Tag Archive for: Google

A way to access Google accounts without a password by Hackers

A recent discovery by security researchers has unveiled a new hacking technique that enables cyber criminals to infiltrate individuals’ Google accounts without requiring their passwords. CloudSEK, a security firm, conducted an analysis and identified a malicious form of malware that exploits third-party cookies to gain unauthorized access to users’ private data. This dangerous exploit is already being actively tested by various hacking groups.

The revelation of this exploit occurred in October 2023 when a hacker shared information about it on a Telegram channel. The hacker explained how accounts could be compromised through a vulnerability associated with cookies. Cookies are utilized by websites and browsers to track users and enhance their browsing experience.

Google authentication cookies play a crucial role in allowing users to access their accounts without repeatedly entering their login credentials. However, the hackers have discovered a method to retrieve these cookies, thereby bypassing the security measures of two-factor authentication.

To address this issue, Google Chrome, the world’s most widely used web browser with a market share exceeding 60% last year, is currently taking steps to crack down on third-party cookies.

“We routinely upgrade our defences against such techniques and to secure users who fall victim to malware. In this instance, Google has taken action to secure any compromised accounts detected,” Google said in a statement.

“Users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.”

The researchers who first uncovered the threat said it “underscores the complexity and stealth” of modern cyber-attacks.

“This exploit enables continuous access to Google services, even after a user’s password is reset,” Pavan Karthick M, a threat intelligence researcher at CloudSEK, wrote in a blog post detailing the issue.

“It highlights the necessity for continuous monitoring of both technical vulnerabilities and human intelligence sources to stay ahead of emerging cyber threats.”

The report, titled ‘Exploiting Undocumented OAuth2 Functionality for session hijacking: Malwares Compromising Google Accounts’, was authored by Pavan Karthick M., a threat intelligence researcher at CloudSEK.

Google Fined $57 Million for Burying Privacy Terms Where Users Won’t Find Them

Google has been fined $56.8 million (₦20,391,200,000.00) by privacy regulators in France, marking the country’s first use of the tough new privacy rules enacted in Europe last year. Specifically, the company is accused of violating provisions of the General Data Protection Regulation (GDPR) by using, without proper consent, the private data of users to craft personalized ads; and by burying key privacy disclosures pages deep, amid oceans of text.

In a statement Monday, France’s privacy watchdog, CNIL, said that Google had been fined for needlessly obscuring information concerning the processing of its users’ data, which Europe’s privacy rules demand be made more easily accessible. Essential information about how user data is processed, stored, and used, it said, was “excessively disseminated across several documents.” It required, in some cases, up to five or six steps to unearth key disclosures, including details of how Google amasses personal information to help it pinpoint a user’s location.

Some of the information, it said, “is not always clear nor comprehensive.”

While Google says it obtains the consent of consumers prior to using their data to personalize ads, the French commission found Google’s process for informing users about what precisely they’re consenting to to be wholly inadequate. Users are “not sufficiently informed,” it said, finding Google’s language “vague” and its violations to be “continuous.”

In regard to the violations, CNIL wrote:

Users are not able to fully understand the extent of the processing operations carried out by GOOGLE. But the processing operations are particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined. The restricted committee observes in particular that the purposes of processing are described in a too generic and vague manner, and so are the categories of data processed for these various purposes. Similarly, the information communicated is not clear enough so that the user can understand that the legal basis of processing operations for the ads personalization is the consent, and not the legitimate interest of the company. Finally, the restricted committee notices that the information about the retention period is not provided for some data.

Google told reporters in response that it was “studying the decision” to inform its next steps. “People expect high standards of transparency and control from us,” it said, adding that it remained “deeply committed to meeting those expectations and the consent requirements of the GDPR.”

TV station France 24 reported that CNIL’s judgement followed complaints filed by two advocacy groups in May—one by La Quadrature du Net, the French digital rights group, and another by Austrian privacy activist Max Schrems.

“We have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products,” Schrems reportedly told the station. “It is important that the authorities make it clear that simply claiming to be compliant is not enough.”

gizmodo

What Data Big Tech Companies Admit To Have On You

Have you ever asked yourself, “What does the Data big companies such as Google know about me?” The answer is uncomfortable. What Google knows about you includes everything from your clicks on ads to your birthday to the device you’re using right now and the Wi-Fi network it’s connected to. But Google pales in comparison to some of the other big companies that sell your data or collect it out there.

