Abandoned Online Domains Unlock Services with Google Sign On

A security researcher purchased abandoned online domains belonging to failed startups and found he could recreate email addresses and access third party services containing sensitive information collected by the shuttered companies.

See Also: Fireside Chat | The Role of AI in Mitigating Identity Risks and Ensuring Compliance

The researcher, Dylan Ayrey wrote Wednesday he was able to access services such as HR platforms and Slack by logging onto them with “Sign in with Google.” Among the documents he was able to access: tax documents, pay stubs and Social Security numbers.

The security failure, he contended in a blog post, stemmed from Google’s use of domain ownership and email addresses as authentication methods. From the perspective of a third party service such as Slack, “ownership changes to the domain won’t look any different,” Ayrey asserted.

Google contends otherwise: the problem, it says, comes from the third party services which have allowed email identifiers to take the place of another a Google Sign In unique ID token identifier that does not travel with changes in domain ownership, the sub field.

Ayrey wrote the sub field is inconsistent. A staff engineer at a major tech company, he said, told him that sub identifiers change in about .04% of logins – a small percentage but one that at a large enterprise can amount to hundreds of account lockouts per week.

“We’ll happily examine any materials on this, but we’ve seen no evidence to support the assertion that the sub field is not an immutable and unique identifier,” a Google spokesperson said.

Ayrey wrote that when he first contacted Google in September 2024 to flag the problem, the company said it would not track the issue as a bug. Sign in with Google was “working as intended,” Ayrey said Google told him.

After his research was accepted for presentation earlier this month at the Shmoocon conference, Google awarded him a bounty of $1337 – the numbers meaning “elite” in leetspeak, a once-fashionable method among computer aficionados for mixing keyboard numbers and symbols with letters.

Google in a statement said it advises customers closing up shop to cancel out their Google Workspace subscription. It also amplified warnings that email accounts shouldn’t be used as unique user identifiers.

“To be clear: a fix wasn’t necessary because a strong and appropriate protection is already in place,” the Google spokesperson said.

With reporting from Information Security Media Group’s David Perera in Washington, D.C.