Hackers has obtain Google certificate, could hijack Gmail accounts

Hackers have obtained a digital certificate good for any Google website from a Dutch certificate provider, a security researcher said.

Criminals could use the certificate to conduct "man-in-the-middle" attacks targeting users of Gmail, Google's search engine or any other service operated by the Mountain View, Calif. company.

"This is a wildcard for any of the Google domains," said Roel Schouwenberg, senior malware researcher with Kaspersky Lab, in an email interview Monday.

"[Attackers] could poison DNS, present their site with the fake cert and bingo, they have the user's credentials," said Andrew Storms, director of security operations at nCircle Security.

Man-in-the-middle attacks could also be launched via spam messages with links leading to a site posing as, say, the real Gmail. If recipients surfed to that link, their account login username and password could be hijacked.

Details of the certificate were posted on Pastebin.com last Saturday. Pastebin.com is a public site where developers -- including hackers -- often post source code samples.

According to Schouwenberg, the SSL (secure socket layer) certificate is valid, and was issued by DigiNotar, a Dutch certificate authority, or CA. DigiNotar was acquired earlier this year by Chicago-based Vasco, which bills itself on its site as "a world leader in strong authentication."

Vasco did not reply to a request for comment.

Security researcher and Tor developer Jacob Applebaum confirmed that the certificate was valid in an email answer to Computerworld questions, as did noted SSL researcher Moxie Marlinspike on Twitter. "Yep, just verified the signature, that pastebin *.google.com certificate is real," said Marlinspike.

Because the certificate is valid, a browser would not display a warning message if its user went to a website signed with the certificate.

It's unclear whether the certificate was obtained because of a lack of oversight by DigiNotar or through a breach of the company's certificate issuing website.

Schouwenberg urged the company to provide more information as soon as possible.

"Given their ties to the government and financial sectors it's extremely important we find out the scope of the breach as quickly as possible," Schouwenberg said. The situation was reminiscent of a breach last March, when a hacker obtained certificates for some of the Web's biggest sites, including Google and Gmail, Microsoft, Skype and Yahoo.

Then, Comodo said that nine certificates had been fraudulently issued after attackers used an account assigned to a company partner in southern Europe.

Initially, Comodo argued that Iran's government may have been involved in the theft. Days later, however, a solo Iranian hacker claimed responsibility for stealing the SSL certificates.

Kaspersky's Schouwenberg said "nation-state involvement is the most plausible explanation" for the acquisition of the DigiNotar-issued certificate.

"For one [thing], there's the type of information being looked for -- from Google users," said Schouwenberg. "This hints towards an intelligence operation rather than anything else. Secondly, this type of attack only works when the attacker has some control over the network, but not over the actual machine."

Others were more skeptical because of the claim that a single hacker pulled off the Comodo heist.

"I think it might still be a stretch to attribute this to the Iranian government," said Marlinspike on Twitter shortly before 4 p.m. ET. "We all know how that went last time."

The google.com certificate has not yet been revoked by DigiNotar -- the first step to blocking its use -- even though it was issued July 10.

Last March, browser makers, including Google, Microsoft and Mozilla, rushed out updates that added the stolen Comodo certificates to their applications' blacklists.

Storms said he expected Google to quickly update Chrome, and that Microsoft, Mozilla and other would do the same some time later. "I suspect that if asked [Microsoft and Mozilla] will also issue updates, as there is already a precedent," said Storms.

Offline Abilities now available on Gmail, Google Docs

After months of delay, Google this week will let people use Gmail, Google Docs, and Google Calendar even when they're offline, a key feature for making the company's cloud-computing vision more practical.

The company is a powerful proponent of the Web-based services, but the practical reality is there are plenty of times when Google's vision falls victim to the practical limits of Internet access. For Google's services to fully compete with Microsoft Office, it must work even in Internet dead zones like subways, airplanes, and rural regions.

And Google knows it. It's been testing the technology in-house and now is meeting its most recent summer deadline for release.

"Gmail, Calendar, and Docs are three of the key apps people really want to use," said Rajen Sheth, a Google group product manager. "This is something we really wanted to bring offline."

