IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Gmail app hack: Why it's unlikely to derail your BYOD plans

Davey Winder takes a closer look at last week's news about the 92 per cent success rate of the Gmail app hack

BYOD

I'm not playing Buzzword Bingo this week, but I am going to mention BYOD (or Bring Your Own Device, if you prefer) and - as enterprises around the globe will testify - plenty of people do.

The explosion in using consumer devices in the workplace should not have caught anyone by surprise. When such devices catch up with, and in many cases surpass, business kit in terms of sheer power, flexibility and cost, then BYOD becomes a no-brainer. This is a good phrase, as it also sums up what appears at first glance to be some very worrying security news that broke this time last week.

The story claims the mobile Gmail app can be hacked with an impressive 92 per cent success rate. The fact research scientists at a couple of US universities have demonstrated a method by which it's possible, across Android, iOS and Windows platforms no less, to obtain personal data including passwords is surely a nail in the coffin of BYOD?

I'm not convinced, despite the shared-memory side channel-using 'UI state interference attack' being technically very interesting indeed. My 'meh' mode is activated because, practically speaking, it's much less interesting.

Here's the lowdown: a user downloads multiple apps, they all run on the same shared platform, and it's possible for one of those apps to employ that memory side-channel which is found in just about every GUI to access the others.

It was possible to do this 92 per cent of the time with Gmail. Shocking stuff huh? Not as shocking as the detail of what is actually required to get this to work.

First, the app that allows this to happen has to be installed. That's an unsigned app, and one that's carrying malicious code. The kind of app that would be prohibited by any half-decent enterprise BYOD policy, and avoided by any half-brained employee who wanted to keep their job.

However, even allowing for the fact such an app may get installed via a rogue app store or  by an idiot user, even then attack success is not a given.

Secondly, on the 'things that are required for this exercise in intellectual masturbation to work' list is the attack would have to take place at the precise, exact, same moment the user was performing the action to be accessed using the target app.

Throw in the third requirement, that all of this is done without user knowledge at any point, and it becomes startlingly clear that in the real world (outside of the rubber walls of the research labs) it's an attack that is very unlikely ever to be successfully pulled off.

This reminds me of something very similar that I was writing about back in 2012, for our sister publication Cloud Pro, under the title of 'Cryptography attack: side-channel cloud threat is all nerd and no knickers.'

Although the side-channel threat is obviously made a lot easier on a mobile device, with regards to the requirement to be running on the same platform at the same time, I stand by the gist of what I said back then. Namely, that if you are an enterprise which follows basic security best-practice strategies, including BYOD policy implementation, then you can move on as there's really nothing to see here except fear, uncertainty and doubt.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

North Korean-linked Gmail spyware 'SHARPEXT' harvesting sensitive email content
Security

North Korean-linked Gmail spyware 'SHARPEXT' harvesting sensitive email content

4 Aug 2022
Gmail vs Outlook.com: Which one is better?
email providers

Gmail vs Outlook.com: Which one is better?

13 Jul 2022
How to delete a Gmail account
email providers

How to delete a Gmail account

15 Jun 2022
How to share your Google Calendar
email providers

How to share your Google Calendar

11 Feb 2022

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Microsoft successfully tests emission-free hydrogen fuel cell system for data centres
data centres

Microsoft successfully tests emission-free hydrogen fuel cell system for data centres

29 Jul 2022