Google password system may not be as secure as we think
by: Bradley Wint on April 20th, 2010 at 11:04 am
An insider at Google has released information that the Chinese hackers responsible for breaching their systems in December 2009 may have gotten more information than Google thinks, and analysts believe more holes may be present in the system. One of the major systems breached includes their Gaia cluster servers, which handles all Google user account passwords, which allow access to vital services including GMail, Adsense and more.
They report that no passwords were modified or stolen, with the exception of the two Gmail accounts owned by Chinese activists. However, with such a big breach, analysts believe the system may have other holes which hackers could exploit. The problem originated when they tricked a Google employee into clicking a rogue link, allowing them access to the employee’s entire computer and then to the server center in Mountain View, California.
Software from the developers’ database was reported as stolen, giving the thieves the opportunity to take down Google’s system if they had the right amount of technical knowledge, server power and timing on their hands. Since then Google has placed newer and stronger levels of encryption to counter the problem, but with such information now in the hands of criminals, it still leaves Google’s network at risk since they are still using the Gaia (a.k.a. Single Sign-On) software. With the programs being run on a cluster of computers, it also adds to the ease of threat because all attention would be simply focused on that cloud of computers rather than trying to target multiple locations if the program was run from different location instead.
It seems the hackers had inside knowledge beforehand, and were able to easily tap into the password protection system, as well as the software database, transfer it to private storage servers (Rackspace servers) and then moved it from there to other unknown locations after.
With that in mind, how safe is Google now? Will more encryption solve the problem, or should they do a total analysis of the system to find other holes which may not be covered by the added security?
Have something to say? Be the first!