How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/

by trendspotter • 14 years ago

477 101 14 years ago

"Harris wasn’t interested in the job at Google, but he decided to crack the key and send an e-mail to Google founders Brin and Page, as each other, just to show them that he was onto their game."

jfc• 14 years ago

I hope this guy's inbox is full of job offers. That's a heck of a find.

clicks• 14 years ago

http://www.linkedin.com/in/drzacharyharris

Wow, the guy's a monster. Fluent in classical (and Levantine) Arabic, Chinese, Greek; Top Putnam score (twice), teacher, Christian missionary. Sounds like he's got drive.

jnhnum12• 14 years ago

Nit-picky corrections:

1. Top Putnam score in Colorado. There's a pretty big difference between that, and say, top Putnam score in Massachusetts (which is more likely the same as top overall due to many Putnam Fellows coming from Harvard or MIT).

2. Elementary proficiency in Classical and Leventine Arabic, Mandarin Chinese, and Koine Greek

pgsandstrom• 14 years ago

Dangerous move, other companies have would set the police on him for that stunt.

alexchamberlain3• 14 years ago

There are a lot of stories of people getting jobs by disclosing security holes like this.

jere• 14 years ago

>But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.

Yes, I can see it now: Iran endures crushing sanctions in order to pursue spam email program.

theycallmemorty• 14 years ago

SPAM is not the only attack that can be carried out with this kind of exploit.

jlgreco• 14 years ago

The rule of thumb that I have heard, and seen played out, is that there are basically 3 tiers of who can factor what. governments or government sized companies (upper millions, or billions sized budgets), modestly sized companies / research projects (millions), or hobbyists. Each can handle about 256 bits more than the next, and the time for one to reach the capabilities of the other is somewhere between 5 to 10 years.

Hobbyists have been factoring 512bit keys on a whim for a few years now, so....

Cogito• 14 years ago

Full article: http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-...

DanBC2• 14 years ago

> Harris thought there was no way Google would be so careless, so he concluded it must be a sly recruiting test to see if job applicants would spot the vulnerability. Perhaps the recruiter was in on the game; or perhaps it was set up by Google’s tech team behind the scenes, with recruiters as unwitting accomplices.

Ha! That's optimistic.

Xion• 14 years ago

Or paranoid. Or naive. Or narcissistic.

It might be somewhat feasible if they wanted him to be security engineer, not a devop. Still, he expected they have set up what essentially is an elaborate prank just to send a cold-call email to just one of probably numerous potential candidates.

How likely this is? What would be the risk-to-reward ratio for doing that, considering that many of unsolicited recruiting mails are not even read? Isn't it more feasible for it to be a genuine mistake on their part? Google's not infallible, omnipotent being after all.

spindritf• 14 years ago

They could send a large number of recruitment e-mails crafted like that at negligible cost, not specifically for that one guy, and see who catches it. A little far-fetched but within the realm of possibility with a company known for geeky stuff.

rachelbythebay• 14 years ago

Back when I believed the hype, I made the same mistake with materials from Google's recruiters. They gave me driving instructions from SJC which left me in the wrong part of the valley on a Friday night during rush hour (this was before smartphone navigation). I figured it was some kind of test. It wasn't.

I called it my "cleverness attribution error" and wrote about it this summer: http://rachelbythebay.com/w/2012/06/19/attrib/

I've run into it in a few other places, too.

wisty• 14 years ago

Google has done this kind of stunt in the past. Remember {first 10-digit prime found in consecutive digits of e}.com?

tptacek13• 14 years ago

DKIM is an anti-spam mechanism. It does not authenticate the sender of an email message; to do that, use something like PGP. This is an interesting story, but it's not a story about a "massive net security hole". Mail on the Internet has always been spoofable.

Erwin• 14 years ago

Gmail (possibly Hotmail) put a little lock icon next to DKIM authenticated email from some senders, such as eBay & PayPal and outright reject unauthenticated emails from such domains. They've flaunted this feature in the past

So if an authenticated PayPal email pops up in your Gmail inbox saying you must do this and that to unlock your account, you may be more likely to do so due to the legitimacy of DKIM.

tptacek13• 14 years ago

The reality is that people will act on "Paypal" mail that comes from "Payapal.ng". Let's not pretend that DKIM has much to do with that decision. I agree, though, that the little lock in the Gmail UI is misleading.

