G-Archive Steals your Gmail Password

[talkgold]

This weekend news came that a Gmail archive service called G-Archiver, which backs up all of your Gmail emails to your hard drive, was actually the front for a scam - hard coded into the application was a “feature” that sent every user’s email address and password to the creator’s own email account, giving him access to all of their Gmail messages.

These users should have known better than to type their email credentials into a third party service, so sympathy levels are at a minimum. But there is a much bigger problem to consider. Gmail is the entry point into a vast array of Google office services - including Google Docs and Google Apps. Those services allow users to share documents with others. If one user’s email credential become compromised, all of those sensitive documents become available to the bad guys, too. So if a single user’s credentials become known, the business they work for is at risk.

That has led a number of experts to conclude that Google Apps can never be a real threat to Microsoft Exchange and Sharepoint. All of the sensitive business information of a company, if stored on Google’s servers, is just a password guess, or in this case what is effectively a phishing scam, away.

[Tdinoz]

Was reading a blog article and the associated comments about this earlier.

Prior to that I hadn't heard of it. Still reading ...