Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Gmail to get previously unlisted e-mail addresses

blog.0day.rocks

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Abusing Gmail to get previously unlisted e-mail addresses

#41

Post by puddintane »

qb45 wrote: post #18
socket0 wrote: post #9

I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes famous.celebrity@gmail.com or controversial.journalist@gmail.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most impo…

To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be. The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates. Use it for Nigerian scams, Viagra ads, account…

This feature really grinds my gears. They should at least allow a feature to disable showing the picture/name until the user has logged in. In some cases I'm handing out my email to avoid handing out my actual identity because I don't want to be spammed or followed. Until then I will continue to use a false name and photo under my accounts signed up to google (apart from the one work email I have thru them).

Re: Abusing Gmail to get previously unlisted e-mail addresses

#42

Post by ggambetta »

puddintane wrote: post #41
qb45 wrote: post #18

Earlier quoted context omitted.

To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be. The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates. Use it for Nigerian scams, Viagra ads, account…

This feature really grinds my gears. They should at least allow a feature to disable showing the picture/name until the user has logged in. In some cases I'm handing out my email to avoid handing out my actual identity because I don't want to be spammed or followed. Until then I will continue to use a false name and photo under my accounts signed up to google (apart from the one work email I have thru them).

AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#43

Post by fixermark »

blincoln wrote: post #27
angry_octet wrote: post #22

Earlier quoted context omitted.

Username enumeration is useful against a system with 10 or 1000 accounts, but absolutely meaningless on a system with 1,000,000,000 regular users.

It can be useful in either case. It depends on what the attacker is trying to achieve. If they just want to get in as any user, then your hypothetical system with a billion regular users is going to be even easier, because if even a fraction of those can be enumerated, it's likely that at least some will be accessible using a password-spraying attack using one or two common passwords, or by cross-referencing with pas…

But if we're talking concretely about GMail here, the easiest way for someone to get in as "any user" is to create a GMail account.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#44

Post by puddintane »

ggambetta wrote: post #42
puddintane wrote: post #41

Earlier quoted context omitted.

This feature really grinds my gears. They should at least allow a feature to disable showing the picture/name until the user has logged in. In some cases I'm handing out my email to avoid handing out my actual identity because I don't want to be spammed or followed. Until then I will continue to use a false name and photo under my accounts signed up to google (apart from the one work email I have thru them).

AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in.

Thank you for this information - seems to be so - just tried a VPN from Canada and it only shows the email that I entered. However I still would like to disable it on the off chance that someone in the future messes up. May never happen but I'd like to not take that risk. Thank you none-the-less as that has eased my mind a little bit.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#45

Post by c8g »

qb45 wrote: post #18
socket0 wrote: post #9

I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes famous.celebrity@gmail.com or controversial.journalist@gmail.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most impo…

To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be. The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates. Use it for Nigerian scams, Viagra ads, account…

>Sometimes you will even see the profile pic

if it was your account

Re: Abusing Gmail to get previously unlisted e-mail addresses

#46

Post by JimDabell »

pavel_lishin wrote: post #28
blincoln wrote: post #25

Earlier quoted context omitted.

This is actually not difficult to address. Modify the account creation process so that the first step is to enter an email address. If the account does not already exist, an account activation link/code is sent. If it does, a password reset link/code is sent.

> If the account does not already exist, an account activation link/code is sent. That's not great for all use cases, though - if I'm just trying to check out of a store, I don't want to have to bounce to my email to confirm stuff.

If you're just trying to check out of a store, you don't have to sign up for an account at all. Or if you do want to create an account, you can have it as an optional step after you've placed the order.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#47

Post by qb45 »

ggambetta wrote: post #42
puddintane wrote: post #41

Earlier quoted context omitted.

This feature really grinds my gears. They should at least allow a feature to disable showing the picture/name until the user has logged in. In some cases I'm handing out my email to avoid handing out my actual identity because I don't want to be spammed or followed. Until then I will continue to use a false name and photo under my accounts signed up to google (apart from the one work email I have thru them).

AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in.

> AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in.

I didn't know about this feature, but I often saw pictures of people I know when I tried. Apparently, it seems that for example just sharing IP address is sufficient to trigger this reasonable confidence. Not sure what other ways there may be. But indeed, it didn't work for a few random strangers from LKML I just tried.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#48

Post by Liquid_Fire »

djhworld wrote: post #6
mkosmo wrote: post #4

Earlier quoted context omitted.

Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.

I guess the authors idea of 1. Checking if an email address exists 2. Running it against a known dump of leaked data, with passwords etc 3. Try logging in to google account with the leaked password, hoping the user reuses passwords Google encourages their users to use 2FA and has other measures to detect when logins are coming from unknown locations, so I guess they figured the risk of this was pretty low

If you have a leaked database dump with login details, you already have the email address in the dump. You don't need to exploit this to find it.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#49

Post by cryptarch »

shinratdr wrote: post #26
Xylakant wrote: post #20

Earlier quoted context omitted.

Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.

Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?

ISP email or any provider that doesn't ask for a secondary account, like Mail.com.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#50

Post by ggambetta »

qb45 wrote: post #47
ggambetta wrote: post #42

Earlier quoted context omitted.

AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in.

> AFAIK the picture is only shown if Google is reasonably confident that it is actually you trying to log in. I didn't know about this feature, but I often saw pictures of people I know when I tried. Apparently, it seems that for example just sharing IP address is sufficient to trigger this reasonable confidence. Not sure what other ways there may be. But indeed, it didn't work for a few random strangers from LKML I…

IP is a factor, but it's actually much more sophisticated than that :)
Post reply on HN