__alexs• 14 years ago

Does that Padlock really have anything to do with DKIM or SPF? I thought it was just some magically hard coded thing for eBay and PayPal messages. My own DKIM signed messages certainly don't get it.

alexchamberlain3• 14 years ago

It authenticates the domain of the sender, right?

tptacek13• 14 years ago

If you want to impute that much authority to it, sure, but the actual signature verification depends on the insecure DNS anyways. Do not make security decisions based on DKIM. It's an anti-spam mechanism and that's all.

rsingel4• 14 years ago

Are you saying that 1) anti-spam is not about about security and that 2) DKIM, even if properly implemented, doesn't make spoofing harder and security better?

tptacek13• 14 years ago

I'm saying that DKIM is an anti-spam mechanism, and that there are real ways to authenticate the actual sender of a message, like PGP or S/MIME. Calling a cracked DKIM key a "massive Internet security hole" is like calling a bug in SpamAssassin a "massive Internet security hole".

seanica6• 14 years ago

“A 384-bit key I can factor on my laptop in 24 hours,” he says. “The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those. Then there are the 768-bit keys. Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.”

"But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda.

Did you know this month is National Cyber Security Awareness Month, as advertized by the DHS?

http://www.dhs.gov/national-cyber-security-awareness-month

philh2• 14 years ago

> At this point I stopped reading, as this article became propaganda.

Even if that was true (it's not), how could you know it without reading further?

seanica6• 14 years ago

What's not true? (what's 'it' that you talk about)

darkarmani• 14 years ago

> "But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda.

How is that propaganda? You don't think most countries have that kind of computing power?

seanica6• 14 years ago

> How is that propaganda?

defn: "Information, esp. of a biased or misleading nature, used to promote or publicize a particular political cause or point of view"

http://mw1.merriam-webster.com/dictionary/propaganda

2: the spreading of ideas, information, or rumor for the purpose of helping or injuring an institution, a cause, or a person

3 : ideas, facts, or allegations spread deliberately to further one's cause or to damage an opposing cause; also : a public action having such an effect

> You don't think most countries have that kind of computing power?

The quote itself states that: "...or a large group with sufficient computing resources could pull it off."

I think you may have misunderstood my point of view. The point is, in his quote, the interviewee (Zachary Harris) singled out Iran. As it stands it is an out-of-the-blue assertion.

Aardwolf• 14 years ago

That's your choice if you don't want to read information if it contains certain sentences. No need to tell the rest of the world about it.

seanica6• 14 years ago

The same could be said about your comment. Touché.

jgrahamc2• 14 years ago

Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be...

dredge• 14 years ago

I was just writing that!

It was on HN too, of course: http://news.ycombinator.com/item?id=1442385

I was surprised then that anyone would be using a 512-bit RSA key in the wild, let alone now.

Evbn8• 14 years ago

So this is one key, used for all a domain's email for a long time, right? How lazy must you be to use an under specced key?

jrabone2• 14 years ago

Plenty of crappy DNS web admin "tools" limit the maximum length of a TXT record. Sometimes it's harder than just typing "1024" instead of "512"...

tptacek13• 14 years ago

I'm curious to hear what you think about DKIM in general.

jgrahamc2• 14 years ago

At one time DKIM and SPF were good indicators that an email was spam because spammers adopted it so that their mail looked more legit.

I never look at DKIM or SPF. If I really care about who a message comes from I use PGP. It's a handy input for learning spam filters that use it as one piece of information, but it has about a 10% failure rate (legit mail where the signature fails to verify because of message manipulation in transit). It's most useful if the domain it's matching against is also trusted in some way. For example, a good signature against google.com is likely to mean the mail is good; a good signature against frohfuwehfwo.biz is not very helpful unless we know that that domain always sends spam.

Also, the most important piece of mail I ever received (from the Prime Minister's office) came without SPF or DKIM and I authenticated it by calling the office. In general, external authentication like that tends to reassure me.

Sami_Lehtinen• 14 years ago

Well, afaik key length isn't the problem. Weak algo is. I assume they use RSA, they should use ECC. 512 bits is more than enough.

https://www.nsa.gov/business/programs/elliptic_curve.shtml

tptacek13• 14 years ago

You can't use ECC for DKIM.

mikeash2• 14 years ago

That doesn't make much sense. There are key lengths for which RSA is strong, and key lengths for which ECC is weak.

ECC keys may be stronger at shorter lengths, but that hardly means that key length isn't the problem. After all, using a longer key would fix this problem.

dfox• 14 years ago

Using ECC would solve this particular problem, because in both DKIM and DNSSEC usage of key lengths of 512 to 768 bits and not more are motivated by what can fit into one UDP DNS reply packet. Also for RSA signature size is equal to key length, and not some small multiple of security parameter and you don't want to expand messages by including large signature that might well be larger than actual payload.