Offline Gmail lets people read and write messages (including with address autocompletion), respond to others' messages, apply labels and stars, and archive messages, said Alex Gawley, a Google senior product manager. Of course, none of the actions taken offline do anything outside a person's computer until a network connection is established and the software synchronizes with Google servers again.

The features work with Google Apps, the subscription service that combines Gmail, Google Docs, Calendar, and other services. And IT staff can install the features remotely on employee computers using Chrome's administrative policies.

Caveats
There are a lot of caveats, though, at this early stage of the process:

• The offline features initially will only be available to users of Google's Chrome browser, installed through the Chrome Web Store. Google does plan broader browser support when the others support necessary Web-app features, Sheth said.

• People will be able only to read word processing documents and spreadsheets. That means no editing of either and no use of presentations at all--again, for now. "The first priority is to get Docs' [feature to] read and write offline," Sheth said

• For offline Gmail, people will have to use a separate Web application, not the regular Gmail Web app. That means people will have to switch back and forth and use a different interface. The Web application got its start from the Gmail app for tablets and looks very similar.

• Offline Gmail stores about the last three to seven days' worth of e-mail, depending on how much people have, and all starred messages, but right now people can't set it so they can cache all messages, for example, from their boss or with a certain label.

• For offline calendars, people can read them offline and respond to RSVPs, but not create new calendar entries.

Gmail Offline is a separate Web app that runs only in Chrome for now. It stores about three to seven days' worth of messages right now and lets people read, write, and organize messages even when there's no Internet connection.

Naturally, though, the offline features fit into Google's plan of releasing technology then improving it as fast as possible.


Iterate often
"This is the first step," Sheth said. "We wanted to get something that meets core needs of users and then iterate."

Offline access also is critical to the success of Chromebooks, the laptops that use Google's browser-based operating system called Chrome OS. Without offline productivity apps, Chromebooks' utility drops significantly for those who plan to use it as more than a machine that stays put in an office or school.

The offline features will work with Chromebooks, Sheth said.

The Gmail Offline app, once installed, can be launched like any other Chrome app from Chrome's new-tab page. That app will be available today, Google said.

The offline access for Google Calendar and Google Docs is added directly to those Web applications, but isn't enabled until people check a box in the Calendar or Docs settings section. Those apps just need to be installed from the Chrome Web store then clicked once to enable. They're set to arrive gradually during this week, starting today.

Years ago, the company had enabled offline access to the applications using in-house technology called Gears. This time it's trying a different route that uses a variety of Web standards--some descended from Gears--but some proprietary elements of Chrome, at least for now.

Among the standards in use are IndexedDB, which is used to run the database that stores the data, and HTML5's App Cache, which lets the Web app run from a computing device, not just from the Web itself.

And necessary technology that's only in Chrome includes background pages, which lets the Gmail Offline app constantly keep in sync with a user's Gmail archive. Of course, that uses more memory.

Also on the road map: better offline mobile support.

"Mobile is a key area of investment for Google," Sheth said, pointing to apps for Gmail, Calendar, and Docs. "We're going to continue to evolve the mobile apps we have."

New in Labs: Gmail Preview Pane

Google just added a long-desired lab feature to Gmail: a preview window. Now Gmail can operate in a paned, widesceen-style view similar to Microsoft Outlook and the new Apple Mail. If you like having your messages list available even when viewing, this is a great feature to have.

Click the image above to see a larger version.

After you enable Preview Pane from the Labs tab in Gmail Settings you’ll see a toggle button in the top right corner of your message list, which lets you switch between preview and list views.

For those of you who have more vertical space you can also move the preview pane below your message list. You can enable this using the dropdown arrow next to the toggle button:

By default there is a 3-second delay in marking a conversation as read after previewing it. If that doesn’t feel natural to you, you can change the timing in the General tab of settings:

If you’d like to remove the new layout, simply return to Gmail Settings and disable the lab.

Gmail Hacks: Tips and Tricks You May Not Know

Google Mail is without doubt one of the most popular online email services. What makes it so interesting is not only the functionality that it provides out of the box but also its extensibility. The following article contains five Gmail tips and tricks that you may not know about:

Trick 1: Select multiple messages

Tired of clicking individual messages but don't want to select all of them? Select the first message in the set, hold the shift key, then select the last message of the set.

