4 ms·

Google's response _The attack presupposes a compromised password, and the actual vulnerability appears to lie in the fact that the Telcos provide inadequate pro

by kabdib 12y ago

Google's response _The attack presupposes a compromised password, and the actual vulnerability appears to lie in the fact that the Telcos provide inadequate protection of their voicemail system. Please report this to the telcos directly._ ... is reprehensible. It's a problem with the design as a whole, Google's customers are going to experience the flaw, and just passing the buck doesn't make the problem go away. I'm really disappointed in Google.

izacus 12y ago
Why? How is that a Google problem, when you use voice as your backup password system and you're not securing it properly?
- pygy_ 12y ago
  Most people are not aware of the attack vector (spoofing the phone number to reach the voice mail).
- ilyanep 12y ago
  As a large company that serves millions of users in many of their most sensitive online endeavors, is it more responsible to throw your hands up and hope that many of the hundreds of telcos out there will fix their own security, or implement a relatively easy fix that will automatically secure all of your customers from this issue regardless of third-party security?
csense 12y ago
The entire point of 2FA is to make password compromise insufficient to gain access to an account. Which makes this response just baffling. I initially thought that the lack of any technical countermeasure might be a legitimate reason for Google to do nothing, but after I thought about it for a moment, I realized that when the 2FA system calls the user, it could simply prompt the user to do something before sending the verification code -- that way, the 2FA provider knows they aren't sending the code to voicemail. Simple and effective, and later in the post I found the author and multiple companies came up with that idea on their own.
- anaphor 12y ago
  Better yet make them repeat something (a nonce in the form of dialtones) back to prevent replay attacks in the form of recorded responses (as was also pointed out in the comments there).
mrb 12y ago
You cherry-picked one line that is not representative of Google's response. Google's final response was: "[we] have filed a bug [and] will [...] take a look", see my coworker (Jeremy)'s reply from May 6 at http://static.shubh.am/2fadisclosure/google.pdf http://static.shubh.am/2fadisclosure/google.pdf Clearly there was initially a simple misunderstanding/miscommunication. The reporter, on April 30, gave Google a few Australian telcos presumably vulnerable. But then he clarified on May 3 that it is actually at least "a large majority of telco's in Australia and UK" that are vulnerable. So, based on this new information, Google replied "Thanks for explaining the potential scope of this issue... [we] have filed a bug". I mean, compare this to the way it was reported to Facebook: the reporter told them right away that 2 of the top 3 telcos in Australia are vulnerable(!) Now if it had been worded like this when first reported to Google, the misunderstanding would probably not have happened.
- nemetroid 12y ago
  Vodafone is the world's second largest mobile telecommunication company behind China Mobile. It is sloppy of Google to not recognise this name, as you suggest happened.
- kabdib 12y ago
  "I have filed a bug" sure sounds like a brush-off to me, especially when combined with the tone of the rest of the reply (which basically reads "Not our problem" -- while it might not be Google's own defect, it's definitely a problem for Google, and one that requires mediation).
  - deleted 12y ago
    [deleted]
  - sirdarckcat 12y ago
    All security reports receive a "I filled a bug" after a bug is filled. https://www.google.com/search?q=%22Nice%20catch!%20I%27ve%20filed%20a%20bug%22 https://www.google.com/search?q=%22Nice%20catch!%20I%27ve%20... Not a brush-off.

by kabdib 12y ago

izacus 12y ago

Why? How is that a Google problem, when you use voice as your backup password system and you're not securing it properly?

pygy_ 12y ago
Most people are not aware of the attack vector (spoofing the phone number to reach the voice mail).
ilyanep 12y ago
As a large company that serves millions of users in many of their most sensitive online endeavors, is it more responsible to throw your hands up and hope that many of the hundreds of telcos out there will fix their own security, or implement a relatively easy fix that will automatically secure all of your customers from this issue regardless of third-party security?

csense 12y ago

The entire point of 2FA is to make password compromise insufficient to gain access to an account. Which makes this response just baffling. I initially thought that the lack of any technical countermeasure might be a legitimate reason for Google to do nothing, but after I thought about it for a moment, I realized that when the 2FA system calls the user, it could simply prompt the user to do something before sending the verification code -- that way, the 2FA provider knows they aren't sending the code to voicemail. Simple and effective, and later in the post I found the author and multiple companies came up with that idea on their own.

anaphor 12y ago
Better yet make them repeat something (a nonce in the form of dialtones) back to prevent replay attacks in the form of recorded responses (as was also pointed out in the comments there).

mrb 12y ago

You cherry-picked one line that is not representative of Google's response. Google's final response was: "[we] have filed a bug [and] will [...] take a look", see my coworker (Jeremy)'s reply from May 6 at http://static.shubh.am/2fadisclosure/google.pdf http://static.shubh.am/2fadisclosure/google.pdf Clearly there was initially a simple misunderstanding/miscommunication. The reporter, on April 30, gave Google a few Australian telcos presumably vulnerable. But then he clarified on May 3 that it is actually at least "a large majority of telco's in Australia and UK" that are vulnerable. So, based on this new information, Google replied "Thanks for explaining the potential scope of this issue... [we] have filed a bug". I mean, compare this to the way it was reported to Facebook: the reporter told them right away that 2 of the top 3 telcos in Australia are vulnerable(!) Now if it had been worded like this when first reported to Google, the misunderstanding would probably not have happened.

nemetroid 12y ago
Vodafone is the world's second largest mobile telecommunication company behind China Mobile. It is sloppy of Google to not recognise this name, as you suggest happened.
kabdib 12y ago
"I have filed a bug" sure sounds like a brush-off to me, especially when combined with the tone of the rest of the reply (which basically reads "Not our problem" -- while it might not be Google's own defect, it's definitely a problem for Google, and one that requires mediation).
- deleted 12y ago
  [deleted]
- sirdarckcat 12y ago
  All security reports receive a "I filled a bug" after a bug is filled. https://www.google.com/search?q=%22Nice%20catch!%20I%27ve%20filed%20a%20bug%22 https://www.google.com/search?q=%22Nice%20catch!%20I%27ve%20... Not a brush-off.