UPDATE: Attention! The bug is not yet fixed!

Another Update: Seems to be fixed for now…

Two days ago, “Google Video New Feature: Pick People to Email“, as I mentioned, the feature “could be dangerous”. After messing a few lines of code yesterday morning, I proved to myself to be right, the feature is indeed dangerous. So I sent an email to the Google Security team and the GMail team. As usual, they have sent me back an auto-response email.

Last night, a story called “GMail Hacked: Visit ANY Website, and Your Whole Contact List Can be Stolen” got on Digg’s home page, and about the same time, the story was picked up and submitted to Slashdot. This has grabbed Google attention, later this morning, they issued a few fixes, but not enough, the bug still can be use by malicious site.

Finally, about an hour ago or so, Google has patched the vulnerability, thoroughly, as far as I can tell. That’s like thirty hours after I notify the Google Security team. It’s new year, people.

Well, the bug has been fixed, but I guess some people will still have questions about it, here are some FAQs. (Questions are from the Digg and Slashdot comments)

  • Zaphod-AVA asked, “So is this a Firefox, Gmail, or javascript vulnerability?” - Gmail’s, or you can say, Google’s, if you like that better.
  • Neuros said, “it incorrectly identified me, too. thought I was my own mother. that… would be a little too weird for me.” - Haha, that’s my fault. :) Looks like you have email your mother a lot.
  • HaxityHaxHaxed exclaimed, “The source was the malicious content!” - I am not going to blame you for thinking of that, the script was “encoded”, but if you take a few seconds look at the clear code which you can obtain by using a Firefox built-in feature, “View Selection Source”, you will find that the code is not malicious - it does nothing but displaying your friends’ emails to you.
  • Kuza55, “You know, the funny thing is you can decode that in seconds using the Web Developer toolbar, and I’m sure he spent at least a good 5-10 minutes or so encoding it……” - Yes, I actually spent a few good minute to encode it, and I knew that you are able to use the Web Developer toolbar to see the code, but there are some people who don’t. By the way, thanks for clarifying about the code for me. :)
  • Yazoo, “I’m not even logged in GMAIL and it still works!!! Try it for yourself. Where’s it getting the list from?” - If you have share a GMail account with other Google services, such as Blogger, Orkut, Google Docs & Spreadsheets, you will be automatically log into Gmail.

There are just too much question to be answered, so if you have one, feel free to leave a comment here, I will answer them one by one ASAP. Kazad, a commenter on Slashdot, has a great explanation on this one, you should take a look. :)

Last thing that I want to say is that Google shouldn’t include the “callback” parameter when using letting client side call for JSON, especially when it contains such important information (email addresses, and possibly phone numbers, address, and names). I don’t know the code that Google is using the pass these information, but in many cases, disabling the callback parameter should work well.

Happy New Year. :)

UPDATE: Forgot to mention that Google didn’t threaten me. This is a really popular question. :)