{"id":2326,"date":"2013-07-24T16:37:26","date_gmt":"2013-07-24T16:37:26","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=7"},"modified":"2022-12-02T17:17:42","modified_gmt":"2022-12-02T11:47:42","slug":"hacking-google-account-through-locked-android-devices","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/hacking-google-account-through-locked-android-devices\/","title":{"rendered":"Hacking Google account through Locked Android Devices"},"content":{"rendered":"


\n\"Hacking<\/a><\/p>\n

Hacking Google account through Locked Android Devices<\/h3>\n

Varutra revealed an issue in the text message notification implementation of Google\u2019s Android operating system which may lead to compromise of user\u2019s Google account, associated with the mobile number of an Android device.<\/p>\n

Varutra research team \u201cKALP@Varutra\u201d discovered that, by default, the contents of text messages (SMS) received are displayed on the notification area of the device even if the device is in locked mode. To reset the Google account password, Google sends a verification code on a text message to the mobile device of the user. In case of an Android device, this verification code can be read from the notification area, and thus be used to reset the victim\u2019s account credentials. The only pre-requisite for such an act to be successful is for the malicious user to know the victim\u2019s Gmail ID where victim has set his android phone number with the target Android device.<\/p>\n

Consider a scenario where in, a malicious user wants to compromise the victim\u2019s Google account and has visibility to the victim\u2019s mobile screen:<\/p>\n

    \n
  1. Attacker accesses the Google account page and clicks on \u201cCan’t access your account?\u201d<\/li>\n
  2. On the \u201cHaving trouble signing in?\u201d page, he opts for \u201cI don’t know my password\u201d and puts victim\u2019s Gmail ID in the \u201cEmail address\u201d field<\/li>\n
  3. For account recovery options, he\/she opts to receive verification code on the pre-registered mobile number and submits the request after entering the victim\u2019s mobile number<\/li>\n
  4. As a result, a verification code is received as a text message on the victims mobile and the attacker can read it on the notification area of the Android screen.<\/li>\n
  5. Attacker submits the verification code and resets the password of Victim\u2019s Google account The severity of this issue escalates by the fact that the Google\u2019s verification code comprises of only 6 digit numeric value, which is easy to read and memorize. The same valid code can be resent to the device up to 5 times.<\/li>\n<\/ol>\n

    As per security best practices, the verification code must meet the necessary complexity requirements of being more than 8 digit alphanumeric code, making it difficult to memorize. Also, it should be made random i.e. should change on every new request.<\/p>\n

    The issue was tested and found to be affecting Android version prior to 4.0.<\/p>\n

     <\/p>\n

    Written By,<\/p>\n

    Attack & PenTest Team,<\/em><\/p>\n

    Varutra Consulting<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    Hacking Google account through Locked Android Devices Varutra revealed an issue in the text message notification implementation of Google\u2019s Android operating system which may lead…<\/p>\n","protected":false},"author":3,"featured_media":3147,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[51,259,260,140,261,262,263],"tags":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t