It took me about 10 minutes to write a python script that grabs a list of recently expired domains and checks each domain to see if it's a valid Google Apps domain. This is a pretty serious issue, if indeed it's still possible to take ownership of accounts as the article suggests. Hopefully Google has added some mitigating steps to keep this sort of thing from happening.
Do not let your domain expire with Google Apps
21–30 of 70 posts
Re: Do not let your domain expire with Google Apps
#22Any idea if this applies for a domain that's an alias to your primary domain?
For example, if you have foo.com as your Google Apps domain, and you have foo.us as an extra domain that was aliased but then expired, does that expose the foo.com Google Apps account?
Re: Do not let your domain expire with Google Apps
#23Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
I think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it. The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
This isn't practical since any Apps admin account has by definition access to modify/reset all regular accounts belonging to that company/domain, so if you don't use things like wipeouts upon whois creation date modifications, the potential to expose a lot of private data from the former owner still exists.
Re: Do not let your domain expire with Google Apps
#24Any idea if this applies for a domain that's an alias to your primary domain? For example, if you have foo.com as your Google Apps domain, and you have foo.us as an extra domain that was aliased but then expired, does that expose the foo.com Google Apps account?
If Google Apps doesn't know about foo.us, then I think that answer would be no. (Though I would confirm this with someone more knowledgeable)
Re: Do not let your domain expire with Google Apps
#25It sounds like Google have changed their policies on this. Just a few months ago I was caught on the other side of this issue. Basically I bought a domain and wasn't able to get Google Apps set up because someone else had used it in the past. Here's the full story: http://www.onlineaspect.com/2010/11/12/issues_with_google_ap...
Thanks JoshFraser, I have appended a note to the blog post to check your comment on here. Although the Google Apps team may have altered their policies according to my blog post which I contacted them about 2 months ago. This issue is still a serious matter. I would have still been able to access the person's Amazon account using a wildcard email address. Although it does lessen the blow if a social engineer takes a…
> This issue is still a serious matter. I would have still been able
> to access the person's Amazon account using a wildcard email
> address.
Re: Do not let your domain expire with Google Apps
#26You have likely broken the law by accessing that Amazon account which was not yours, and now you blog about it. It might be a good idea to talk to a lawyer. not a legal advice
Good idea to talk to a lawyer? I'd wait until you're actually sued before wasting your time and money worrying about something so stupid. Most people aren't going to sue you if explain what you did (and why) and it's obvious you had genuine intentions.
Personally, I think that's naive. There are a lot of people that will overreact in the extreme. Especially since they've been caught with their pants down (even though they haven't been specifically outed by name).
Re: Do not let your domain expire with Google Apps
#27Earlier quoted context omitted.
I think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it. The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
This isn't practical since any Apps admin account has by definition access to modify/reset all regular accounts belonging to that company/domain, so if you don't use things like wipeouts upon whois creation date modifications, the potential to expose a lot of private data from the former owner still exists.
Maybe “account” is the wrong word. I think that the domain’s owner should be able to create an entirely new “instance” of Google Apps (with separate users and separate data), whereupon the old instance would be detached from domain.
An admin of the old apps instance should be able to get into it to access data, delete it, or attach it to a different domain name.
Re: Do not let your domain expire with Google Apps
#28Google's problem isn't in their authentication, it's in the whole idea that having a domain name now means I should have access to the previous google apps account. They're separate entities.
This is probably related to why google isn't able to move an apps account to a new domain (our real domain is just an alias to our google apps account on previous company name's domain).
Re: Do not let your domain expire with Google Apps
#29You have likely broken the law by accessing that Amazon account which was not yours, and now you blog about it. It might be a good idea to talk to a lawyer. not a legal advice
Good idea to talk to a lawyer? I'd wait until you're actually sued before wasting your time and money worrying about something so stupid. Most people aren't going to sue you if explain what you did (and why) and it's obvious you had genuine intentions.
Danger Will Robinson! Danger! As anybody who has recently decided to browse Sarah Palin's email can tell you, accessing a computer system to which one does not have legitimate access to with genuine intentions is still a federal crime and "It was easy to do!" is not a defense.
If you ever find yourself logged into someone else's account log out and, if you absolutely have to reproduce it, reproduce the attack against an account you have legitimate control over. (e.g. Register dummydomain.co, set up a Google apps account tied to it, transfer the domain, regain access to the Google apps account using nothing but the DNS settings to the transfered dummy domain. If this succeeds, you know you can compromise any account linked to a Google Apps email account on an expired domain -- you don't need to commit a federal crime to demonstrate this.)
Re: Do not let your domain expire with Google Apps
#30Making sure to renew your domain name is a good solution if you actually want to keep your domain. But what if you are done with that domain, and purposely let it expire? Is there a way to delete your Google Apps account entirely before letting the domain name expire, so the next person to register that domain can start from scratch with Google Apps, as if that domain had never been used before?
There is an option in the Google Apps cpanel: "Delete Google Apps for mintcake.com". Underneath which it reads: "You can close your Google Apps account and delete all user accounts and data associated with it." It's in Domain settings > Account information.