Google Security Vulnerabilities and Updates

Security self-reporting is a good thing


It has definitely been a rough couple of weeks for Google, at least in terms of security nightmares. Last week Google notified people like myself that the Bluetooth Low Energy (BLE) Titan Security key had a manufacturing flaw that could allow someone to intercept the pairing process.
Here's what Google emailed us:
Hi,

We’ve become aware of an issue affecting the Bluetooth Low Energy (BLE) Titan Security Key that you purchased from the Google Store. This issue does not affect the USB/NFC version of the Titan Security Key.

Recommended actions
While it is still safer to use the affected BLE Titan Security Key instead of no key at all, you should do the following for your security:

• Sign in and unpair. After you’ve used your key to sign in to your Google Account on your mobile device, immediately unpair it. Here are instructions for iOS and Android.
• Replace your current security key for free by visiting google.com/replacemykey.
Important
If you don’t replace your key and use a device with iOS 12.3 or higher, you could be locked out of your Google Account. Follow these instructions if you get locked out of your account.

Sincerely,
The Google Store team

Titan Security Key email

This isn't really new-news


Back in January when I was sent my Titan Security Key Bundle by Google, I noted that it was troubling that the 2 keys were made by 2 different manufacturers. This isn't inherently problematic as a lot of OEM's outsource their parts and manufacturing. What was troubling was that  the Bluetooth/NFC Titan Security key is made by Chinese company Feitian Technologies which is part of a Chinese Military Alliance. Many security researchers had noted that so long as Feitian hadn't made any modifications to the FIDO Web Authentication API that they should be fine. At that time, Google hadn't acknowledged any potential issues.

Well, it looks like the concerns were well warranted, as they usually are now that Google is allowing replacements of the T1 and T2 labeled keys.

Titan Key Replacement steps

G Suite plain text passwords


Well, apparently Admin generated and Google generated temporary passwords have been stored in plain text for years for G Suite users. This isn't really a huge pressing issue, unless the password the admin generated was not set to be changed by the user upon next sign-in. Google only identified one of our clients as being affected, and it is a user who hasn't ever signed in. Here's what we were sent:
Dear Partner,

We are writing to inform you of a technical issue which affected your G Suite customer(s). Please see the below communication that we sent to your customer(s) which contains additional detail.

We sincerely apologize for any impact of this issue to your organization and your customers.

If you have any questions, please let us know by contacting Google Support and referencing issue number ##########.

Sincerely,

The G Suite Team

Here is the message we sent to your affected customers:

Google Customer Alert

Dear G Suite Administrator,

We are writing to inform you that due to legacy functionality that enabled customer Domain Admins to view passwords, some of your users’ passwords were stored in our encrypted systems in an unhashed format. This primarily impacted system generated or admin generated passwords intended for one-time use.

We have reviewed the login information for the user account(s) and have found no evidence that the unhashed passwords were misused.

The following is the list of users impacted in your domain(s):

List of Users
Google Planned Action: for your security, starting tomorrow Wednesday May 22, 2019 PT we will force a password change unless it has already been changed prior to that time.

Our password update methodology is as follows:

Users With Single Sign On: We will reset their password by changing it to a randomly generated secure value. Please note that this will have no effect on their ability to log in using their Single Sign On credentials.
Other Users and Super Admins: We will terminate their sessions and prompt users to change their password at their next login.
In addition, starting Wednesday, May 29, 2019 PT we will reset the password for users that have not yet selected a new password or have not had a password reset. These users will need to follow your organization’s password recovery process. Super Admins will not be impacted. For information on password recovery options please refer to the following Help Center Article.
For further questions please contact Google Support and reference issue number ##########.

Sincerely,

The G Suite Team

We've identified your customers affected by this issue below:

G Suite Passwords

All-in-all, it's just another day in the tech industry I guess.


Originally Posted to Lemacks Media https://lemacksmedia.com/news/05/22/google-security-vulnerabilities-and-updates/ , by Andrew Lemacks for updates and more content.

Comments

Post a Comment

Popular posts from this blog

Gmail confidential mode launching on by default on June 25, 2019

Image
Originally Posted on Google's G Suite Updates Blog What’s changing Earlier this year, we announced the launch of Gmail confidential mode for G Suite in beta. On June 25, 2019, this feature will become generally available and your users will have the option to send emails with confidential mode. At launch, confidential mode will be set to default ON for all domains with Gmail enabled, unless you choose to disable this feature (see instructions below). Who’s impacted Admins and end users Why you’d use it Confidential mode provides built-in information rights management controls in your emails by allowing senders to create expiration dates and revoke previously sent messages. Because a sender can require additional authentication via text message to view an email, it’s also possible to protect data even if a recipient’s email account has been hijacked while the message is active. Additionally, with confidential mode, recipients don’t have the option to...
Read more

Check out the new G Suite Learning Center

Image
Originally Posted on Google's G Suite Updates Blog What’s changing We’re launching a revamped G Suite Learning Center . Who’s impacted Admins and end users Why you’d use it This completely redesigned site features 300+ guides and customer-friendly enhancements, including: An Announcements tab with lists of new and updated Learning Center guides. A “Day 1” checklist to help new G Suite users get started on their first day. An improved search function to help you find help and training content across the G Suite Learning Center. Guides that are easier to print and save as PDFs or customize in Google Docs and Slides. How to get started Admins and end users: The new G Suite Learning Center can now be found at support.google.com/a/users, but you can still use the old web address gsuite.google.com/learning-center. Additional details This initial launch is for the English language site only. In the coming months, we’ll release our revamped Learning ...
Read more

Bulk-export Hangouts Meet hardware fleet information

Image
Originally Posted on Google's G Suite Updates Blog What’s changing We’ve added the ability to export detailed information about all Hangouts Meet hardware devices in a domain to a Google Sheet or CSV file in a single action. Who’s impacted Admins only Why you’d use it Having access to up-to-date information about all Meet devices allows G Suite admins to better understand usage across their entire organization by: Populating data for reports/dashboards Auditing organization-wide peripherals usage Analyzing data for external systems such as ticket/support system or financial functions such as asset tracking or inventory management How to get started Admins: To export your list of devices, follow the steps in the Help Center. After completion, the results will be available from the Tasks icon at the top of the page. Depending on the selected format the information can then be viewed in Google Sheets, or downloaded as a CSV file. End users: No action required Addit...
Read more