As if losing your job when the startup you work for collapses isn’t bad enough, now a security researcher has found that employees at failed startups are at particular risk of having their data stolen. This ranges from their private Slack messages to Social Security numbers and, potentially, bank accounts.
The researcher who discovered the issue is Dylan Ayrey, co-founder and CEO of Andreessen Horowitz-backed startup Truffle Security. Ayrey is best known as the creator of the popular open source project TruffleHog, which helps watch for data leaks should the bad guys gain identity login tools (i.e., API keys, passwords, and tokens).
Ayrey is also a rising star in the bug-hunting world. Last week at security conference ShmooCon, he gave a talk on a flaw he found with Google OAuth, the tech behind “Sign in with Google,” which people can use instead of passwords.
Ayrey gave his talk after reporting the vulnerability to Google and other companies that could be affected and was able to share the details of it because Google doesn’t forbid its bug hunters from talking about their findings. (Google’s decade-old Project Zero, for example, often showcases the flaws it finds in other tech giants’ products like Microsoft Windows.)
He discovered that if malicious hackers bought the defunct domains of a failed startup, they could use them to log in to cloud software configured to allow every employee in the company to have access, like a company chat or video app. From there, many of these apps offer company directories or user info pages where the hacker could discover former employees’ actual emails.
Armed with the domain and those emails, hackers could use the “Sign in with Google” option to access many of the startup’s cloud software apps, often finding more employee emails.
To test the flaw he found, Ayrey bought one failed startup’s domain and from it was able to log in to ChatGPT, Slack, Notion, Zoom, and an HR system containing Social Security numbers.
“That’s probably the biggest threat,” Ayrey told TechCrunch, as the data from a cloud HR system is “the easiest they can to monetize, and the Social Security numbers and the banking information and whatever else is in the HR systems is probably pretty likely” to be targeted. He said that old Gmail accounts or Google Docs created by employees, or any data created with Google’s apps, are not at risk, and Google confirmed.
While any failed company with a domain for sale could fall prey, startup employees are particularly vulnerable because startups tend to use Google’s apps and a lot of cloud software to run their businesses.
Ayrey calculates that tens of thousands of former employees are at risk, as well as millions of SaaS software accounts. This is based on his research that found 116,000 website domains currently available for sale from failed tech startups.
Prevention available but not perfect
Google actually does have tech in its OAuth configuration that should prevent the risks outlined by Ayrey, if the SaaS cloud provider uses it. It’s called a “sub-identifier,” which is a series of numbers unique to each Google account. While an employee might have multiple email addresses attached to their work Google account, the account should have only one sub-identifier, ever.
If configured, when the employee goes to log in to a cloud software account using OAuth, Google will send both the email address and the sub-identifier to identify the person. So, even if malicious hackers re-created email addresses with control of the domain, they shouldn’t be able to re-create these identifiers.
But Ayrey, working with one affected SaaS HR provider, discovered that this identifier “was unreliable,” as he put it, meaning the HR provider found that it changed in a very small percentage of cases: 0.04%. That may be statistically near zero, but for an HR provider handling huge numbers of daily users, it adds up to hundreds of failed logins each week, locking people out of their accounts. That’s why this cloud provider didn’t want to use Google’s sub-identifier, Ayrey said.
Google disputes that the sub-identifier ever changes. As this finding came from the HR cloud provider, not the researcher, it wasn’t submitted to Google as part of the bug report. Google says that if it ever sees evidence that the sub-identifier is unreliable, the company will address it.
Google changes its mind
But Google also flip-flopped on how important this issue was at all. At first, Google dismissed Ayrey’s bug altogether, promptly closing the ticket and saying it wasn’t a bug but a “fraud” issue. Google wasn’t completely wrong. This risk comes from hackers controlling domains and misusing email accounts they re-create through them. Ayrey didn’t begrudge Google’s initial decision, calling this a data privacy issue where Google’s OAuth software worked as intended even though users still could be hurt. “That’s not as cut and dry,” he said.
