Twin Google flaws allowed researcher to get from YouTube ID to Gmail address in a few easy steps
(2025/02/17)
- Reference: 1739759106
- News link: https://www.theregister.co.uk/2025/02/17/infosec_news_in_brief/
- Source link:
Infosec In Brief A security researcher has found that Google could leak the email addresses of YouTube channels, which wasn’t good because the search and ads giant promised not to do that.
A security researcher who goes by Brutecat last week [1]explained he found two vulnerabilities that, when chained, make it possible to sniff out the email addresses, despite Google’s promises of privacy.
It all started when Brutecat was digging through Google's People API and found out that a function that allows blocking a YouTube user relied on an obfuscated “Gaia” ID. Gaia is the ID management system for all Google products. Brutecat pointed out that, per a Google support page, blocking someone on YouTube extends to other Google services, meaning it's their Gaia ID that's blocked, not their YouTube account.
[2]
"In the past, there's been several bugs to resolve [Gaia IDs] to an email address, so I was confident there was still a Gaia ID to Email in some old obscure Google product," Brutecat wrote.
[3]
[4]
The researcher was right: he found just such a link in the web version of Pixel Recorder, a [5]audio recording app for Google Pixel devices .
By sharing a recording from the web version of Pixel Recorder to a Gaia ID and examining the web request, the target's email was exposed. Normally, this action would trigger a share notification to the target, but Brutecat bypassed it by running a Python script that assigned an extremely long filename (about 2.5 million characters), causing the notification to fail.
[6]
Brutecat submitted the matter for a Google bug bounty, and at first was told it was worth $3,133. After some additional thinking on the matter, Google decided it had a high likelihood of exploitation, and awarded an additional $7,500.
Google fixed the flaws that made this possible.
Critical vuln of the week: FortiOS follies
Last week’s [7]Patch Tuesday means most nasty bugs have already been revealed, so the worst of the rest is a CVSS 8.0 vulnerability in Fortinet's FortiOS ( [8]CVE-2024-40591 ) spotted by one of the firm's own employees. This flaw allows an authenticated administrator with Security Fabric permissions to escalate their privileges to super-admin.
According to Fortinet, the exploitation requires connecting the targeted FortiGate system to a another FortiGate controlled by the attacker.
While successful exploitation requires specific conditions, this one looks a strong candidate for attention in your next change window.
Release the data, Kraken, says Cisco; See if we care
The Kraken ransomware gang last week [9]claimed to have hit Cisco, reportedly leaking a bundle of sensitive data, including privileged administrator account credentials, Switchzilla’s Kerberos ticket system, and more.
The networking giant said the leak is nothing to panic about.
"Cisco is aware of certain reports regarding a security incident," a company spokesperson The Register . "The incident referenced in the reports occurred back in May 2022, and we fully addressed it at that time."
DOGE geniuses build wonky website
Elon Musk's [10]code crusaders in the Department of Government Efficiency (DOGE) hastily spun up a website last week after Musk [11]claimed his team was being transparent.
It's not a great site.
[12]
Questionable design choices aside, [13]doge.gov appears to have just been built using the Cloudflare Pages webpage building platform connected to a database that, [14]according to a pair of web developers who talked to 404 Media, anyone can write and see their changes appear on the website.
By examining the API endpoints of the database, one of the developers was able to post changes to the site mocking the expertise of its builders and disparaging its design. Both said that it appeared the site wasn't even running on government servers and was instead hosted by Cloudflare.
Zacks attack: Data on 12M users posted online
Customers of Zacks Investment Research, take note: If you were a customer prior to June, 2024, there's a good possibility your data is now available online.
Have I Been Pwned [15]added Zacks to its listing - for the [16]second time in recent years - this week after an attacker published 12 million unique email addresses worth of information on a hacking forum. Along with the email accounts, the leak included IP and physical addresses, names, usernames, phone numbers, and unsalted SHA-256 password hashes. The breach in which the data was stolen reportedly took place in June, 2024.
The threat actor [17]reportedly gained access to Zacks' files via an Active Directory administrator account and used it to steal source code from a number of sites owned by the company.
Zacks hasn't confirmed the incident to anyone who has asked, but suffice it to say, it's probably not a bad idea to change your password if you're a Zacks customer.
FBI pats itself on back for stopping cryptocurrency scams
The FBI last week claimed a year-long operation has seen it prevent over 4,300 folk across the US from falling prey to cryptocurrency investment scams, saving them more than $285 million.