Evbn8• 14 years ago

Props to Wired for disclosing that their silly phony photo setups are phony. I found that comforting.

Props to Google for fixing the problem instantly.

Weird that he thought the email was phony based on content. Who wouldn't want a computer savvy math genius on their team? Google has lots.

meshko2• 14 years ago

Google very rarely hires pure mathematicians AFAIK.

meshko2• 14 years ago

I find it cute how clueless mathematicians and physicists are about how clueless we (programmers) are. Weak crypto? Assume it is a puzzle!

tolos• 14 years ago

What a happy ending, no threats of jail or lawsuits.

scotty79• 14 years ago

It's still bit of a let down that they didn't contacted him in any way. They could at least track him and since he is a well meaning guy they could send him something funny.

suyash• 14 years ago

What is the Direct Link to this guy's website?

eranation• 14 years ago

Ok, this got me scared, checked with Sendgrid support,of course they use 1024, back to breathing again.

seacond2• 14 years ago

Seems to be some conflation in this thread. Are DKIM and authentication (PGP) really comparable in practice?

Here's my take: DKIM is an attempt by _third parties_ (i.e. "email providers", not the author or the recipient of the message) to control who can send email (but guess what? anyone can send email, go figure). On the other hand, authentication (PGP) is an attempt to allow senders to sign messages and receivers to verify signatures (no third parties needed).

Bob printed his PGP public key on a card and gave it to Alice when they had lunch. He then signed an email message the following week using PGP and sent it to Alice. But Bob's "email provider" decided to block Bob's message because Bob didn't pay money to someone for the use of a "domain name" and Bob's "email provider" thought his email was "spam" because he hadn't been "authorized" (by paying money for use of a domain name) to send email.

snowwrestler• 14 years ago

DKIM is not the only tool for catching spoofed emails; to my knowledge SPF is more widely used because it is much easier to set up. I'd be shocked if the little Larry/Sergei joke email made it to their inbox since it would fail the SPF lookup.

samuellb• 14 years ago

Yes lots of sites have SPF, but what I've seen most sites set it to soft-fail mode.

I think this is because SPF is still sometimes broken in practice. For example, it can fail when there are misconfigured e-mail forwarding (e.g. mail aliases) at _other_ peoples servers[1]. Or with web forms that set the envelope sender to the "From" field in web page...

http://en.wikipedia.org/wiki/Email_forwarding#Forwarding_ver...

Kliment• 14 years ago

I got one of those emails too once. I still can't figure out why. I did post to LKML a couple times in the past, but I haven't done anything kernel in over a decade. And a random Google recruiter emails me to congratulate me on my experience and offer me an unspecified position as a SRE. Not only do I have zero experience or interest in sysadmin and large server type stuff, they don't even have any facilities within 400km of me. What the fuck, Google?

HerraBRE• 14 years ago

In my experience (ex-Googler here), recruiters tend to be contractors who work off a script and get bonuses proportionate to how many people end up in the hiring pipeline. There are checks and balances to prevent outright spam, but the motivations are aligned in such a way that a pretty wide net is cast.

Also, until you have interviewed, all positions are "unspecified". Many positions need to be filled and they don't pick one for you until they know what you can do.

Geography is not really considered to be an issue. Once SRE finds someone they really want they will help with relocation.

cyber• 14 years ago

Also an ex-Googler here, they cast the net far and wide trying to pick up SRE. When I was there they were offering significant bounties for submitting recommendations that only had to make it pass the resume screen. Want a brand new shiny PS3? Less than 10* that made it past the resume screen, and it was yours.

I has additionally heard rumors that recruiters were so silo'ed that they would actually just throw away a resume rather than route it. Reason being that they were in a competition with all recruiters, and worst performers (based strictly on a numbers game) didn't get their contracts renewed.

*May have been as low as less than 5, its been a few years, and I never really took to memorize what was posted on the wall while I was at the urinal.

wia• 14 years ago

Sloppy work by affected companies since RFC was unambiguous. But why didn't RFC keep it consistent by requiring verifiers to only work with the same minimum key length?

RFC 4871 (sorry for formatting but ipad issue) " signers MUST use RSA keys of at least 1024 bits for long-lived keys. Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys. Verifier policies may use the length of the signing key as one metric for determining whether a signature is acceptable.

   Factors that should influence the key size choice include the
   following:

   o  The practical constraint that large (e.g., 4096 bit) keys may not
      fit within a 512-byte DNS UDP response packet

   o  The security constraint that keys smaller than 1024 bits are subjec to offline attacks..."

How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

Related Stories