I stole the data in millions of people’s Google accounts
ethanblake4.medium.com
I stole the data in millions of people’s Google accounts
1–10 of 21 posts
Re: I stole the data in millions of people’s Google accounts
#2EDIT: should have finished reading the article!
Re: I stole the data in millions of people’s Google accounts
#3Spoiler, because clickbait headlines are disingenuous and annoying:
> As many of you may have suspected, this post is not entirely truthful. I have not released this fitness app onto the Play Store, nor have I collected millions of master tokens. ... But yes, these methods do work. I absolutely could release such an app, and so could anyone else (and maybe they have).
Re: I stole the data in millions of people’s Google accounts
#4Would like to know your results if you submitted this to the bug bounty program. Maybe put that at the top?
Re: I stole the data in millions of people’s Google accounts
#5EDIT: should have finished reading the article!
The name doesn't matter if you keep reading.
Re: I stole the data in millions of people’s Google accounts
#6The meat of this story is that, instead of showing the Google oauth flow which would say “sign in to continue to ” with the list of permissions shown to the user, he embedded a web view that is actually a URL for setting up a new android device. This is exactly the reason Google is doing things like restricting embedded browser sign-ins[0], which HN was particularly critical about[1].
0: https://9to5google.com/2019/04/18/google-block-man-in-the-mi...
Re: I stole the data in millions of people’s Google accounts
#7Would like to know your results if you submitted this to the bug bounty program. Maybe put that at the top?
This type of attack is already known, so it wouldn't be eligible for any kind of bounty. It is why Google is switching to disallowing auth from embedded browsers, and only allowing known-good + standards-compliant browsers to do auth instead.
Re: I stole the data in millions of people’s Google accounts
#8Would like to know your results if you submitted this to the bug bounty program. Maybe put that at the top?
Is it a bug?
Arguably, everything here is working as intended.
Re: I stole the data in millions of people’s Google accounts
#9This isn't even a vulnerability. Mobile applications should be using the system browser, not a WebView. This blog post is proud of abusing the users trust. I can also make an application which opens an OAuth page to a fake-google.com which looks exactly like Google. I guess you can still trick Grannies with his app.
Finally the author admits... > Nothing I did would technically be considered an ‘exploit’
and of course, admits he lied about the title and multiple sentences in his blog... > As many of you may have suspected, this post is not entirely truthful.
Poor form.
Re: I stole the data in millions of people’s Google accounts
#10Great article and very clever. Luckily I never use SSO providers to log anywhere precisely because of issues like this. Since Safari remembers all my accounts anyway I have little reason to use Google or something else to log myself everywhere in.