Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Is the Gmail activity log still missing activesync as described in this blog post? As it is "someone with my credentials could be reading and sending [email] messages with my account" without that access being reported via the log.

share|improve this question
4  
Lance - can you add some more context to your question. – Rory Alsop♦ May 6 '11 at 17:34
I suppose the question is about whether the mentioned bug in the blog post has been fixed or not. The wording could be improved. – john May 9 '11 at 20:38
To be fair, can you compare this to any other free online email services that offer https security and auditing of access to your email account? – nealmcb May 9 '11 at 22:05
Of course not, but this subtle bug effectively disables the auditing functionality and hence leads to a false sense of security, which (in some cases) may be worse than not having auditing. Anyway I reported it a while ago but I guess they already know it. – john May 9 '11 at 22:10

1 Answer

up vote 3 down vote accepted

I did some testing, using my windows mobile phone & activesync. The Activity Log, indeed does not log anything, only when just receiving mails. But whenever you do some change that can lead to an update operation, then it logs this attempt.

Say for example I initiate a sync operation and 10 messages are downloaded on my mobile as soon as the activesync finishes - 7 I have already read on my PC and 3 new unread. This sync operation does not get logged in the Activity Monitor.

If I read one of the already read mails, and then sync, again it is not logged.

But I read one of the unread mails, and thus change its state, the next sync operation is logged (with name "Mobile"). The same happens if I send a mail - the sync gets logged.

So to sum up, a clever attacker that has stolen credentials can read all the emails of a person, without being noticed, by manipulating the active sync queries so no updates are sent, or by changing the state of the mails back to unread after reading them.

share|improve this answer
OMG! security hole? :P – LanceBaynes May 10 '11 at 10:33
Seems like plausibly reasonable behavior -- it has the benefit of avoiding spamming the activity logs. – D.W. May 11 '11 at 0:54
If you consider that POP or IMAP accesses get logged, then it is a 'bug'. – john May 11 '11 at 9:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.