Google gears Gmail for PC hack attack
Over the past year, dozens of web-based services have adopted new features that allow them to be used even when an internet connection isn't available. The technologies making this possible may offer plenty of convenience, but they also make end users susceptible to powerful new attacks, a security researcher warns.
So-called offline web applications are springing up like weeds, thanks in large part to Gears, an open-source project spawned by Google that allows data normally stored on a webserver to be stashed instead on end users' computers. Last month, Gmail joined the party, allowing the masses to read and write email even when they're not connected to the interwebs.
Like almost all other offline web applications, offline Gmail works by creating the equivalent of a relational database on the client PC. The result: a single cross-site scripting (XSS) error or SQL injection vulnerability on the web server is all it takes to gain full access to the contents, says Michael Sutton, vice president of research at web security firm Zscaler. He plans to discuss his findings in detail on Wednesday at the Black Hat security conference in Washington.
:
