This is why we need U2F.
I stole the data in millions of people’s Google accounts
11–20 of 21 posts
Re: I stole the data in millions of people’s Google accounts
#12[deleted]
Re: I stole the data in millions of people’s Google accounts
#13All this blog post does is highlight why you shouldn't trust WebViews.
Re: I stole the data in millions of people’s Google accounts
#14The title isn't truthful to the content. @dang, can you please change it? Should be something along the lines of "how to steal data from Google accounts." As the author states waaay down in the article, they didn't actually do it, they're merely showing how.
Re: I stole the data in millions of people’s Google accounts
#15Would like to know your results if you submitted this to the bug bounty program. Maybe put that at the top?
These type of attacks are already known and out of scope for the bounty.
Users giving their password on random popups asking for it is not something google can control.
Re: I stole the data in millions of people’s Google accounts
#16Even though the post is a bit clickbaity there is still one thing I learned from it and if somebody cyber security expert can confirm this:
- there exists a powerful token (like a master key) using which a person can read all my emails, drive, etc bypassing the email alert and unknown device check?
Re: I stole the data in millions of people’s Google accounts
#17This isn't even a vulnerability. Mobile applications should be using the system browser, not a WebView. This blog post is proud of abusing the users trust. I can also make an application which opens an OAuth page to a fake-google.com which looks exactly like Google. I guess you can still trick Grannies with his app. Finally the author admits... > Nothing I did would technically be considered an ‘exploit’ and of cours…
This is a poor rebuttal.
>Mobile applications should be using the system browser, not a WebView
Maybe honest ones, however there is no reason a dishonest app that is trying to steal your Google account should stick to best practices.
>I can also make an application which opens an OAuth page to a fake-google.com which looks exactly like Google
You have ignored the part about bypassing Google's IP and location based fraud detection. Your idea wouldn't work.
Re: I stole the data in millions of people’s Google accounts
#18This is why we need U2F.
What's clever here is that it hijacks a full, legitimate login (including asking for the second factor, using proper IP addresses et al) then gains the full access token.
Doesn't matter what security the user has added: if they are willing to type their credentials into a web view they lose their trust.
Re: I stole the data in millions of people’s Google accounts
#19This isn't even a vulnerability. Mobile applications should be using the system browser, not a WebView. This blog post is proud of abusing the users trust. I can also make an application which opens an OAuth page to a fake-google.com which looks exactly like Google. I guess you can still trick Grannies with his app. Finally the author admits... > Nothing I did would technically be considered an ‘exploit’ and of cours…
What do you suggest? Lock down allowed webview like iOS, killing actual browsers?
Re: I stole the data in millions of people’s Google accounts
#20Even though the post is a bit clickbaity there is still one thing I learned from it and if somebody cyber security expert can confirm this: - there exists a powerful token (like a master key) using which a person can read all my emails, drive, etc bypassing the email alert and unknown device check?
If you mean the one that's used on your phone to access everything, yes, although it doesn't bypass the email alert (the linked clickbait goes into how they have to click "allow device" on their already-signed-in phone). When you log into either the Google.com website or into an Android device your token needs permission to do everything you'd expect to do as a user - gmail, drive, etc. This attack is basically a browser MITM which captures that token and (theoretically) ships it off to a server for malicious usage/storage.
Or, if you mean "can Google employees read my email", then they can since almost no Google service is end-to-end encrypted (although you can e2ee Chrome sync[0]). Gmail, Drive, and Docs are completely unencrypted unless you use encryption on top of it (like with rclone[1] or cryptomator[2]).
0: https://support.google.com/chrome/answer/165139?co=GENIE.Pla....
1: https://www.section.io/engineering-education/encrypting-gdri...