GMail Contact List Exploit :(

POSTED 02/18/2006 UNDER Suckage

Someone I had chatted with via email a few months ago apparently got some spam about "online bingo", clicked on the "unsubscribe" link, and it then exposed their entire gmail address contact list.

According to this post, through some Javascript trickery the entire contact list can be harvested by a spammer if you click on a special link.

I'm not sure if this has yet been patched or if this even was the method of attack (it's apparently pretty old, and Google has a reputation of fixing stuff quickly)...but in general don't be clicking any strange links on strange emails. Please.

Comments

1. e said on 02/18/2006 11:36AM...

It’s more insideous than that: if the user is browsing with the same browser that’s logged into GMail, and they go to a site with the malcode on it, their account can be attacked. They don’t have to follow a link from GMail, as far as I can tell.

——-

2. kartooner said on 02/19/2006 07:08AM...

Very creepy. Let’s hope they patch this up quickly!

3. biru said on 02/20/2006 09:56AM...

This person should not have clicked ANY link found in spam. Gmail has a ‘report spam’ button, use that instead.

4. CarlenLea said on 02/22/2006 08:02AM...

biru is right—their first mistake was clicking on an unsubscribe link in a spam. At best, it just confirms your email address for the spammer. At worst, it unleashes a virus.

5. casin sicuri said on 10/27/2007 04:34AM...

Your website is beautifully decorated and easily navigated. I have enjoyed visiting this site today and hope to visit many more times in the future.