Message-ID: <CAFhH=Nae6DUp+ponrXVAUXmC2rk3Kuwyj_uG0LJCkyOkHqHz2Q@mail.gmail.com>
Date: Thu, 7 Jun 2012 09:54:20 +0200
From: Mike Hearn <hearn@...gle.com>
To: "Michael J. Gray" <mgray@...tcode.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Google Accounts Security Vulnerability

No, it isn't related.

The system described in this full-disclosure thread handles the case where
an attacker knows your password and is trying to get in, moreover, an
attacker has a long list of passwords and doesn't know or care much about
his victims beyond that. For example, the LinkedIn compromise has dumped a
large supply of passwords onto the market and when somebody tries to log in
to all of them, this system will try its best to stop them.

The CloudFare hack is based on manipulating account recovery. At no time
did the attacker know the users actual passwords. If you don't know the
users password, you cannot encounter the risk analysis/ID verification
system.

On Thu, Jun 7, 2012 at 4:26 AM, Michael J. Gray <mgray@...tcode.com> wrote:

> One of the events is identical to what I described. I'd call it related.
>
> -----Original Message-----
> From: Kyle Creyts [mailto:kyle.creyts@...il.com]
> Sent: Wednesday, June 06, 2012 12:51 AM
> To: Michael J. Gray
> Cc: Jann Horn; full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] Google Accounts Security Vulnerability
>
> To be clear, there doesn't appear to be a direct link between your report,
> and the activity noted in the CloudFlare notice.
>
> But one could speculate that your announcement and subsequent replies may
> have fostered thoughts in others about possible fail-open modes of
> authentication flows for Google Account activities.
>
> On Tue, Jun 5, 2012 at 7:32 PM, Michael J. Gray <mgray@...tcode.com>
> wrote:
> > I'm glad Google took the report so seriously and corrected the problem
> > before anyone could do anything scary with it. Oh wait...
> >
> > Thanks for the link Kyle.
> >
> > -----Original Message-----
> > From: Kyle Creyts [mailto:kyle.creyts@...il.com]
> > Sent: Tuesday, June 05, 2012 11:58 AM
> > To: Michael J. Gray
> > Cc: Jann Horn; full-disclosure@...ts.grok.org.uk
> > Subject: Re: [Full-disclosure] Google Accounts Security Vulnerability
> >
> > from full-disclosure to in-the-wild in less than 3 weeks
> > http://lists.grok.org.uk/pipermail/full-disclosure/2012-May/086850.htm
> > l to http://share.cloudflare.com/3g1X141s2s3J2G2Z0e0O
> >
> > On Tue, May 22, 2012 at 3:16 AM, Kyle Creyts <kyle.creyts@...il.com>
> wrote:
> >> Creating test accounts and reproducing this bug sounds like a
> >> responsible thing to do.
> >>
> >> On Sun, May 20, 2012 at 4:22 PM, Michael J. Gray <mgray@...tcode.com>
> > wrote:
> >>> That was a bit ambiguous and I apologize for that. I meant that I
> >>> had reproduced the issue several times, not created test accounts.
> >>> I'm willing to bet it's not just a few accounts being affected.
> >>>
> >>> -----Original Message-----
> >>> From: Jann Horn [mailto:jannhorn@...glemail.com]
> >>> Sent: Sunday, May 20, 2012 4:39 AM
> >>> To: Michael J. Gray
> >>> Cc: 'Thor (Hammer of God)'; 'Dan Kaminsky';
> >>> full-disclosure@...ts.grok.org.uk
> >>> Subject: Re: [Full-disclosure] Google Accounts Security
> >>> Vulnerability
> >>>
> >>> On Sat, May 19, 2012 at 12:04:43PM -0700, Michael J. Gray wrote:
> >>>> On why I don't want to provide my email address to Google:
> >>>>
> >>>> It's a different email address which I don't want associated with
> >>>> this email address for various reasons. That is why I am not going
> >>>> to provide
> >>> it.
> >>>>
> >>>> Your assumption that it's a simple piece of information and
> >>>> requires no effort to give out is correct, but the impact of the
> >>>> association is unwanted.
> >>>
> >>> Sounds reasonable.
> >>>
> >>>
> >>>> The fact that Google can create a test account and reproduce the
> >>>> issue (as I have now done several times) tells me that they want
> >>>> the account information for some other purpose or that they're just
> >>>> being
> > lazy.
> >>>
> >>> So, you now have a test account that doesn't reveal any secrets
> >>> about you and which is affected... so you could surely give Google
> >>> the name of that one?
> >>>
> >>> _______________________________________________
> >>> Full-Disclosure - We believe in it.
> >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >>> Hosted and sponsored by Secunia - http://secunia.com/
> >>
> >>
> >>
> >> --
> >> Kyle Creyts
> >>
> >> Information Assurance Professional
> >> BSidesDetroit Organizer
> >
> >
> >
> > --
> > Kyle Creyts
> >
> > Information Assurance Professional
> > BSidesDetroit Organizer
> >
>
>
>
> --
> Kyle Creyts
>
> Information Assurance Professional
> BSidesDetroit Organizer
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 

Mike Hearn | Senior Software Engineer |  hearn@...gle.com |  Account
security team

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists