Slashdot Mirror
Source Code To Google Authentication System Stolen
Aardvark writes "More details are coming out about the extent of the break-in at Google a few months ago. The NY Times is reporting that one of the things stolen was the source code to Google's single sign-on authentication system, called Gaia. Though Google is making changes to the system, the theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future. No wonder that Eric Schmidt recently said they've become paranoid about security."
Strange - didn't you guys say if I had nothing to hide, privacy didn't matter?
tar.gz or it didn't happen
More eyes make the bugs shallow, right? ;)
Put identity in the browser.
So, Schmidt is worried because google was relying on security through obscurity?
Seriously, the bad guys already have it, so enlist the help of the security community to improve it.
We are agents of the free
I thought the cloud was secure?
Stolen?
What.. they are no longer in possession of the source code?
They should open source it, since a copy is out on the loose anyway. This could work to their advantage.
I still think capability based security is the only workable long term solution..
http://www.slashcode.com/
i'd love to see /. put their source out there, money where their mouth is so to speak.
...You mean like http://www.slashcode.com/about.shtml ?
From TFA: "By clicking on a link [sent on Microsoft Messenger] and connecting to a 'poisoned' Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google’s headquarters in Mountain View, Calif. Ultimately, the intruders were able to gain control of a software repository used by the development team."
I don't know about you, but I'm quite shocked at how an innocuous thing like this can lead to the theft of "one of Google's crown jewels". Are their security practises that lax over there in Google China? And, considering that this happened to Google - a leading Tech-savvy company - how many other corporations and conglomerates have already been hit by a similar attack? Banks? Military? Oil and Gas? Heck, MSFT?? After all, TFA reported that it was a "lightning raid that lasted less than two days".
And yeah, while TFA sounds like Luddite fear-mongering, I think it's a valid concern for everyone.
The Wknd Sessions - Malaysian and South East Asia independent music
This explains all those sexy emails my girlfriend has been getting from all kinds of different guys in her gmail account
there was no mention of whether their security system is buggy or not. The attack was made through a hacked internet site, with the help of an internal employee, not by someone "hacking into" the system. The weak link in the chain is always people, not software.
wasn't this same attack linked to MS internet explorer 6? had to bring that up...of course I could be wrong.
Anyone know of any large company opening up the source code to their security systems?
This seemed like a reasonable sig at the time.
This sounds very very bad to me, the worst fact being that security and paranoia always lead to bad decisions and breaches of rights. Even if we believe google's do no evil policy if they are pushed far enough they will become something we don't want.
matched the target
that is, the economics of the attack is not a common one: your average podunk company offers what, exactly? and i'm not even talking in terms of financial possibilities, i'm talking in terms of corporate and political espionage, which the chinese government is interested in, not common robbery. because with google, if you break in, you get such a huge payoff in terms of strategic intelligence, unlike any other exploitable entity. so somewhere in china, a stable of minds are focused like a laser on you
and structurally, security wise, the problem is the same as terrorism: the good guys have to be vigilant all the time, they can't fail ever. while the bad guys: they can screw up time and again, that's ok. they learn even. they only need to get in once. so even if you are google, no, ESPECIALLY if you are google because you're such a fabled target, you are at a strategic disadvantage, even with all your resources, to be hacked. those who want to hack you are ready to invest heavily into hacking you: its a good investment, because the payoff is gargantuan, the economics of the security situation works against google
the REAL lesson is for us, the common joe blows of the world: don't put all of your eggs in one basket. have an ecosystem of interdepndent accounts with different companies. don't do EVERYTHING at google, or their exposure is your exposure
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
As Bruce Schenier said, security through obscurity does not work...
That has been a mantra on slashdot since it started and I have never been convinced that it's necessarily true. There are plenty of examples where a security hole was discovered in 10+ years old open source code. On the other hand, there's no way of knowing how many security holes are never exploited because the company whose systems have it keeps quiet.
"theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future"
As Bruce Schenier said, security through obscurity does not work...
Are you sure he said that, or did he say that it was wrong to rely on security through obscurity? Obscurity (i.e. not telling tales out of school) is one valid element of an overall security model.
Crumb's Corollary: Never bring a knife to a bun fight.
They took the code without Google's consent, hence they stole it.
Not quite. In most jurisdictions, the question "Is it theft?" is answered by the following tests.
1. Was the property provably taken without consent?
2. Was the property provably taken with the intent of depriving its rightful owner of said property?
If both of those tests are true, it's theft. In this case, Google still has a copy of their code, so the crime would not be considered theft in most jurisdictions.
Of course, in the USA there is no national definition of theft, since it's defined and prosecuted at the state level. Talk about confusing.
"Theft" is a concept that really varies in meaning from place to place. I guess that's why so many people jump on their high horse, wave their hands madly, and proclaim that various petty infringements are "stealing". They are probably right in the context of some banana republic somewhere.
I've been sent spam recently from quite a few people who's gmail accounts have been hacked. Look at the gmail forums....
http://www.google.com/support/forum/p/gmail/label?lid=65ac3f0a8251ca2d&hl=en
Filled with spam from hacked account messages. Coincidence?
Zoid.com
A cheap two factor solution like passwindow.com where the user tokens cost nothing to produce would be the best solution for mass deployment and more secure than most of the basic OTP electronic tokens which the trojans like Zeus are bypassing with MITB attacks. Anyone have any better ideas?
Yes; well the truth is that only if those eyes are looking (I'm sure the crackers will be). But still, it's yet another example that not publishing your source code just means that the only eyes looking other than your own are hostile eyes. Google should now publish the source code to this system and more of their other internal stuff that others could use and share.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Targeted zero day attacks to steal source code are worth 1000x more than an account to send spam on. Root at google? This is actually a big deal, above the realm of small bot shops, this is superpowers in a cyber arms race. Very strong implications on the security of cloud computing as the provisioning company can be the vector of attacks to any company it hosts.
If the only eyes looking other than your own are hostile eyes...
The point being made was that this is the case only when you don't publish your code, and therefore the only way it gets out is if it's stolen - thus, now you have access and the person who stole it has access. If on the other hand you publish the code, then everyone, good and bad has access, and hopefully count(good) > count(bad)
I can imagine Google decides to replace Gaia. They might opensource parts of authentication or encryption code. A public audit if you will.
Hivemind harvest in progress..
Bruce Schneier was just trying to explain Kerckhoff's principle, which is that all security must be assumed to lie in the token and not in the algorithm, because the problem space for algorithms is very, very small, while the problem space for tokens (eg, keys) can be made arbitrarily large. In other words, if Google's algorithm relied on its secrecy for its effectiveness, they weren't doing it right.
Oh please! Nearly everyone tries "novel" forms of writing without capital letters, without punctuation, or of some other kind at least once. Usually when they're teenagers and they usually grow out of it when they realise it's nowhere near as "novel" as they first thought.
Capital letters are not redundant. They are incredibly useful due to the way we read. Once you're reached a certain level of proficiency in reading, you don't read one word at a time. You read whole sentences - sometimes several, or a short paragraph - in one go. You find the beginning, skip to the end, and look over the whole thing finding the meaning. This is a much quicker way of reading than a single word at a time.
Capital letters provide a very useful visual clue that quickly let you find the end of the sentence or block you wish to read and let you read it quickly. When they're absent, it slows you down and makes reading the text much more difficult and frustrating than it needs to be. It's simply poor communication.
Igor Presnyakov stole my hat