Webmail accounts hacked via WLAN

It has been recognised for some time now that it is a bad idea to check your emails through an unencrypted WLAN hotspot. If the information is unencrypted, an attacker can, for example, hijack the log-in information for webmail or POP3 accounts. However, this can be accomplished with even less effort, as demonstrated by Robert Graham of Errata Security at the Black Hat Conference. In order to hijack a Gmail account, for example, an attacker can simply read the connected victim’s cookies and use this information for logging in later. It is thus no longer necessary to find out the login name and password.

(more...)