Domain owners flummoxed as strangers get Google for their  domains.

G Suite Sours

All aboard! Climb up on the Brian Krebs cycle: Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services

“Circumvent email verification”
Google … fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services. … Google said it fixed the problem within 72 hours of discovering it, and that the company has added additional detection to protect against these types of authentication bypasses.
…
Anu Yamunan, director of abuse and safety protections at Google Workspace, [said] “The tactic here was to create a specifically-constructed request … to circumvent email verification during the signup process. … They would use one email address to try to sign in, and a completely different email address to verify a token. Once they were email verified, in some cases we have seen them access third party services using Google single sign-on.”

Google Whosit? Pradeep Viswanathan explains what this Google Workspace thing is:

“Lack of transparency”
Google Workspace allows businesses to create professional email addresses using their company’s domain name, such as [email protected]. Businesses can also access Google Drive, Gmail calendars, Google Meet, and more through a Google Workspace account.
…
Google recently found that hackers were able to bypass the email verification system, which is needed to create a Google Workspace account. … Even worse, the created Google Workspace account could be used at third-party services that allow “Sign in with Google” as a login mechanism.
…
Google’s lack of transparency … raises concerns. A clear and detailed public disclosure, including proactive steps taken to prevent future breaches, would be a more responsible approach [and] would demonstrate a commitment to transparency and user trust.

What should domain owners do? Alap Naik Desai suggestifies thuswise: Google email verification bypassed

“Change passwords if necessary”
It would be wise to exercise caution for the next few weeks. … Pay attention to emails that confirm subscriptions, logins, or purchases.
…
Internet users may receive legitimate emails from authentic service providers informing them of purchases or logins from unrecognized or suspicious locations. It would be prudent to check possible unauthorized access and change passwords if necessary.

Still confused? Heed mcoliver’s experience:

Why is this such a big deal? Latent Heat explains:

They weren’t doing this to access the [Google Workspace] productivity tools. Rather, to spoof their online credentials for other, potentially malicious purposes.

ELI5? nottorp explains like you’re five:

So if you own example.com and use [email protected] as log in to greatonlinegame.com, someone can register example.com with google workspace and then they can use “login with Google” to log in [with] [email protected] account at greatonlinegame.com.

Ohhh—an OAuth bug? Bryan Walsch Jr reacts logically:

I never sign in with Google. I will forget which ones I did it for. If its that important, create a unique user ID and Password. And write it down (keep a fake written book if you’re afraid someone will steal it).
…
The rule of “don’t write it down” has ended up costing online users billions — just keep your book in a fire safe. … If someone is stealing your fire safe you have bigger problems than passwords.

Are you feeling some déjà vu? @_prbh is, too:

Authentication bypass by merely changing the email address during the token verification step. Quite similar to the Apple iCloud bug from sometime back.

Meanwhile, Paul B is not a happy bunny:

This is kindergarten-level security. … Google=evil.

And Finally:

Hoist by my own whatnow?

Previously in And Finally

You have been reading SB  Blogwatch by Richi  Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites—so you don’t have to. Hate mail may be directed to  @RiCHi, @richij, @[email protected], @richi.bsky.social or [email protected]. Ask your doctor before reading. Your mileage may vary. Past performance is no guarantee of future results. Do not stare into laser with remaining eye. E&OE. 30.

Image sauce: OSPAN ALI (via Unsplash; leveled and cropped)