{"id":2384,"date":"2012-10-25T16:48:47","date_gmt":"2012-10-25T11:18:47","guid":{"rendered":"https:\/\/www.qadit.com\/blog\/?p=2384"},"modified":"2012-10-25T16:48:47","modified_gmt":"2012-10-25T11:18:47","slug":"how-a-google-headhunter%e2%80%99s-e-mail-unraveled-a-massive-net-security-hole","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/how-a-google-headhunter%e2%80%99s-e-mail-unraveled-a-massive-net-security-hole\/","title":{"rendered":"How a Google Headhunter\u2019s E-Mail Unraveled a Massive Net Security Hole"},"content":{"rendered":"<\/p>\n
\n\"\"<\/a><\/p>\n

Mathematician Zach Harris, 35, of Jupiter, Fl., poses for a portrait on Tuesday. Photo: Brynn Anderson\/Wired<\/em><\/p>\n<\/div>\n

It was a strange e-mail, coming from a job recruiter at Google, asking Zachary Harris if he was interested in a position as a site-reliability engineer.<\/p>\n

\u201cYou obviously have a passion for Linux and programming,\u201d the e-mail from the Google recruiter read. \u201cI wanted to see if you are open to confidentially exploring opportunities with Google?\u201d<\/p>\n

Harris was intrigued, but skeptical. The e-mail had come to him last December completely out of the blue, and as a mathematician, he didn\u2019t seem the likeliest candidate for the job Google was pitching.<\/p>\n

So he wondered if the e-mail might have been spoofed \u2013 something sent from a scammer to appear to come from the search giant. But when Harris examined the e-mail\u2019s header information, it all seemed legitimate.<\/p>\n

Then he noticed something strange. Google was using a weak cryptographic key to certify to recipients that its correspondence came from a legitimate Google corporate domain. Anyone who cracked the key could use it to impersonate an e-mail sender from Google, including Google founders Sergey Brin and Larry Page.<\/p>\n

The problem lay with the DKIM key (DomainKeys Identified Mail<\/a>) Google used for its google.com e-mails. DKIM involves a cryptographic key that domains use to sign e-mail originating from them \u2013 or passing through them \u2013 to validate to a recipient that the domain in the header information on an e-mail is correct and that the correspondence indeed came from the stated domain. When e-mail arrives at its destination, the receiving server can look up the public key through the sender\u2019s DNS records and verify the validity of the signature.<\/p>\n

For security reasons, the DKIM standard calls for using keys that are at least 1,024 bits in length<\/a>. But Google was using a 512-bit key \u2013 which could be easily cracked with a little cloud-computing help.<\/p>\n

Harris thought there was no way Google would be so careless, so he concluded it must be a sly recruiting test to see if job applicants would spot the vulnerability. Perhaps the recruiter was in on the game; or perhaps it was set up by Google\u2019s tech team behind the scenes, with recruiters as unwitting accomplices.<\/p>\n

Harris wasn\u2019t interested in the job at Google, but he decided to crack the key and send an e-mail to Google founders Brin and Page, as each other, just to show them that he was onto their game.<\/p>\n

\u201cI love factoring numbers,\u201d Harris says. \u201cSo I thought this was fun. I really wanted to solve their puzzle and prove I could do it.\u201d<\/p>\n

In the e-mail, he plugged his personal website:<\/p>\n

\n

Hey Larry,<\/p>\n

Here\u2019s an interesting idea still being developed in its infancy:<\/p>\n

https:\/\/www.everythingwiki.net\/index.php\/What_Zach_wants_regarding_wiki_technology<\/p>\n

or, if the above gives you trouble try this instead:<\/p>\n

https:\/\/everythingwiki.sytes.net\/index.php\/What_Zach_wants_regarding_wiki_technology.<\/p>\n

I think we should look into whether Google could get involved with this guy in some way. What do you think?<\/p>\n

-Sergey<\/p>\n<\/blockquote>\n

Harris made sure the return path for the e-mails went to his own e-mail account, so that Brin and Page could ask him how he\u2019d cracked their puzzle. But Harris never got a response from the Google founders. Instead, two days later, he noticed that Google\u2019s cryptographic key had suddenly changed to 2,048 bits. And he got a lot of sudden hits to his web site from Google IP addresses. <\/p>\n

Oops, Harris thought, it was a real vulnerability he\u2019d found.<\/p>\n

<\/span><\/p>\n

<\/p>\n

\n

Original news article at https:\/\/www.wired.com\/threatlevel<\/a> on October 24, 2012 at 04:00PM<\/p>\n","protected":false},"excerpt":{"rendered":"

Mathematician Zach Harris, 35, of Jupiter, Fl., poses for a portrait on Tuesday. Photo: Brynn Anderson\/Wired It was a strange e-mail, coming from a job recruiter at Google, asking Zachary Harris if he was interested in a position as a site-reliability engineer. \u201cYou obviously have a passion for Linux and programming,\u201d the e-mail from the … <\/p>\n

Continue reading “How a Google Headhunter\u2019s E-Mail Unraveled a Massive Net Security Hole”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[4],"class_list":["post-2384","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-it-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-Cs","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/2384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=2384"}],"version-history":[{"count":0,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/2384\/revisions"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=2384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=2384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=2384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}