Trick 2: Bypass the blank message prompt

Do you send messages where the subject is the entire message? Then you're familiar with the prompt asking you if you're sure you want to send the message without text in the body. To bypass the prompt, type "EOM" or "(EOM)" at the end of the subject to tell Gmail that it's the end of message.

Trick 3: Use address aliases

Gmail doesn't offer traditional e-mail aliases, but you can add a "+" to the end of your username to create one. For example, messages sent to username+alias@gmail.com is sent to username@gmail.com. This can be useful for setting up filters or figuring out who's selling your e-mail address to spammers.

Trick 4: Dots or no dots, it's your username

Did you know that Gmail doesn't recognize dots as characters within a username? That means that if your e-mail address is username@gmail.com, then user.name@gmail.com and u.s.e.r.n.a.m.e@gmail.com are also yours.

Trick 5: Send & Archive at once

If you send messages and immediately archive the conversation, you can save yourself a step by adding a Send & Archive button. Go to the Labs section of your Mail Settings and enable the Send & Archive button.

So, how many of these tips and tricks did you already know?

How to Configure Gmail With A Desktop Mail Client

We love using Gmail.com for its many features, but if you want offline access and a more "desktop-like" experience, you can get your Gmail messages delivered to a desktop client, like Outlook or Apple Mail. Here's how.

Every mail client is a little bit different, so we can't show you every way to set up Gmail, but in general, it should be pretty similar. Some programs will set up Gmail automatically with just your username and your password, while others will require you to set them up manually. If you have a Google Apps account (that is, if you're using Gmail but your email is not an @gmail.com email address), you'll also have to do it manually. Here are a few examples using the most popular email clients.

Initial Setup (for All Clients)

Before you do anything, you'll need to enable IMAP in Gmail, which will let you access your accounts on the desktop. To do this, head into Gmail's Settings and go to the Forwarding and POP/IMAP tab. Scroll down to the IMAP section and enable IMAP. Then save your changes, and open up your desktop email client of choice to set it up using the following instructions.

Set Up Gmail in Microsoft Outlook

To set up Gmail in Microsoft Outlook (we'll be using Outlook 2010 for this demonstration), open up Outlook and run through the following steps:

• Head to File > Account Settings > Account Settings. Click the New button to create a new account.
• Click on the "Manually configure server settings" radio button at the bottom of the new account window. Then, hit Next.
• Choose Internet Email at the next screen and hit Next.
• Type in your name and Gmail address under "User Information. Change your Account Type from POP3 to IMAP, and add imap.gmail.com as your Incoming Mail Server. Type in smtp.gmail.com as your Outgoing Mail Server.
• Type in your full Gmail address (i.e. whitson@gmail.com) and password under Logon Information.
• Hit the More Settings button and go to the Advanced tab. Under Incoming Server, type 993 and set your encryption from "None" to "SSL". Under Outgoing Server, type 587 and set your encryption to TLS.
• Head to the Outgoing Server tab of the same window and check the box that says "My outgoing server requires authentication". Hit OK, and hit Next to complete your account setup.

If all goes well, Outlook should send a test message, and let you know that your account was successfully set up! Check out the video above to see this process in action.

Set Up Gmail in Apple Mail

To add a new account in Apple Mail:

• Head to Mail > Preferences in the menu bar and go to the Accounts tab. Hit the plus sign in the bottom left corner to add a new account.
• Type in your Name, full Gmail address, and password and hit Continue. If you're using an @gmail.com address, you're probably done—Mail should fill in the rest of the settings for you. If you're using a Google Apps account, you'll need to do a few more things.
• On the next window, choose IMAP as your Account Type, type in a description (something like "Gmail"), and type imap.gmail.com. Change your username to your full Gmail address and type in your password. Click Continue.
• On the next screen, type a description, type smtp.gmail.com as your Outgoing Mail Server, and check the Use Authentication. Click Continue, and click Continue on the next screen as well. Hit Create to take the account online.

When you're done, Mail should start downloading all your messages to your inbox, and you'll be ready to read all your email right from the desktop. Check out the video above to see this process in action. Note that Mail doesn't automatically use Gmail's Sent, Spam, or Trash folders—it'll create its own, which can be annoying. To fix this, just select Gmail's Sent Mail folder, then go to Mailbox > Use This Mailbox For > Sent in the menu bar. Repeat this process for Trash and Junk, too, to make sure all your folders sync up.

