How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#1

Post by trendspotter » Wed, Oct 24, 2012, 11:31 AM UTC

"Harris wasn’t interested in the job at Google, but he decided to crack the key and send an e-mail to Google founders Brin and Page, as each other, just to show them that he was onto their game."

How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
wired.com

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#2

Post by jfc » Wed, Oct 24, 2012, 12:04 PM UTC

I hope this guy's inbox is full of job offers. That's a heck of a find.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#3

Post by pgsandstrom » Wed, Oct 24, 2012, 12:29 PM UTC

Dangerous move, other companies have would set the police on him for that stunt.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#4

Post by jere » Wed, Oct 24, 2012, 12:44 PM UTC

>But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.

Yes, I can see it now: Iran endures crushing sanctions in order to pursue spam email program.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#5

Post by clicks » Wed, Oct 24, 2012, 12:50 PM UTC

jfc wrote: post #2

I hope this guy's inbox is full of job offers. That's a heck of a find.

http://www.linkedin.com/in/drzacharyharris

Wow, the guy's a monster. Fluent in classical (and Levantine) Arabic, Chinese, Greek; Top Putnam score (twice), teacher, Christian missionary. Sounds like he's got drive.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#6

Post by Cogito » Wed, Oct 24, 2012, 12:58 PM UTC

Full article: http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-...

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#7

Post by DanBC » Wed, Oct 24, 2012, 12:59 PM UTC

> Harris thought there was no way Google would be so careless, so he concluded it must be a sly recruiting test to see if job applicants would spot the vulnerability. Perhaps the recruiter was in on the game; or perhaps it was set up by Google’s tech team behind the scenes, with recruiters as unwitting accomplices.

Ha! That's optimistic.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#8

Post by tptacek » Wed, Oct 24, 2012, 1:02 PM UTC

DKIM is an anti-spam mechanism. It does not authenticate the sender of an email message; to do that, use something like PGP. This is an interesting story, but it's not a story about a "massive net security hole". Mail on the Internet has always been spoofable.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#9

Post by seanica » Wed, Oct 24, 2012, 1:06 PM UTC

“A 384-bit key I can factor on my laptop in 24 hours,” he says. “The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those. Then there are the 768-bit keys. Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.”

"But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda.

Did you know this month is National Cyber Security Awareness Month, as advertized by the DHS?

http://www.dhs.gov/national-cyber-security-awareness-month

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#10

Post by jgrahamc » Wed, Oct 24, 2012, 1:18 PM UTC

Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be...