RT NewsA gaping security bug in Google’s systems may have been used to unearth millions upon millions of users’ email addresses. The activist claimed it took Google a month to rectify the problem after his report to the company.
Tel Aviv-based security researcher Oren Hafif discovered the bug and has informed Google, which has managed to resolve the problem.
However, before Hafif notified Google, he successfully retrieved some 37,000 addresses from the system.
“I have every reason to believe every Gmail address could have been mined,” Hafif told Wired.
He uploaded a video tutorial to his YouTube account at the beginning of June.
Hafif accessed a page declaring that his access had been denied towards the end of last year. After changing a single character in the website’s URL, the Gmail page said that he’d been denied access to a different address.
He automated character changes using software called DirBuster. “I could have done this potentially endlessly,” said Hafif.
While passwords weren’t provided, the bug may have left accounts wide open to spam, phishing and password hacking attempts.
Google rewarded Hafif with $500 – which some commentators deemed to be very low considering the work he did.
“Being a good person is not very profitable these days 🙂 ,” Hafif posted on Twitter on Thursday.
A Google spokesperson confirmed to Wired that the company had repaired the bug and awarded him some financial compensation. However, Google did not respond to any further requests for comment.