Fact Check: Brutecat found that Google's account recovery forms worked without JavaScript, which contributed to the vulnerability.

Fact Check: "Brutecat found that Google's account recovery forms worked without JavaScript, which contributed to the vulnerability."

What We Know

The claim centers around a vulnerability discovered by a security researcher known as Brutecat, who reported that Google's account recovery forms could function without JavaScript enabled. This finding was surprising because, historically, these forms relied on JavaScript for anti-abuse measures, particularly through a system called BotGuard, which used obfuscated JavaScript code to prevent automated attacks (Bruteforcing the phone number of any Google user).

Brutecat detailed a process where the username recovery form allowed users to check if a recovery email or phone number was associated with a specific display name using just two HTTP requests, even when JavaScript was disabled. This capability was exploited to potentially uncover users' phone numbers through brute-force methods (Google brute-force attack exposes phone numbers in ...).

Analysis

The evidence provided by Brutecat is credible, as it is supported by detailed technical descriptions of the vulnerability and the methods used to exploit it. The researcher explicitly noted that the account recovery forms worked without JavaScript, which was unexpected given the reliance on JavaScript for security in previous iterations of the service (Bruteforcing the phone number of any Google user).

Multiple reputable sources corroborate the existence of this vulnerability. For instance, reports from Malwarebytes and Dark Reading confirm that the flaw allowed attackers to brute-force phone numbers tied to Google accounts, emphasizing the implications for user privacy and security.

However, it is important to consider the context of the reporting. While Brutecat's findings were significant, Google responded by patching the vulnerability quickly and awarding the researcher $5,000 as part of their bug bounty program, indicating that they took the issue seriously (Google fixes bug that could reveal users' private phone ...).

The reliability of the sources reporting on this incident is generally high, as they are well-known in the cybersecurity community and have a history of accurate reporting on similar issues. However, the potential for bias exists in how the severity of the vulnerability is portrayed, particularly in the context of Google's rapid response and the relatively modest bounty awarded.

Conclusion

The claim that "Brutecat found that Google's account recovery forms worked without JavaScript, which contributed to the vulnerability" is True. The evidence presented by Brutecat, along with corroborating reports from multiple reputable sources, confirms that the account recovery forms indeed functioned without JavaScript, which was a significant factor in the identified vulnerability. Google's acknowledgment and subsequent patching of the issue further validate the seriousness of the findings.

Sources

1. Bruteforcing the phone number of any Google user
2. Google brute-force attack exposes phone numbers in ...
3. Google bug allowed phone number of almost any user to ...
4. Google Bug Allowed Brute-Forcing of Any User Phone ...
5. Researcher Found Flaw to Discover Phone Numbers ...
6. Google patched bug leaking phone numbers tied to accounts
7. Google fixes bug that could reveal users' private phone ...
8. This Google account vulnerability could have revealed ...