New Timing Attack Discovered Could Compromise Google Users Further

Ahead of the recent Google password leak, a new Timing exploit has been discovered which tin can be used to unmask the identities of Google users browsing the web. Simply two days back a staggering v million Gmail passwords were leaked on a Russian bitcoin forum, resulting in many assertive their security had been compromised.

Google nonetheless denied the validity of the data posted and claimed that the passwords posted were sometime and therefore useless. Well, a new vulnerability has been discovered in Google'due south document sharing service and Google drive which tin be used to unmask the identities of users visiting the website of the attacker.

Security Researcher Andrew Cantino Discovers New Timing Vulnerability In Google Drive

According to Andrew Cantino, Vice President engineering at Mavenlink, the exploit discovered can have several repercussions. In lodge to exploit this vulnerability an aggressor would take to share a document with one or more email addresses but uncheck the choice which sends a notification. This gives the attacking site an pick to know when someone logged into one of the email addresses the certificate has been shared with accesses the site.

While information technology might seem light at kickoff, this can accept several negative consequences. This assault can be used for spear phishing, targeted attacks on particular users such as government officials and can even be used to unmask the identities of Tor users if they use the browser while logged into gmail.

Mr. Cantino reported the event to Google who acknowledged the issue but refused to fix it. This is due to the fact that according to Google the risk of exploiting this vulnerability to target a large population is low.