using automated tools and typically require testing by security aware developers.

Dedicated hosting company Layered Technologies is advising customers to reset account logins after an incident Monday night in which hackers were able to access a client support database. Layered Tech said it doesn't believe that any customer credit card numbers were compromised, but is nonetheless advising customers to change the login credentials on all their servers and underlying services created in the past two years, including webmail, SSH access, MySQL databases and cPanel reseller control panels.

"The Layered Technologies support database was a target of malicious activity on the evening of 9/17/2007 that may have involved the illegal downloading of information such as names, addresses, phone numbers, email addresses and server login details for 5 to 6,000 of our clients," company president Todd Abrams wrote to customers. "Layered Technologies responded immediately to this specific incident by conducting a comprehensive security audit of internal processes and procedures."

INetU Inc., New York Internet and Acens are the most reliable hosting company sites for August 2007, followed closely by Easynet,iPowerWeb and GoDaddy.com.

This month's leaders include two managed hosting providers who have made frequent appearances in our ranking of the most reliable performers. New York Internet, a colocation and managed services provider in Manhattan, topped the charts for the third time this year. NYI previously was most reliable in January and May of 2007. INetU, a managed hosting provider in Allentown, Pa., was second in the July survey and has appeared in the top 10 many times, including a run of seven straight months in 2004. This is the first appearance on the reliable hoster list for Spanish hosting company Acens. In January private equity firm Nazca Capital bought a major stake in Acens, which had revenue of $18.8 million in 2006.

Close behind the top three are American discount specialists iPowerWeb and Go Daddy, who offer shared hosting accounts starting at $4 to $6 per month. Go Daddy is also the world's largest domain registrar.

Three of the ten most reliable hosts run their web sites on FreeBSD, three on Windows and two on Linux.

In the September 2007 survey we received responses from 135,166,473 sites. This is an increase of 7.2 million sites since last month, the largest growth in the number of sites recorded by the survey. The rate of growth, around 5.5%, is high but not exceptional by historical standards.

The high growth so far this year has been largely driven by the increasing number of online blogging and social networking communities. This month sees strong growth in the number of sites at Windows Live Spaces, MySpace, and Blogger appearing in the survey. The increased popularity of these blog hosting services continues to have a dramatic effect on the web server market shares: Apache suffered a sudden decline in share when sites at Blogger switched to Google's GFE.

Apache gains over 3 million hostnames, and around 0.9 million active sites this month. But this is not enough to prevent its market share declining closer to the 50% mark, as Microsoft also gained over 3 million hostnames (a large part of which come from MySpace and Live Spaces, both of which use its Internet Information Server).