Google fixes errors that can reveal the private phone numbers for users

A security researcher has discovered a mistake that can be used to reveal the phone number of the private recovery phone for almost any Google account without alerting its owner, which may expose users to the risks of privacy and safety.

Google confirmed to Techcrunch that she fixed the error after the researcher alerted the company in April.

Independent researcher, who goes through BRUTCAT handle and Clear their resultsTeccrunch told that they can get a Google recovery phone number by exploiting an error in the company’s account recovery feature.

The exploitation relied on a “attack chain” for many individual operations that operate alongside, including leaking the full offer of the target account, and bypassing the Google Control Protection Mechanism to prevent the harmful random mail of requests to reset the password. Ultimately, reduce the minimum rate of wandering in all the potential flipping of the Google Account phone number in a short period of time and access to the right numbers.

By automating the attack chain using a text program, the researcher said it could determine the Google account owner’s phone number in 20 minutes or less, depending on the length of the phone number.

To test this, Techcrunch prepared a new Google account with a phone number that has not been used before, then introduce Bretecat with our new Google email address.

Shortly after that, Protikat sent his messenger with the phone number that we identified.

Bingo :), the researcher said.

The disclosure of the private recovery phone number can reveal the unknown Google accounts for targeted attacks, such as acquisition attempts. A private phone number associated with a person’s Google account may be easy for a skilled terminal to control this phone number through SIM exchange attackFor example. With this phone number control, the attacker can reset the password for any account connected to this phone number by creating the reputation of the password sent to this phone.

Looking at the potential risks of the broader audience, Techcrunch agreed to keep this story so that the error can be fixed.

“This problem has been fixed. We have always stressed the importance of working with a security research community through our weakness program and we want to thank the researcher for a sign of this problem,” Google spokesman Kimberly Samra told Techcrunch. “The presentation of researchers like this is one of the many ways in which we can find problems and quickly repair the safety of our users.”

Samra said that the company had seen “any confirmed and direct links to exploits at this time.”

Google said that Google paid $ 5,000 in Bug Bounty’s bonus to discover it.