Gmail app hack: Why it's unlikely to derail your BYOD plans

Davey Winder takes a closer look at last week's news about the 92 per cent success rate of the Gmail app hack


I'm not playing Buzzword Bingo this week, but I am going to mention BYOD (or Bring Your Own Device, if you prefer) and - as enterprises around the globe will testify - plenty of people do.

The explosion in using consumer devices in the workplace should not have caught anyone by surprise. When such devices catch up with, and in many cases surpass, business kit in terms of sheer power, flexibility and cost, then BYOD becomes a no-brainer. This is a good phrase, as it also sums up what appears at first glance to be some very worrying security news that broke this time last week.

Advertisement - Article continues below

The story claims the mobile Gmail app can be hacked with an impressive 92 per cent success rate. The fact research scientists at a couple of US universities have demonstrated a method by which it's possible, across Android, iOS and Windows platforms no less, to obtain personal data including passwords is surely a nail in the coffin of BYOD?

I'm not convinced, despite the shared-memory side channel-using 'UI state interference attack' being technically very interesting indeed. My 'meh' mode is activated because, practically speaking, it's much less interesting.

Here's the lowdown: a user downloads multiple apps, they all run on the same shared platform, and it's possible for one of those apps to employ that memory side-channel which is found in just about every GUI to access the others.

Advertisement - Article continues below

It was possible to do this 92 per cent of the time with Gmail. Shocking stuff huh? Not as shocking as the detail of what is actually required to get this to work.

Advertisement - Article continues below

First, the app that allows this to happen has to be installed. That's an unsigned app, and one that's carrying malicious code. The kind of app that would be prohibited by any half-decent enterprise BYOD policy, and avoided by any half-brained employee who wanted to keep their job.

However, even allowing for the fact such an app may get installed via a rogue app store or  by an idiot user, even then attack success is not a given.

Secondly, on the 'things that are required for this exercise in intellectual masturbation to work' list is the attack would have to take place at the precise, exact, same moment the user was performing the action to be accessed using the target app.

Throw in the third requirement, that all of this is done without user knowledge at any point, and it becomes startlingly clear that in the real world (outside of the rubber walls of the research labs) it's an attack that is very unlikely ever to be successfully pulled off.

Advertisement - Article continues below

This reminds me of something very similar that I was writing about back in 2012, for our sister publication Cloud Pro, under the title of 'Cryptography attack: side-channel cloud threat is all nerd and no knickers.'

Although the side-channel threat is obviously made a lot easier on a mobile device, with regards to the requirement to be running on the same platform at the same time, I stand by the gist of what I said back then. Namely, that if you are an enterprise which follows basic security best-practice strategies, including BYOD policy implementation, then you can move on as there's really nothing to see here except fear, uncertainty and doubt.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


email providers

How to share your Google Calendar

8 Jul 2020

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The road to recovery

30 Jun 2020