Bruteforcing the phone number of any Google user (brutecat.com)

Article summary

The article describes a vulnerability in Google's account recovery system that allowed an attacker to brute-force a user's phone number. The attacker used a combination of IPv6 and a botguard token to bypass rate limits and discover the phone number. The vulnerability was reported to Google and has since been fixed. The attack relied on exploiting a non-JS username recovery form and using a Looker Studio document to leak the user's display name.

Main themes

• legacy page maintenance
• security vulnerabilities
• bug bounty programs
• software design
• deprecated services
• account recovery systems

What commenters say

• Maintaining legacy pages is a daunting task for large companies like Google.
• The vulnerability highlights the importance of securing old code and deprecated services.
• Some argue that the bug bounty program is an efficient way to identify security issues, while others think the reward was too low.
• The use of interns and new hires to maintain legacy pages can be ineffective due to their lack of knowledge about the validity of the information.
• Deprecating old products and services can be a way to avoid security holes, but it may not always be possible or practical.
• The design of software should prioritize security and avoid shared accounts across all services.
• The bug bounty program can be a cost-effective way to identify security issues, but it may not be suitable for all companies.