Set Up Gmail in Mozilla Thunderbird

Setup in Mozilla Thunderbird is pretty much the same as in Apple Mail. To add Gmail to Thunderbird:

• Head to Tools > Accounts, and at the bottom of the window that pops up, click the Account Actions drop-down. Hit "Add Mail Account".
• Type in your name, email address, and password and click Continue. Thunderbird will try to set up the account automatically. If it fails to do so, hit the "Manual Setup" button.
• In the sidebar, find the account you just created and click on Server Settings. Type in imap.gmail.com for your Server Name, type 993 for your port, and make sure your username is your entire Gmail address. Under Connection Security, pick SSL/TLS and pick Normal Password as your Authentication Method.
• Hit OK to finish the account creation process.

Once Thunderbird imports your account, you'll be able to send and receive mail right from your desktop.

If you're using a mail client different from one of the above, the setup shouldn't be too different—just make sure you're typing in your full Gmail address as your username, and that you're using the correct ports and encryption types as described above in the account settings.

Gmail Redesign: It's Light and Simple but looks good

If you’re feeling daring, Google is offering users the chance to take the new, redesigned Gmail for a test drive ahead of its full-on rollout. And the first thing many people are going to notice: the new e-mail interface has a lot in common with Google+ (Google Plus).

Google’s “New Look” overview website, which is going to be detailing the cosmetic changes hitting the search giant’s services over the next little while, has the full instructions for how to activate the “Preview” and “Preview (Dense)” themes. But essentially, you just activate one or the other under the “Themes” tab in Gmail’s Settings and off you go.

So why two Preview themes? Well, Google says in its blog entry that eventually, the new-look Gmail will automatically adjust how much information is packed onto the screen based on the display resolution and other factors. But for now, it’s a manual switch. Moreover, you can switch between old Gmail and the new design at will until Google is ready for the full rollout, at which point it will become the default.

Overall, the new Gmail design looks very polished, with that same overall minimalist, appealing design that’s drawn praise from early users of Google+. The caveat, for now, is that some Google Labs features may not display quite correctly in this early version, but fixes are promised, along with updated versions of some of the other Gmail themes.

On a final note, the promised Google Calendar updates are apparently close enough to ready that users will start to see that redesign, with similar design principles, go live over the next couple of days, so keep an eye out.

Gmail: How To Secure your Gmail account

Google recently learned a lesson in security when it found that hundreds of user e-mail accounts, including ones belonging to U.S. and Chinese government officials, had been hacked.

Hackers are professionals in their field who prey on unknowing (and sometimes even tech-savvy) individuals. With the rise in hacks recently, it's time to check to see if your Gmail account is secure.

Below you'll find five best practices for securing your Gmail account. Each one is free, built into Gmail, and easily configured.

1: Enable two-step verification

All that hackers need to access your Google account (including YouTube, Gmail, and Blogger) is your password, which they can acquire with a phishing scam or when you accidentally expose your password. To address this issue, Google now offers two-step verification, in which Google will send you an SMS with a special code that you enter as the second part of the log-in process.

2: Be a password strategist

When choosing a password, there are two things you should be doing. First, choose a password that is unique to your Gmail account--don't use it for any other service. Once you've chosen a password, head to Password Meter to check its strength.

3: Enable HTTPS security

If you access Gmail over an unsecured network--as at a cafe, library, or shop--you instantly become vulnerable to hackers. Make sure you're browsing public Wi-Fi safely, and that you're using Gmail with HTTPS security. To enable HTTPS, sign in to Gmail and go to Mail settings (upper right) > General. Set "Browser Connection" to "Always use HTTPS."

4: Update your backups

Sign in to Gmail and head to Account settings (upper right) > Accounts and Import > Change password recovery options. Here, you can add an e-mail address, a phone number, and a security question you can use to recover your account if a hacker changes your password.

5: Check account activity

It could be that a hacker (or an ex-girlfriend) is accessing your account without your knowledge. To check, sign in to your Gmail account and go to the bottom of the page. You'll see a line that says "Last account activity..." At the end of this line, click "Details" and you'll see when, how, and where your account is being used. If you suspect any unkosher activity, immediately change your password and security questions, and enable two-step verification.