But three months later, right after his talk was accepted by ShmooCon, Google changed its mind, reopened the ticket, and paid Ayrey a $1,337 bounty. A similar thing happened to him in 2021 when Google reopened his ticket after he gave a wildly popular talk about his findings at cybersecurity conference Black Hat. Google even awarded Ayrey and his bug-finding partner Allison Donovan third prize in its annual security researcher awards (along with $73,331).
Google has not yet issued a technical fix for the flaw, nor a timeline for when it might — and it’s not clear if Google will ever make a technical change to somehow address this issue. The company has, however, updated its documentation to tell cloud providers to use the sub-identifier. Google also offers instructions to founders on how companies should properly shut down Google Workspace and prevent the problem.
Ultimately, Google says, the fix is for founders shuttering a company to make sure they properly close all of their cloud services. “We appreciate Dylan Ayrey’s help identifying the risks stemming from customers forgetting to delete third-party SaaS services as part of turning down their operation,” the spokesperson said.
Ayrey, a founder himself, understands why many founders might not have ensured their cloud services were disabled. Shuttering a company is actually a complicated process done during what could be an emotionally painful time — involving many items, from disposing of employee computers, to closing bank accounts, to paying taxes.
“When the founder has to deal with shutting the company down, they’re probably not in a great head space to be able to think about all the things they need to be thinking about,” Ayrey says.
Halo, para pencinta slot! Pernah denger semboyan “slot gaco”? Kalau belum, siap-siap jatuh hati sama konsep ini. raja slot merupakan mesin slot yang selalu kasih kemenangan. Ya, mesin-mesin ini bisa dikatakan adalah jagoannya tuk bawa pulang cuan. but, cemana sih caranya nemuin slot gacor yang benar? Tenang Bro, kita beri santai saja di tempat ini
Gaming tergaco waktu ini satu-satunya berada Indonesia hanya di yang menyediakan return on Investment tertinggi
Daftar di:
Informasi mengenai KING SLOT, Segera Daftar Bersama king selot terbaik dan terpercaya no satu di Indonesia. Boleh mendaftar melalui sini king slot serta memberikan hasil kembali yang paling tinggi saat sekarang ini hanyalah KING SLOT atau Raja slot paling gacor, gilak dan gaco saat sekarang di Indonesia melalui program return tinggi di kingselot serta pg king slot
slot demo gacor
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun demo slot gacor
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun slot demo gacor
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun demo slot pragmatic
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun slot demo pragmatic
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun slot demo
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
akun demo slot
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama kdwapp.com
slot demo gacor
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun demo slot gacor
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun slot demo gacor
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun demo slot pragmatic
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun slot demo pragmatic
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun slot demo
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
akun demo slot
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama jebswagstore.com
slot demo gacor
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun demo slot gacor
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun slot demo gacor
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun demo slot pragmatic
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun slot demo pragmatic
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun slot demo
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
akun demo slot
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama demoslotgacor.pro
slot demo gacor
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun demo slot gacor
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun slot demo gacor
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun demo slot pragmatic
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun slot demo pragmatic
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun slot demo
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
akun demo slot