This is what the big six tech companies have officially admitted to collecting as far as personal data about you, according to their official privacy policies.

The Data Big Tech Companies Have On You

Android P to stop apps from monitoring network activity

In the future, it looks like Android apps will no longer be able to detect when other apps on your device are connecting to the internet.

It’s about time Google patches this nasty privacy flaw. Any app can monitor your network activity without your knowledge to see when you connect with a competing app, or perhaps worse.

XDA Developers first noticed the new changes coming to Android’s SELinux rules for apps targeting API level 28 running on Android P:

A new commit has appeared in the Android Open Source Project to “start the process of locking down proc/net.” /proc/net contains a bunch of output from the kernel related to network activity. There’s currently no restriction on apps accessing /proc/net, which means they can read from here (especially the TCP and UDP files) to parse your device’s network activity.

The SELinux changes only enable designated VPN apps to access some networking information, according to the code. As XDA Developers points out, Android apps won’t have to target API level 28 until 2019 — meaning the flaw could still be accessed for some time.

We’ll be looking for changes in the next release of the Android Open Source Project. Hopefully Google will jump in and patch things before Android P’s future release.

zdnet

Learn How to Code with your Phone for Free

Grasshopper

A bunch of Google employees participating in the company’s Area 120 internal incubator have launched Grasshopper, a free mobile app for Android and iOS that teaches you the basics of programming.

It’s beautifully designed and is suitable for just about anyone who can be trusted to use a phone on their own. By solving simple challenges and answering quiz questions, you’ll soon get the hang of basic JavaScript.

The gamified app, named after programming pioneer Grace Hopper, currently includes three sets of lessons, which cover the fundamentals of coding (calling functions, using variables and objects, and so on), as well as animations. The idea is to spend a few minutes a day with it, so you can have the app remind you to hop in daily and take on a few challenges.

When you’re done with the content in Grasshopper, you can move on to recommended Coursera classes to learn more about JavaScript, HTML, CSS, algorithms, and web design for a fee, or simply muck around in Grashopper’s online playground and make your own JS animations. Naturally, you can also explore alternatives for learning to code, such as the courses offered by edX and FreeCodeCamp.

I’ve been meaning to get back to coding for a while now, having ditched my chops when I graduated from high school. The app is fun and easy enough to get through a few challenges when you’re on a commute, and feels like a good alternative to scrolling through social media feeds mindlessly.

Grasshopper is the latest product to emerge from Area 120, which gives Google employees a chance to work full-time on their side projects and bring them to life. It’s previously seen launches like Uptime, which lets you watch YouTube videos in sync with friends elsewhere in the world, and Supersonic, a messaging app for emoji lovers.

thenextweb

This New Web Standard Could Finally Kill the Password

Passwords are pretty archaic. Unfortunately, despite the best efforts of companies including Google, Apple, Facebook and others, no one has figured out a uniform standard that would make it possible to do away with them entirely. Until, perhaps, now.

A new credential system proposed by the W3C—the World Wide Web Consortium—could be what we need to kill off the password for good.

Per the w3c, the new Web Authentication specification details an “API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.” In other words, this would be a universal system that could offer unique encryption keys for each user that could be accessed securely across every site, all in your standard web browser.

But the big upgrade is that, instead of being limited to a regular password, the API would also support the use of fingerprint readers, cameras, and USB keys as a method of logging into your account. In fact, some potential use cases even include using the fingerprint reader on your phone to log into a website that you’re browsing on your laptop or desktop, which may not have its own fingerprint sensor.

While the new standard is currently listed as just a “Candidate Recomendation,” the feature is already in use as an experimental technology in FireFox, with other browsers including Chrome and Edge expected to test the Web Authentication API later this year.

