Possible Google Account loophole

[Cryptreaper <cryptreaper () gmail com>]

Hi,

There is a slight possibility that an attacker can guess password of a
google account due to a possible loop hole in their captcha system.

It happens when a user tries to login to a Google account with a wrong
password for a number of times, the system challenges the user with a
captcha. If the attacker enters both wrong password and captcha they
are given a warning that they have entered wrong username/password as
well as captcha text not being correct. Also if only the user
name/password if wrong, the warning message says wrong password. But
if the user name password combination is correct but ONLY captcha test
fails, the user is given only the captcha warning. This means that
user name /password combination was correct and thus the attacker
(which could be an automated bot) need not provide correct captcha
text in order to figure out the password.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/