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
situs slot terbaru
situs slot terbaru permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
slot terbaru
slot terbaru permainan paling top dan garansi imbal balik hasil besar bersama situsslotterbaru.net
sewaapartemen permainan paling top dan garansi imbal balik hasil besar bersama sewaapartemen.org
pipapvc permainan paling top dan garansi imbal balik hasil besar bersama pipapvc.org
pialaeropa2028 permainan paling top dan garansi imbal balik hasil besar bersama pialaeropa2028.net
pialadunia2026 permainan paling top dan garansi imbal balik hasil besar bersama pialadunia2026.asia
bahanbangunan permainan paling top dan garansi imbal balik hasil besar bersama bahanbangunan.org
gemini999 permainan paling top dan garansi imbal balik hasil besar bersama gemini999.org
havana888 permainan paling top dan garansi imbal balik hasil besar bersama havana888.net
indonesia88 permainan paling top dan garansi imbal balik hasil besar bersama indonesia88.info
inspirasi permainan paling top dan garansi imbal balik hasil besar bersama inspirasi.info
jokiwin88 permainan paling top dan garansi imbal balik hasil besar bersama jokiwin88.org
oli88 permainan paling top dan garansi imbal balik hasil besar bersama oli88.org
situs88 permainan paling top dan garansi imbal balik hasil besar bersama situs88.asia
transfermarkt88 permainan paling top dan garansi imbal balik hasil besar bersama transfermarkt88.com
rossi46 permainan paling top dan garansi imbal balik hasil besar bersama rossi46.com
pecco88 permainan paling top dan garansi imbal balik hasil besar bersama pecco88.com
pecco permainan paling top dan garansi imbal balik hasil besar bersama pecco.asia
pangkas permainan paling top dan garansi imbal balik hasil besar bersama pangkas.net
facebook88 permainan paling top dan garansi imbal balik hasil besar bersama facebook88.com
depo88 permainan paling top dan garansi imbal balik hasil besar bersama depo88.asia
bajaringan88 permainan paling top dan garansi imbal balik hasil besar bersama bajaringan88.com
baja ringan permainan paling top dan garansi imbal balik hasil besar bersama bajaringan.asia
tradingview88 permainan paling top dan garansi imbal balik hasil besar bersama tradingview88.com
trading88 permainan paling top dan garansi imbal balik hasil besar bersama trading88.org
tokopedia88 permainan paling top dan garansi imbal balik hasil besar bersama tokopedia88.net
kualifikasi permainan paling top dan garansi imbal balik hasil besar bersama kualifikasi.net
grosirboneka permainan paling top dan garansi imbal balik hasil besar bersama grosirboneka.net
situsgacor permainan paling top dan garansi imbal balik hasil besar bersama situsgacor.news
prediksi88 permainan paling top dan garansi imbal balik hasil besar bersama prediksi88.biz
keramat88 permainan paling top dan garansi imbal balik hasil besar bersama keramat88.biz
cnn88 permainan paling top dan garansi imbal balik hasil besar bersama cnn88.asia
cnbc88 permainan paling top dan garansi imbal balik hasil besar bersama cnbc88.com
bloomberg88 permainan paling top dan garansi imbal balik hasil besar bersama bloomberg88.com
antibocor88 permainan paling top dan garansi imbal balik hasil besar bersama antibocor88.com
buku88 permainan paling top dan garansi imbal balik hasil besar bersama buku88.org
dukun88 permainan paling top dan garansi imbal balik hasil besar bersama dukun88.info
indodax88 permainan paling top dan garansi imbal balik hasil besar bersama indodax88.net
investing88 permainan paling top dan garansi imbal balik hasil besar bersama investing88.net
makanan88 permainan paling top dan garansi imbal balik hasil besar bersama makanan88.net
pakaian88 permainan paling top dan garansi imbal balik hasil besar bersama pakaian88.com
rambo88 permainan paling top dan garansi imbal balik hasil besar bersama rambo88.info
santet88 permainan paling top dan garansi imbal balik hasil besar bersama santet88.net
sekolah88 permainan paling top dan garansi imbal balik hasil besar bersama sekolah88.org
uno88 permainan paling top dan garansi imbal balik hasil besar bersama uno88.info
starlink88 permainan paling top dan garansi imbal balik hasil besar bersama starlink88.org
solitaire88 permainan paling top dan garansi imbal balik hasil besar bersama solitaire88.net
roblox88 permainan paling top dan garansi imbal balik hasil besar bersama roblox88.org
pubg88 permainan paling top dan garansi imbal balik hasil besar bersama pubg88.info
motogp88 permainan paling top dan garansi imbal balik hasil besar bersama motogp88.net
