At GNUcitizen, Petko D Petkov has just blown a hole in Google's Gmail by showing "how someone can install a persistent backdoor within your GMail account and snoop onto all your conversations. I repeat, it is persistent. It is very critical and very unlikely that you will detect it unless you are an uber user."
xMoDx has responded with a useful roundup of recent Google security holes which include the Google Search Appliance, Blogspot, Picasa and Google's Urchin Analytics service.
Google also "won" MOSEB -- the Month of Search Engine Bugs -- with Google dorks strikes back, along with Microsoft's MSN Shopping.
The field is not without its funny side. One hacker demonstrated a hole with an example that "will make Gmail forward all new received emails to another email account, no user interaction required, well you just need to open a website while still logged to Gmail." Later, he added:
Update: Google fixed this issue, I'd like to ask the people that looked at the second poc to disable forwarding if you have not done so, I'm still getting ton of email.
The point is that if a hacker sets a Gmail filter with mail forwarding, this continues to work forever, even after the hole is fixed.
