Critical Google Security Flaw Exposes Millions of Users’ Phone Numbers Through Brute-Force Attack
A critical security vulnerability discovered in Google's legacy authentication infrastructure, specifically impacting its No-JavaScript username recovery form. This flaw allowed attackers to extract complete phone numbers of millions of Google users through a brute-force attack by exploiting known display names and leveraging advanced techniques like IPv6 address rotation and Botguard token repurposing to bypass Google's rate limits and security measures. The article explains the attack methodology, geographic impact, and Google's prompt response and remediation timeline, ultimately deprecating the vulnerable system. Finally, it highlights broader implications for digital security, emphasizing the dangers of legacy system vulnerabilities and offers protection strategies for Google users and technical recommendations for organizations, with Technijian promoting its cybersecurity services as a solution for addressing such threats. ... Read More