The sad part so far is that, despite input and contribution from companies such as Google, Microsoft, PayPal, Mozilla, Qualcomm and others, it doesn’t seem like Apple is on board to help test or refine the tech. That’s a real shame, because even though wide-scale adoption is still a ways out, it would be nice if there was a secure, non-proprietary login platform that all the big tech companies could agree on.

gizmodo

Yes Chrome is scanning your Windows PC, but it might be a bug

A few days ago Kelly Shortridge, a product manager at SecurityScorecard detected some unexpected behavior on her PC, as a honeypot Canarytoken reported being accessed by Chrome.exe. That’s not what you’d expect from a web browser normally, except for one thing — Google did add some antivirus-y capabilities to its browser on Windows late last year as an enhancement to its Chrome Cleanup tool that can help reset hijacked settings. Google Chrome security lead Justin Schuh explained how the feature works and pointed to some documentation about it, and that was that —

If you are hitting this issue and you want a fix right now then go to chrome://downloads in your browser, go to the menu in the top right, and select Clear All. That will clear Chrome’s list of downloaded files so that it won’t have any files to existence-check at startup. If you have a large list of downloaded files then this will improve startup time slightly.

It turns out the “AV scanning” wasn’t that at all, and what it was doing could affect you right now. It turns out that Chrome is checking the integrity of downloaded files at startup, and a bug lead it to that particular folder. It relies on the Downloaded History list for this check, and if you have a lot of files in there, it could slow down your computer when you start Chrome. While the dev team is working to skip the check entirely in a future update, users worried about it can fix it by clearing their download history.

Chrome Is Scanning Files on Your Computer

The browser you likely use to read this article scans practically all files on your Windows computer. And you probably had no idea until you read this. Don’t worry, you’re not the only one.

Last year, Google announced some upgrades to Chrome, by far the world’s most used browser—and the one security pros often recommend. The company promised to make internet surfing on Windows computers even “cleaner” and “safer ” adding what The Verge called “basic antivirus features.” What Google did was improve something called Chrome Cleanup Tool for Windows users, using software from cybersecurity and antivirus company ESET.

Tensions around the issue of digital privacy are understandably high following Facebook’s Cambridge Analytica scandal, but as far as we can tell there is no reason to worry here, and what Google is doing is above board.

In practice, Chome on Windows looks through your computer in search of malware that targets the Chrome browser itself using ESET’s antivirus engine. If it finds some suspected malware, it sends metadata of the file where the malware is stored, and some system information, to Google. Then, it asks you to for permission to remove the suspected malicious file. (You can opt-out of sending information to Google by deselecting the “Report details to Google” checkbox.)

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

A screenshot of the Chrome pop-up that appears if Chrome Cleanup Tool detects malware on your Windows computer.

Last week, Kelly Shortridge, who works at cybersecurity startup SecurityScorecard, noticed that Chrome was scanning files in the Documents folder of her Windows computer.

“In the current climate, it really shocked me that Google would so quietly roll out this feature without publicizing more detailed supporting documentation—even just to preemptively ease speculation,” Shortridge told me in an online chat. “Their intentions are clearly security-minded, but the lack of explicit consent and transparency seems to violate their own criteria of ‘user-friendly software’ that informs the policy for Chrome Cleanup [Tool].”

Her tweet got a lot of attention and caused other people in the infosec community—as well as average users such as me—to scratch their heads.

“Nobody likes surprises,” Haroon Meer, the founder at security consulting firm Thinkst, told me in an online chat. “When people fear a big brother, and tech behemoths going too far…a browser touching files it has no business to touch is going to set off alarm bells.”

Now, to be clear, this doesn’t mean Google can, for example, see photos you store on your windows machine. According to Google, the goal of Chrome Cleanup Tool is to make sure malware doesn’t mess up with Chrome on your computer by installing dangerous extensions, or putting ads where they’re not supposed to be.

As the head of Google Chrome security Justin Schuh explained on Twitter, the tool’s “sole purpose is to detect and remove unwanted software manipulating Chrome.” Moreover, he added, the tool only runs weekly, it only has normal user privileges (meaning it can’t go too deep into the system), is “sandboxed” (meaning its code is isolated from other programs), and users have to explicitly click on that box screenshotted above to remove the files and “cleanup.”

In other words, Chrome Cleanup Tool is less invasive than a regular “cloud” antivirus that scans your whole computer (including its more sensitive parts such as the kernel) and uploads some data to the antivirus company’s servers.

But as Johns Hopkins professor Matthew Green put it, most people “are just a little creeped out that Chrome started poking through their underwear drawer without asking.”