Seventy-six percent of the crypto scam victims that “Operation Level Up” [18]intervened to rescue were unaware they were being ripped off, the FBI said last week. The scams its working to stop frequently involve "unsolicited online contact, a long period of trust building, fake investment opportunities, and a false sense of urgency," the bureau explained.
That’s the way [19]pig butchering schemes
operate.
The FBI won't say how it identified potential victims, only mentioning the use of "sophisticated techniques" that are able to identify people "actively being defrauded.”. Once the investigators contact a fraud target, they reportedly educate them about how such scams work in the hope they won’t be fooled again.
"Unfortunately, we continue to see these scams grow and evolve every day," said FBI CID assistant director Chat Yarbrough. "It doesn't matter where the subjects are—we will use every tool at our disposal to stop them from targeting U.S. citizens." ®
Get our [20]Tech Resources
[1] https://brutecat.com/articles/leaking-youtube-emails#timeline
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://recorder.google.com/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/02/12/patch_tuesday_february_2025/
[8] https://fortiguard.fortinet.com/psirt/FG-IR-24-302
[9] https://cyberpress.org/cisco-data-breach-2/
[10] https://www.theregister.com/2025/02/10/doge_infosec_impact_court_order/
[11] https://abcnews.go.com/Politics/elon-musk-faces-1st-questions-doges-transparency-joins/story?id=118705771
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] http://doge.gov
[14] https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/
[15] https://haveibeenpwned.com/PwnedWebsites#Zacks2024
[16] https://haveibeenpwned.com/PwnedWebsites#Zacks
[17] https://www.bleepingcomputer.com/news/security/hacker-leaks-account-data-of-12-million-zacks-investment-users/
[18] https://www.fbi.gov/news/press-releases/fbi-takes-action-to-protect-your-hard-earned-money
[19] https://www.theregister.com/2024/12/17/interpol_stop_saying_pig_butchering/
[20] https://whitepapers.theregister.com/
A security researcher who goes by Brutecat last week [1]explained he found two vulnerabilities that, when chained, make it possible to sniff out the email addresses, despite Google’s promises of privacy.
It all started when Brutecat was digging through Google's People API and found out that a function that allows blocking a YouTube user relied on an obfuscated “Gaia” ID. Gaia is the ID management system for all Google products. Brutecat pointed out that, per a Google support page, blocking someone on YouTube extends to other Google services, meaning it's their Gaia ID that's blocked, not their YouTube account.
[2]
"In the past, there's been several bugs to resolve [Gaia IDs] to an email address, so I was confident there was still a Gaia ID to Email in some old obscure Google product," Brutecat wrote.
[3]
[4]
The researcher was right: he found just such a link in the web version of Pixel Recorder, a [5]audio recording app for Google Pixel devices .
By sharing a recording from the web version of Pixel Recorder to a Gaia ID and examining the web request, the target's email was exposed. Normally, this action would trigger a share notification to the target, but Brutecat bypassed it by running a Python script that assigned an extremely long filename (about 2.5 million characters), causing the notification to fail.
[6]
Brutecat submitted the matter for a Google bug bounty, and at first was told it was worth $3,133. After some additional thinking on the matter, Google decided it had a high likelihood of exploitation, and awarded an additional $7,500.
Google fixed the flaws that made this possible.
Critical vuln of the week: FortiOS follies
Last week’s [7]Patch Tuesday means most nasty bugs have already been revealed, so the worst of the rest is a CVSS 8.0 vulnerability in Fortinet's FortiOS ( [8]CVE-2024-40591 ) spotted by one of the firm's own employees. This flaw allows an authenticated administrator with Security Fabric permissions to escalate their privileges to super-admin.
According to Fortinet, the exploitation requires connecting the targeted FortiGate system to a another FortiGate controlled by the attacker.
While successful exploitation requires specific conditions, this one looks a strong candidate for attention in your next change window.
Release the data, Kraken, says Cisco; See if we care
The Kraken ransomware gang last week [9]claimed to have hit Cisco, reportedly leaking a bundle of sensitive data, including privileged administrator account credentials, Switchzilla’s Kerberos ticket system, and more.
The networking giant said the leak is nothing to panic about.
"Cisco is aware of certain reports regarding a security incident," a company spokesperson The Register . "The incident referenced in the reports occurred back in May 2022, and we fully addressed it at that time."
DOGE geniuses build wonky website
Elon Musk's [10]code crusaders in the Department of Government Efficiency (DOGE) hastily spun up a website last week after Musk [11]claimed his team was being transparent.
It's not a great site.