motivasi88 permainan paling top dan garansi imbal balik hasil besar bersama motivasi88.com
mobilelegends88 permainan paling top dan garansi imbal balik hasil besar bersama mobilelegends88.com
ludoking permainan paling top dan garansi imbal balik hasil besar bersama ludoking.asia
kucing88 permainan paling top dan garansi imbal balik hasil besar bersama kucing88.asia
kucing permainan paling top dan garansi imbal balik hasil besar bersama kucing.info
klasmen88 permainan paling top dan garansi imbal balik hasil besar bersama klasmen88.com
imdb88 permainan paling top dan garansi imbal balik hasil besar bersama imdb88.net
higgsdomino permainan paling top dan garansi imbal balik hasil besar bersama higgsdomino.biz
gmail88 permainan paling top dan garansi imbal balik hasil besar bersama gmail88.org
gmail88 permainan paling top dan garansi imbal balik hasil besar bersama gmail88.net
chess88 permainan paling top dan garansi imbal balik hasil besar bersama chess88.info
callofduty88 permainan paling top dan garansi imbal balik hasil besar bersama callofduty88.com
semen88 permainan paling top dan garansi imbal balik hasil besar bersama semen88.com
seluler88 permainan paling top dan garansi imbal balik hasil besar bersama seluler88.com
ram88 permainan paling top dan garansi imbal balik hasil besar bersama ram88.net
pasir88 permainan paling top dan garansi imbal balik hasil besar bersama pasir88.asia
papan88 permainan paling top dan garansi imbal balik hasil besar bersama papan88.info
komputer88 permainan paling top dan garansi imbal balik hasil besar bersama komputer88.net
kayu88 permainan paling top dan garansi imbal balik hasil besar bersama kayu88.info
kabel88 permainan paling top dan garansi imbal balik hasil besar bersama kabel88.net
gaming88 permainan paling top dan garansi imbal balik hasil besar bersama gaming88.asia
games88 permainan paling top dan garansi imbal balik hasil besar bersama games88.info
beton88 permainan paling top dan garansi imbal balik hasil besar bersama beton88.lat
teknis88 permainan paling top dan garansi imbal balik hasil besar bersama teknis88.com
sarana88 permainan paling top dan garansi imbal balik hasil besar bersama sarana88.info
arena88 permainan paling top dan garansi imbal balik hasil besar bersama arena88.asia
viral888 permainan paling top dan garansi imbal balik hasil besar bersama viral888.asia
usdt88 permainan paling top dan garansi imbal balik hasil besar bersama usdt88.net
uang88 permainan paling top dan garansi imbal balik hasil besar bersama uang88.asia
twitter88 permainan paling top dan garansi imbal balik hasil besar bersama twitter88.asia
tahanlama88 permainan paling top dan garansi imbal balik hasil besar bersama tahanlama88.com
suka88 permainan paling top dan garansi imbal balik hasil besar bersama suka88.biz
sekali88 permainan paling top dan garansi imbal balik hasil besar bersama sekali88.org
plafonpvc permainan paling top dan garansi imbal balik hasil besar bersama plafonpvc.net
pinjol88 permainan paling top dan garansi imbal balik hasil besar bersama pinjol88.asia
mpox88 permainan paling top dan garansi imbal balik hasil besar bersama mpox88.com
daun88 permainan paling top dan garansi imbal balik hasil besar bersama daun88.asia
wordpress88 permainan paling top dan garansi imbal balik hasil besar bersama wordpress88.net
whatsapp88 permainan paling top dan garansi imbal balik hasil besar bersama whatsapp88.net
wechat88 permainan paling top dan garansi imbal balik hasil besar bersama wechat88.net
telegram88 permainan paling top dan garansi imbal balik hasil besar bersama telegram88.org
super888 permainan paling top dan garansi imbal balik hasil besar bersama super888.asia
skype88 permainan paling top dan garansi imbal balik hasil besar bersama skype88.com
racing88 permainan paling top dan garansi imbal balik hasil besar bersama racing88.asia
pupuk88 permainan paling top dan garansi imbal balik hasil besar bersama pupuk88.net
petani888 permainan paling top dan garansi imbal balik hasil besar bersama petani888.org
pabrik88 permainan paling top dan garansi imbal balik hasil besar bersama pabrik88.asia
organik88 permainan paling top dan garansi imbal balik hasil besar bersama organik88.com
online77 permainan paling top dan garansi imbal balik hasil besar bersama online77.info
ojek88 permainan paling top dan garansi imbal balik hasil besar bersama ojek88.info
nostalgia88 permainan paling top dan garansi imbal balik hasil besar bersama nostalgia88.com
michat permainan paling top dan garansi imbal balik hasil besar bersama michat.info
