David Airey has lost his domain after his Gmail account was hacked by a hacker. But how did the criminal can take down David’s domain? You can read the full story here but if you want to know how the attacker did it, please read on.
First, the victim login to his Gmail account as normal. Then he visit to a website which contains a script that exploiting the vulnerability in Gmail. This script will create a new filter in the victim’s email. Like in the example above, the script creates a filter that will forward any email that has attachment to firstname.lastname@example.org.
But how about if the filter is set to forward all incoming emails to the attacker email? Do you will happy losing all your secret and passwords to the attacker? Of course you are not.
I have checked my filter settings in Gmail. Know what? There is a filter that forward incoming emails to *@colmac.com. I was shocked and removed it immediately. I do not know since when the filter was added and how many emails the guy at colmac.com had read. I hope they are happy what they are doing.
If you using Gmail, check your Gmail filters now. Who knows, maybe you are lucky and get strange filters in your Gmail settings. However, Google has fixed this problem but you are still be advised to check your filter settings.
Google GMail E-mail Hijack Technique [via GNUCITIZEN]