Losing a job when a startup collapses is tough enough, but a newly uncovered vulnerability adds another layer of concern. Employees at failed startups may face a heightened risk of having their personal data stolen, from private messages on Slack to Social Security numbers and bank account details.

The Problem: Old Google Logins and Defunct Domains

Dylan Ayrey, co-founder and CEO of Truffle Security, discovered a flaw related to Google OAuth, the technology behind “Sign in with Google.” His findings, presented at the ShmooCon security conference, reveal how hackers could exploit old domains from defunct startups to access sensitive data.

Here’s how it works:

Hackers purchase the expired domain of a failed startup.
With the domain, they can recreate email addresses previously used by the startup’s employees.
Using the “Sign in with Google” option, hackers can access cloud-based software tied to the company, such as Slack, ChatGPT, Zoom, or HR systems.
From these platforms, they can uncover employee information and potentially sensitive data like Social Security numbers or banking details stored in HR systems.

Ayrey tested the vulnerability by purchasing a defunct startup’s domain, successfully gaining access to multiple cloud platforms. He identified HR systems as the greatest risk, given the valuable personal information they often store.

Why Startups Are Particularly Vulnerable

Startups are frequent users of Google Workspace and cloud-based tools, making them prime targets for this type of exploit. Ayrey estimates that tens of thousands of former employees and millions of SaaS accounts could be at risk. His research identified 116,000 domains from failed tech startups currently available for purchase.

A Flawed Fix: Google’s Sub-Identifier

Google offers a solution within its OAuth configuration called a “sub-identifier.” This unique numeric code, tied to a Google account, should prevent hackers from using recreated email addresses to access cloud services. However, implementation challenges have limited its effectiveness:

An affected SaaS HR provider found that sub-identifiers changed in 0.04% of cases, creating login issues for legitimate users.
As a result, some providers opt not to use this feature.

Google disputes claims that sub-identifiers can change and has not addressed this issue in a technical fix, instead urging cloud providers to implement the sub-identifier.

Google’s Response

Initially, Google dismissed Ayrey’s findings, categorizing them as a “fraud” issue rather than a technical flaw. However, three months later, after Ayrey’s ShmooCon talk was accepted, Google reopened the case, awarded Ayrey a $1,337 bounty, and updated its documentation to emphasize the importance of using the sub-identifier.

Google has also provided guidance for founders on properly shutting down Google Workspace accounts to prevent such vulnerabilities. However, the company has yet to issue a broader technical solution or timeline for addressing the problem.

Prevention: A Shared Responsibility

While Google’s tools function as intended, the issue highlights a gap in how companies wind down operations. Founders often overlook the need to properly close cloud services during the emotionally and logistically challenging process of shutting down a business.

“When the founder has to deal with shutting the company down, they’re probably not in a great headspace to think about all the things they need to be doing,” Ayrey said.

What Employees Can Do

For individuals, there’s little they can do to address vulnerabilities caused by their former employers. However, staying vigilant about suspicious activity and securing personal accounts with strong, unique passwords and two-factor authentication can provide some level of protection.

As startups continue to leverage cloud services, the risk of data exposure during shutdowns remains a pressing concern. Companies, cloud providers, and employees alike must prioritize security to mitigate potential threats.

Source