Abusing Gmail to get previously unlisted e-mail addresses
blog.0day.rocks
Abusing Gmail to get previously unlisted e-mail addresses
1–10 of 51 posts
Re: Abusing Gmail to get previously unlisted e-mail addresses
#2Thanks Google :( I think they should at least put a rate limiter to that endpoint.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#3Thanks Google :( I think they should at least put a rate limiter to that endpoint.
Nah, it's not a security bug, that means we can exploit it.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#4Thanks Google :( I think they should at least put a rate limiter to that endpoint.
Nah, it's not a security bug, that means we can exploit it.
Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#5Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
Re: Abusing Gmail to get previously unlisted e-mail addresses
#6Earlier quoted context omitted.
Nah, it's not a security bug, that means we can exploit it.
Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.
I guess the authors idea of
1. Checking if an email address exists
2. Running it against a known dump of leaked data, with passwords etc
3. Try logging in to google account with the leaked password, hoping the user reuses passwords
Google encourages their users to use 2FA and has other measures to detect when logins are coming from unknown locations, so I guess they figured the risk of this was pretty low
Re: Abusing Gmail to get previously unlisted e-mail addresses
#7This isn't an issue, you can do the same thing with the main login form and a number of undocumented APIs. I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue and I don't see why Google should be the first.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#8Earlier quoted context omitted.
Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.
I guess the authors idea of 1. Checking if an email address exists 2. Running it against a known dump of leaked data, with passwords etc 3. Try logging in to google account with the leaked password, hoping the user reuses passwords Google encourages their users to use 2FA and has other measures to detect when logins are coming from unknown locations, so I guess they figured the risk of this was pretty low
Agreed, a popped account is a bad thing, especially if it's published as such. A larger risk would be somebody popping one of the compromised-credential repositories. Then you've got both username and password. But here we're effectively seeing a slow-scale brute force...
Everybody should enable 2FA, and use the strongest 2FA you can. Buy a yubikey or other U2F key and use it for everything possible. And webdevs, please start supporting U2F in addition to RFC 6238 TOTPs. It's really not that hard.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#9I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes famous.celebrity@gmail.com or controversial.journalist@gmail.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most importantly, I don't learn anything I couldn't have learned by sending messages to every likely permutation of famous.celebrity@gmail.com. This won't teach me anything particularly useful for spearfishing, as I'm just throwing out a net hoping something gets caught.
Re: Abusing Gmail to get previously unlisted e-mail addresses
#10This isn't an issue, you can do the same thing with the main login form and a number of undocumented APIs. I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue and I don't see why Google should be the first.
There's a difference between being able to do that 10 times or 40.000 times in an hour.