As if losing your job when the startup you work for collapses isn’t bad enough, now a security researcher has found that employees of failed startups are at particular risk of having their data stolen. This ranges from their private Slack messages to Social Security numbers and, possibly, bank accounts.

The researcher who discovered the issue is Dylan Ayrey, co-founder and CEO of Andreessen Horowitz-backed startup Truffle Security. Ayrey is best known as the creator of the popular open source project TruffleHog, which helps detect data leaks when bad actors acquire identity login tools (ie, API keys, passwords , and tokens).

Ayrey is also a rising star in the bug hunting world. Last week at security conference ShmooConhe gave a talk on a flaw he found in Google OAuth, the technology behind “Sign in with Google,” which people use instead of passwords.

Ayrey gave his speech after reporting the vulnerability to Google and other companies that may be affected and was able to share its details because Google does not prohibit its bug hunters from speaking about their findings. . (Google’s decade-old Project Zerofor example, often showing errors it finds in other products of technology giants such as Microsoft Windows.)

He discovered that when malicious hackers buy defunct domains of a failed startup, they can use them to log into cloud software configured to allow every employee of the company to have access, such as in the company’s chat or video app. From there, many of these apps offer company directories or user information pages where the hacker can discover the actual emails of former employees.

Using the domain and those emails, hackers can use the “Sign in with Google” option to access multiple cloud software applications at startup, often finding multiple employee emails. .

To test the error he found, Ayrey bought a failed startup domain and from it logged into ChatGPT, Slack, Notion, Zoom, and an HR system with Social Security numbers. .

“That’s probably the biggest threat,” Ayrey told TechCrunch, because the data from a cloud HR system is “the easiest they can be to monetize, and the Social Security numbers and the information in banking and anything else in HR systems is likely to be targeted. He said old Gmail accounts or Google Docs created by employees, or any data created using Google apps. , not dangerous, and confirmed by Google.

While any failed company with a domain for sale could fall victim, startup employees are especially vulnerable because startups tend to use Google apps and a lot of cloud software to run their businesses.

Ayrey estimates that tens of thousands of former employees are at risk, as well as millions of SaaS software accounts. This is based on his research that found 116,000 website domains currently available for sale from failed technology startups.

Control is available but not perfect

Google actually has tech in its OAuth configuration that should prevent the risks outlined by Ayrey, if the SaaS cloud provider uses it. This is called a “sub-identifier,” which is a series of numbers unique to each Google account. While an employee can have multiple email addresses attached to their work Google account, the account must have only one sub-identifier, always.

If configured, when the employee goes to log into a cloud software account using OAuth, Google will send the email address and the sub-identifier to identify the person. So, even if malicious hackers recreate email addresses with domain control, they don’t necessarily recreate these identifiers.

But Ayrey, working with an affected SaaS HR provider, discovered that this identifier was “unreliable,” as he said, meaning the HR provider found it had changed in a very small percentage of cases: 0.04 %. That may be a statistic close to zero, but for an HR provider that manages many daily users, it adds up to hundreds of failed logins every week, locking people out of their accounts. account. That’s why this cloud provider doesn’t want to use Google’s sub-identifier, Ayrey said.

Google argues that the sub-identifier is constantly changing. As this search came from the HR cloud provider, not the researcher, it was not submitted to Google as part of the bug report. Google says that if it finds evidence that the sub-identifier is unreliable, the company will respond to it.

Google changed its mind

But Google is also ignoring how important this issue is. At first, Google dismissed Ayrey’s bug entirely, quickly closing the ticket and saying it wasn’t a bug but a “fraud” issue. Google is not entirely wrong. This risk comes from hackers taking control of domains and abusing the email accounts they recreate through them. Ayrey did not take issue with Google’s initial decision, calling it a data privacy issue where Google’s OAuth software was working as intended even though users might have been hurt. “That’s not as cut and dry,” he said.

But three months later, after ShmooCon accepted his talk, Google changed its mind, reopened the ticket, and paid Ayrey a $1,337 bounty. A similar thing happened to him in 2021 when Google reopened his ticket after he gave a famous speech about his findings at the Black Hat cybersecurity conference. Google even awarded Ayrey and his bug-finding partner Allison Donovan the third annual security researcher prize awards (with $73,331).

Google has not yet issued a technical fix for the bug, or a timeline for when it might be available — and it’s unclear whether Google will make a technical change to address it. issue. The company, however, has updated it documentation to tell cloud providers to use the sub-identifier. Google also offers instructions to the founders of how companies can shut down Google Workspace and prevent the problem.

Ultimately, Google said, the fix is ​​for founders who shut down a company to make sure they properly shut down all of their cloud services. “We appreciate Dylan Ayrey’s help in identifying the risks that arise from customers forgetting to opt-out of third-party SaaS services as part of their denial of service,” the spokesperson said.

Ayrey, a founder himself, understands why many founders can’t make sure their cloud services are disabled. Shutting down a company is actually a complex process done during what can be an emotionally painful time — involving many things, from disposing of employee computers, to closing accounts. in the bank, until the tax is paid.

“If the founder has to deal with shutting down the company, they’re probably not in a big head space to think about all the things they need to think about,” Ayrey said.