Re: [Full-disclosure] Google Accounts Security Vulnerability

[Jason Hellenthal <jhellenthal@xxxxxxxxxx>]

LMFAO!

On Sat, May 12, 2012 at 04:22:30AM -0700, Michael J. Gray wrote:
> Effective since May 1, 2012.
> 
> Products Affected: All Google account based services
> 
>  
> 
> Upon attempting to log-in to my Google account while away from home, I was
> presented with a message that required me to confirm various details about
> my account in order to ensure I was a legitimate user and not just someone
> who came across my username and password. Unable to remember what my phone
> number from 2004 was, I looked for a way around it.
> 
> The questions presented to me were:
> 
>     Complete the email address: a******g@xxxxxxxxx
> 
>     Complete the phone number: (425) 4**-***7
> 
>  
> 
> Since this was presented to me, I was certain I had my username and password
> correct.
> 
> >From there, I simply went to check my email via IMAP at the new location.
> 
> I was immediately granted access to my email inboxes with no trouble.
> 
>  
> 
> >From there, I attempted to log-in to my Google account with the same
> username and password.
> 
> To my surprise, I was not presented with any questions to confirm my
> identity.
> 
> This completes the steps required to bypass this account hijacking
> counter-measure.
> 
>  
> 
> This just goes to show that even the largest corporations that employ teams
> of security experts, can also overlook very simple issues.
> 

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


-- 

 - (2^(N-1))

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/