Here is a demonstration by Sandro Gauci of the Surf Jack attack being performed on Gmail. It also shows how Google's Gmail can be prevented from being vulnerable to this attack by selecting the "always use https" option.

net-security.org/secworld.php? ...

Covered at EnableSecurity Blog too,
link
enablesecurity.com/2008/08/11/ ...