Google stored some G Suite passwords in unhashed form for 14 years
Google revealed that it recently discovered a bug that caused a subset of its enterprise G Suite customers to have their passwords stored in an unhashed — albeit encrypted — form for about 14 years.
“This is a G Suite issue that affects business users only — no free consumer Google accounts were affected — and we are working with enterprise administrators to ensure that their users reset their passwords,” Google said in a blog post disclosing the security lapse.
The company failed to specify exactly how many customers were affected this way. However, it went on to stress that it didn’t find any evidence of improper access.
G Suite is the company’s corporate version of Gmail and apps like Drive, Docs, and Hangouts, among others. This February, Google announced it had over 5 million paying businesses on its G Suite platform.
The issue stems from the way Google implemented password security in its core sign-in system. There are two different slip-ups at play here.
The first involves a G Suite feature available for IT staff since 2005. The tool, now no longer in existence, allowed them to set and recover users’ passwords via the admin console.
Google says the feature had been designed with an intent to onboard new employees, and help them sign into their accounts with passwords manually set by the admins. These passwords, according to the blog post, were not hashed.
Hashing is a standard security practice to protect user credentials by scrambling them, using a one-way encryption algorithm.
The company has a relatively good reputation when it comes to account security, so the fact this bug has been around for so long is a little disconcerting.
The second involves storing some unhashed user credentials for up to two weeks. This was discovered in January 2019 as it was troubleshooting new G Suite customer sign-ups, the search giant said.
With this latest development, Google becomes the latest company to join Facebook, GitHub, Instagram, and Twitter to suffer from embarrassing plaintext password bugs.
Back in May 2018, Twitter asked all its 330 million users to change their passwords after a bug exposed them in plaintext in an internal log. Then Facebook acknowledged earlier last March that it had been storing millions of user passwords in plaintext since 2012. A few weeks later, it expanded the scope of the security lapse to include millions of Instagram users.
Google’s case is a little different in that the passwords were eventually encrypted before they were stored on disk. This means, even if an attacker managed to get hold of your password, they would still have to unscramble it in order to gain access to your account.
A malicious interloper could theoretically use the search giant’s backend software to decrypt your password, although the scenario is extremely unlikely, as the attacker would’ve had to break into Google’s security infrastructure first without being detected.
Noting that both these security blunders have been fixed, Google urged users to make use of multi-factor authentication to thwart any account takeover attacks. It also apologized to its users for not following industry standards and promised to do better.
source thenextweb
Industry: Cyber Security News
Latest Jobs
-
- Cyber Security Sales | Enterprise | New Business | London
- City of London
- Uncapped OTE
-
Enterprise Account Executive | Cyber Security | UK London / UK (hybrid with client engagement) A scaling cyber security firm is hiring an Enterprise Account Executive to drive growth across large UK organisations. This role blends new business with ownership. You will open doors, create demand, and win enterprise accounts, then retain and grow those relationships into long-term, high-value partnerships. Targeting senior stakeholders at CISO, CIO, and board level, you will shape and close complex deals across cyber security, cloud, and transformation programmes. This is a strategic role. Fewer accounts, higher value, longer cycles. You are expected to build pipeline from scratch, with support around you but without reliance on inbound or marketing. A recent and consistent track record of achieving or exceeding sales targets is essential. This role requires someone currently performing at a high level in enterprise sales. UK-based, with remote working and client engagement as needed. Competitive base and uncapped earnings, with scope to build a meaningful enterprise portfolio.
-
- Cyber Security Sales | Financial Services | New Business | London
- England
- Uncapped OTE
-
New Business Lead | Cyber Security | Financial Services | London / UK UK Remote / London client travel A well-backed cyber security and technology firm is looking to hire a senior New Business Lead to drive UK growth, with a particular focus on Financial Services. This is a position for someone who knows how to open doors where others cannot. A role built around identifying opportunity, challenging incumbents, and converting that into long-term client relationships and revenue. You will own new logo acquisition across FS, working closely with leadership to shape go-to-market strategy and position across cyber security, cloud, and modernisation offerings. Full ownership of the sales lifecycle. Pipeline creation, deal strategy, negotiation, and close. The expectation is simple. Build momentum, win key accounts, and scale a function around you as revenue grows. Strong experience selling into Financial Services environments is key. Credibility at CISO, CIO, and board level matters. Remote-first, with London and client engagement as required. Competitive base, uncapped earnings, and genuine scope to build something meaningful. The successful sales person MUST have a recent history and current experinece of achieving / overachieving against sales target.