Google corrects two vulnerabilities that revealed the email linked to YouTube users

Google has corrected two vulnerabilities present in its services that allowed you to achieve the YouTube Accounts Email address, even anonymous users.

Gaia’s identifier (ID) is the system that manages the unique IDs of each user for all Google products, that is, it is the same in Gmail, Drive, YouTube and other services. It is a fact that the company shares with its systems internally, however, for months it has allowed to know the emails associated with users.

The process begins on YouTube, from where a user can be blocked and make this blockade active in several of Google services, something possible from a live chat or in the notification entrance tray.

In this case, the researcher known as Brutecat, using a YouTube API, agreed to Gaia Officado of a user who had blocked from the live chat in any ‘streaming’, identified together with his YouTube channel.

Together with Nathan, another researcher, expanded the analysis of Google services that could have some non -corrected error, for example, those who had become obsolete, and allow to find out the ’email’ of a person from an id of an ID of Gaia.

Thus, they arrived at the Pixel recorder, which stores the backup copies of the recordings on the website https://recorder.google.com, with a web API that served for its purpose.

Here, Nathan made a recording from his Pixel device and synchronized it in his Google account to appear on that website. When trying to share this recording with an email they had as a test, the API returned the email linked to Gaia’s ID.

Then, both decided to link these two errors and from the recorder website, introduce the Gaia ID of a previously blocked user on YouTube, which showed the email of this person.

This action, however, sends a notification to the victim’s mail, although the researchers solved this problem by sharing the recording with an extremely long name (in their test, 2.5 million letters).

These failures have been paved in February, although they identified in September of last year. Google has rewarded researchers with $ 10,633 (about 10,258 euros to change).