Hello, welcome to the Friday, March 22nd, 2019 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Riyadh, Saudi Arabia.

Well, and that's also the answer for this month's challenge.

We got a ton of submissions.

I think the best hint that I probably gave was a picture

that I posted on Twitter. We got a number of submissions based on that. Also, once I ever mentioned

the local time here that narrowed it down somewhat, but actually probably a couple hundred submissions and

only two guessed the city correctly. The winner who's the person that first submitted the right

answer should receive an email from me sometime later today. Well about talking about images and associated metadata. Imperva has an interesting blog about

vulnerability in Google Photos that allowed others to guess the location and time and other

parameters of photos that you have stored with Google Photos.

The problem here is the API that Google exposed in order to search for photos and a neat

sort of cross-site timing attack that Imperva was able to exploit in order to actually retrieve search results.

In order to exploit the vulnerability, the victim has to be logged into Google Photos and has to be

visiting a malicious website. So this sounds very much like cross-side request forging and

in essence it is cross-side request forging and in essence it is cross-side request

forging with an interesting twist to get around same origin policy. Due to same origin

policy, the attacker will not receive a response back from this web service, but depending

on whether or not the search returned any results

or not, the time required for the error message to come back to the attacker will be different.

So essentially the attacker will have to prude force things like location and time,

...