Gmail vulnerability disclosed at Defcon

Though it’s not specific to Gmail, or easily exploitable by users
outside your network, a session hijacking demonstration by Robert
Graham showed hackers how to take over a users email account by simply
sniffing network traffic and stealing cookies. In the demonstration,
George Ou volunteered an email address
he created to be hacked into — and it didn’t take long. Within seconds,
the attacker was able to use a point-and-click interface to get access
to this account and send a message from it.

The demonstration highlights how easy unsecure network traffic can
make for some very simple session hijacking. One way you can avoid
having your Gmail account taken over by people on your network is to
use the SSL version — be warned though, any website that relies heavily
on cookies for authentication remains vulnerable.

If you don’t have Greasemonkey installed, or you still use Internet Explorer, get used to typing “https://www.gmail.com”
to check your email — doing this will safeguard yourself from prying
eyes through network sniffing. If you have Firefox, you can install this Greasemonkey script to ensure your session always remains in “secure mode”.