Blog

WebmasterTools in Dangerous Security Flaw

by

It has been seen tonight that WebmasterTools has suffered a major security hole and opened up and reverified all old accounts. What does this mean to the SEO community?

From initial glance at our WMT’s accounts we now have regained access to every old account we have previously been given access to, whether that is a previous client or maybe a site that came to us for some short term consultancy. What is also quite amusing (if you look on the funny side) is that you can see who won the client or who you won the client from.

On a more serious note though, now that WMT is so much more powerful than it ever was there is a serious risk that damage could be caused to sites by people who no longer have permission to make changes. Things like disavow link lists, deindex urls or the entire site, redirect urls, geolocation alterations .. a whole world of pain.

Oh… and this also is the same for Google Analytics too.. its going to potentially be a late night! Hopefully the messages that we have sent to Matt Cutts will be seen and actioned quickly.

This is when the reverification attempts happened

Here is a screenshot of what we “could” do …. (Disclaimer – we won’t be doing anything to anyone)

This is an example of the mess .. so from the bottom up on this account, 13 days ago ownership revoked for the old SEO company, 11 days ago new SEO company added, then what appears an hour ago the old SEO company, an ex-employee and us (who haven’t had the account for about a year) were reverified.

20 Comments

  • Alastair McDermott 178 days ago

    http://www.websitedoctor.com/

    Disastrous security measures by Google. They’ll need to provide some kind of solution, maybe roll back 24 hours of GWT data or something like that.

    Reply
  • Lee Smallwood 178 days ago

    That is such a hole David…! Any news from Matt Cutts yet?

    Reply
  • Lee Colbran 178 days ago

    I noticed something happening this afternoon. Well done for alerting the community to this Dave.

    Reply
  • James Norquay 178 days ago

    http://jamesnorquay.com

    This is a massive security flaw for Google, I have checked a few of my accounts and they do not seem to have old accounts showing. I have also read of people having access to old Google analytic’s accounts on Twitter. Would be good too see an official statement from Google regarding this!

    Reply
  • Christopher West 178 days ago

    http://about.me/seowestcp

    Hi David

    Not seeing this so far in a few of the AU sites I have checked – but will keep monitoring.

    Thanks for the headsup!

    Reply
  • Bob Jones 178 days ago

    http://www.titanweb.com.au

    Panic in the office this morning after this post came to my attention, but it looks like none of our sites have any problems (800+ Australian sites). Seeing that James and Christopher also mentioned not seeing any problems with their Australian sites…perhaps its only happening to certain regions?

    Reply
  • [...] can see some evidence of the Webmaster Tools access on David Naylor’s blog here, where he demonstrates some of the things that could be done to his firm’s ex-clients. He has [...]

  • Jimboot 178 days ago

    http://stewartmedia.biz

    Damn what a morning we picked to delete all old accounts that were unverified LOL. We just finished doing it when I read your post.

    Reply
  • [...] today and reported on several SEO blogs and news outlets — including (first, I believe) by Dave Naylor — and was discussed pretty heavily by search marketers on Twitter. We asked Google late [...]

  • [...] today and reported on several SEO blogs and news outlets — including (first, I believe) by Dave Naylor — and was discussed pretty heavily by search marketers on Twitter. We asked Google late Tuesday [...]

  • [...] client or maybe a site that came to us for some short term consultancy,” David Naylor posted on his search marketing blog today. Source: David NaylorGoogle Webmaster Tools re-verifying old [...]

  • ketan raval 177 days ago

    http://www.implicitly.me/

    that is terrifying security hole and privacy issue.

    Reply
  • Uncle Demotivator 177 days ago

    http://www.motivationals.org

    This is what happens when you archive everything and never really delete anything. However I doubt that Google will learn anything form this.

    Reply
  • Alan Charncok 177 days ago

    http://www.seo-internetmarketing.co.uk

    Happened to the company I work for, Google fails again!

    Reply
  • Doc Sheldon 177 days ago

    http://topshelfcopy.com

    Good catch, Dave and a good job of letting folks know right away. FYI, we’ve found no changes here yet on any of our clients’ accounts (AU, UK, CA, US), but will keep checking periodically.

    Reply
  • Jimboot 177 days ago

    http://stewartmedia.biz

    Ok Dave can confirm it happened here in Australia. It looks like it has been fixed now.

    Reply
  • Andrea Moro 175 days ago

    http://www.andreamoro.co.uk

    Google reverted the situation within hours from the discovery. Those sites which automatic authorization has been given, has also been automatically demoted. Not a big issue though, especially considering the issue occurred during night time in Europe.

    However, if you are still experiencing the issue and you see some site to which you should not have access to, please feel free to report them here and I will liaise directly with the relevant Google team to which I’m in contact as an official TC.

    Reply
  • [...] We all know how important it is to secure your webmaster tool account.  However, for a short time last week Google left its users open to attact due to a security glitch  [...]

  • Carl 171 days ago

    http://www.webmaisterpro.com

    This is absolute disaster, for every webmaster. I just can’t believe this is happening with “Big G”.

    Reply
  • Volker Schaefer 170 days ago

    http://www.InternetMarketingPro.biz

    Wow, why do such thing happen to Google again and again?

    They should be better.

    Reply

Write your comment

Optional

The Bronco Family
Work With Us