[12]
Questionable design choices aside, [13]doge.gov appears to have just been built using the Cloudflare Pages webpage building platform connected to a database that, [14]according to a pair of web developers who talked to 404 Media, anyone can write and see their changes appear on the website.
By examining the API endpoints of the database, one of the developers was able to post changes to the site mocking the expertise of its builders and disparaging its design. Both said that it appeared the site wasn't even running on government servers and was instead hosted by Cloudflare.
Zacks attack: Data on 12M users posted online
Customers of Zacks Investment Research, take note: If you were a customer prior to June, 2024, there's a good possibility your data is now available online.
Have I Been Pwned [15]added Zacks to its listing - for the [16]second time in recent years - this week after an attacker published 12 million unique email addresses worth of information on a hacking forum. Along with the email accounts, the leak included IP and physical addresses, names, usernames, phone numbers, and unsalted SHA-256 password hashes. The breach in which the data was stolen reportedly took place in June, 2024.
The threat actor [17]reportedly gained access to Zacks' files via an Active Directory administrator account and used it to steal source code from a number of sites owned by the company.
Zacks hasn't confirmed the incident to anyone who has asked, but suffice it to say, it's probably not a bad idea to change your password if you're a Zacks customer.
FBI pats itself on back for stopping cryptocurrency scams
The FBI last week claimed a year-long operation has seen it prevent over 4,300 folk across the US from falling prey to cryptocurrency investment scams, saving them more than $285 million.
Seventy-six percent of the crypto scam victims that “Operation Level Up” [18]intervened to rescue were unaware they were being ripped off, the FBI said last week. The scams its working to stop frequently involve "unsolicited online contact, a long period of trust building, fake investment opportunities, and a false sense of urgency," the bureau explained.
That’s the way [19]pig butchering schemes
operate.
The FBI won't say how it identified potential victims, only mentioning the use of "sophisticated techniques" that are able to identify people "actively being defrauded.”. Once the investigators contact a fraud target, they reportedly educate them about how such scams work in the hope they won’t be fooled again.
"Unfortunately, we continue to see these scams grow and evolve every day," said FBI CID assistant director Chat Yarbrough. "It doesn't matter where the subjects are—we will use every tool at our disposal to stop them from targeting U.S. citizens." ®
Get our [20]Tech Resources
[1] https://brutecat.com/articles/leaking-youtube-emails#timeline
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://recorder.google.com/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/02/12/patch_tuesday_february_2025/
[8] https://fortiguard.fortinet.com/psirt/FG-IR-24-302
[9] https://cyberpress.org/cisco-data-breach-2/
[10] https://www.theregister.com/2025/02/10/doge_infosec_impact_court_order/
[11] https://abcnews.go.com/Politics/elon-musk-faces-1st-questions-doges-transparency-joins/story?id=118705771
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z7LCeP9jyF4FcyWCI7Xv5QAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] http://doge.gov
[14] https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/
[15] https://haveibeenpwned.com/PwnedWebsites#Zacks2024
[16] https://haveibeenpwned.com/PwnedWebsites#Zacks
[17] https://www.bleepingcomputer.com/news/security/hacker-leaks-account-data-of-12-million-zacks-investment-users/
[18] https://www.fbi.gov/news/press-releases/fbi-takes-action-to-protect-your-hard-earned-money
[19] https://www.theregister.com/2024/12/17/interpol_stop_saying_pig_butchering/
[20] https://whitepapers.theregister.com/
doge.com - saving you from X many evils
that one in the corner
As the linked-to article points out, doge.com is (currently) just a mirror of their Twitter posts.
But at least that means we can see those tweets without going anywhere near, let alone actually logging onto, The Website That Must Not Be Named[1].[2]
Though you just gotta love a dot-com that has to stick at the top "An official website of the United States government" without any kind of recognisable logo, let alone a dot-gov address. Yeah, I'm convinced. Ooh, look, this other website says that is is "The official website of Prince Burt of Nigeria" and he would like me to do him a favour.
[1] come on, "x" isn't a name, it is the canonical placeholder for the thing you don't know the name of.
[2] and having read the first page or so: now we see the very definition of "picayune"! That lot is a triumph against waste and will lead to saving two trillion dollars? Meanwhile, let's kill off more US Soft Power influence... And damn those come paper straws!
"we will use every tool at our disposal to stop them from targeting U.S. citizens"
About that for stopping Pig Butchering - according to a pic on Reddit, the CIA has stopped their cybersecurity outreach to senior citizens due to Trump/Musk butchering.
Mushroom cloud because they were sacked too.