Google Groups e-mail disclosure in plain text

[n3td3v <n3td3v () gmail com>]

Vendor:
Google Inc (GOOG).

Service:
Groups.

Description:
Google has an archive of Usenet since 1981 on its network. However,
Google decided to build a new Groups interface known as Google Groups
2 or GG2 for short.

Issue:
Bot network harvesting of e-mail address in plain text via web
interface headers.

Steps Google already take to prevent plain text e-mail disclosure:
Google obscure an e-mail address in message headers via web interface.

Google allow you to view an e-mail address in plain text via word
verification system -only, via the web interface.

Problem:
Google forgot to add obscurity measures for forwarded messages, and so
an e-mail address is readable via web interface headers,  in plain
text.

See here for further info:
http://groups.google.com/group/Groups-Suggestions/browse_thread/thread/d46a06d9d9fac8ef/9425615a2859ec6f#9425615a2859ec6f

How long n3td3v has know about this issue:
Since 2004, when GG2 was launched in beta format.

Why wait:
Because I was hoping this easy to fix issue would be sorted by now,
but its not been, so I issued an advisory last night via the official
GG2 group, to make the GG2 team 100% fully aware of the problem.

History:
#1 n3td3v released cross-site scripting vulnerability for Google
Groups browse thread in December 2004 (This attack targeted the
general public.)
#2 n3td3v released cross-site scripting vulnerability for Google
Groups pending message December 2005 (This attack targeted owner and
moderators only.)
#3 n3td3v released sender e-mail in plain text vulnerability for
Google Groups forwarded message April 2006
(This attack targeted the general public)

Credit:
n3td3v

Personal:
I'll see you next time Google!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/