That’s the problem here: most users of an internet browser probably don’t expect it to scan and remove files on their computers.

When reached out for comment, a Google spokesperson redirected me to the blog post from last year and Schuh’s tweets.

A section in Chrome’s Privacy Whitepaper explains that “Chrome periodically scans your device to detect potentially unwanted software.” That exact language has been there since at least January of 2017, according to archived versions of the whitepaper. And similar language (“Chrome scans your computer periodically for the sole purpose of detecting potentially unwanted software”) has been there for even longer.

Martijn Grooten, the editor of Virus Bulletin and organizer of one of the premiere antivirus conferences in the world, told me in a Twitter chat that the behavior of the Chrome Cleanup Tool was “sensible.”

“For almost all users, this seems really harmless, and for those who are extremely concerned about Google seeing some metadata, maybe they shouldn’t be running Google’s browser in the first place,” he said.

Motherboard

Google shutting down goo.gl URL shortener next year

google shortener

The goo.gl link is very common on the web and was first launched by Google in 2009. However, the company announced on Friday, March 30, 2018, that it’s winding down the URL Shortener beginning next month, with a complete deprecation by next year. Fortunately, existing links will continue to work.

The URL shortener service launched in 2009 for FeedBurner and the Google Toolbar. With neither of those services available, the same is now happening to goo.gl for both consumers and developers. The latter group is being directed to Firebase Dynamic Links with the announcement meant to “refocus” Google’s efforts.

many popular URL shortening services have emerged and the ways people find content on the Internet have also changed dramatically, from primarily desktop webpages to apps, mobile devices, home assistants, and more.

However, for average users that just want to truncate a link, there is no new alternative from the company, with Google suggesting Bitly and Ow.ly.

Starting on April 13, 2018, new and anonymous users will no longer be able to reach the goo.gl console to create short links. However, existing users will have access to all features like creation, management, and analytics until March 30, 2019, when the console will be discontinued.

Google notes “all links will continue to redirect to the intended destination” even after 2019, with users also able to export link information from the console.

Developers are encouraged to switch over to Firebase Dynamic Links that have the advantage of automatically detecting the user’s platform and send the user to either the web or your app.

URL Shortener has been a great tool that we’re proud to have built. As we look towards the future, we’re excited about the possibilities of Firebase Dynamic Links, particularly when it comes to dynamic platform detection and links that survive the app installation process. We hope you are too!

9 to 5 Google

Facebook is hosting an online abuse summit with other tech leaders

Desperate to show it takes thwarting misinformation, fraud and spam seriously, Facebook just revealed that it’s hosting a private “Fighting Abuse @Scale” invite-only conference in San Francisco on April 25th. Speakers from Facebook, Airbnb, Google, Microsoft and LinkedIn will discuss how to stop fake news, prevent counterfeit account creation, use honeypots to disrupt adversarial infrastructure and how machine learning can be employed to boost platform safety.

Facebook Event: fighting abuse Though never publicly announced, Facebook has already privately filled the event to capacity. The company’s PR says this isn’t a “last-minute” event as we originally described it, and initial invites went out February 6th. But the sudden move to invite journalists less than a month ahead seems timed to humanize Facebook’s efforts to combat its ongoing data abuse and election interference scandals.

Fighting Abuse @Scale will be held at the Bespoke Event Center within the Westfield Mall in SF. We can expect more technical details about the new proactive artificial intelligence tools Facebook announced today during a conference call about its plans to protect election integrity. The first session is titled “Combating misinformation at Facebook” and will feature an engineering director and data scientists from the company.

Facebook previously held “Fighting Spam @Scale” conferences in May 2015 and November 2016 just after the presidential election. But since then, public frustration has built up to a breaking point for the social network. Russian election interference, hoaxes reaching voters, violence on Facebook Live, the ever-present issue of cyberbullying and now the Cambridge Analytica data privacy scandal have created a convergence of backlash. With its share price plummeting, former executives speaking out against its impact on society and CEO Mark Zuckerberg on a media apology tour, Facebook needs to show this isn’t just a PR problem. It needs users, potential government regulators, and its own existing and potential employees to see it’s willing to step up and take responsibility for fixing its platform.

tech crunch