Google App Engine page already owned by hackers

#1

Post by nickb » Wed, Apr 09, 2008, 4:06 AM UTC

Google App Engine page already owned by hackers
valleywag.com

Re: Google App Engine page already owned by hackers

#2

Post by thorax » Wed, Apr 09, 2008, 5:20 AM UTC

An XSS is a tad different than being owned (IMHO), but certainly isn't an ideal thing to see right away.

The cool part is that things like this will encourage them to put more security-by-default sorts of APIs into GAE.

Re: Google App Engine page already owned by hackers

#3

Post by staunch » Wed, Apr 09, 2008, 5:50 AM UTC

Most everyone doing lots of web apps gets bitten by XSS at some point. Nothing embarrassing about it IMHO.

Re: Google App Engine page already owned by hackers

#4

Post by webframp » Wed, Apr 09, 2008, 6:31 AM UTC

misleading headline. plus why is a valleywag article showing up on HN, I can get that elsewhere.

Re: Google App Engine page already owned by hackers

#5

Post by dcurtis » Wed, Apr 09, 2008, 7:14 AM UTC

staunch wrote: post #3

Most everyone doing lots of web apps gets bitten by XSS at some point. Nothing embarrassing about it IMHO.

But Google has probably hired ten PhDs just to make sure none of their products gets exploited like this.

But the PhDs failed. Thus, it's newsworthy.

Re: Google App Engine page already owned by hackers

#6

Post by malanalars » Wed, Apr 09, 2008, 8:29 AM UTC

That's a simple XSS example hack. Google should have filtered that out, but it's not that bad either (as long as they react fast).

Re: Google App Engine page already owned by hackers

#7

Post by m0nty » Wed, Apr 09, 2008, 10:21 AM UTC

webframp wrote: post #4

misleading headline. plus why is a valleywag article showing up on HN, I can get that elsewhere.

"misleading headline"

Absolutely. Any fewl know it should be "pwned".

Re: Google App Engine page already owned by hackers

#8

Post by apgwoz » Wed, Apr 09, 2008, 12:06 PM UTC

malanalars wrote: post #6

That's a simple XSS example hack. Google should have filtered that out, but it's not that bad either (as long as they react fast).

While THAT may be an example of a SIMPLE attack, probably for the sake of showing off, what if "the goog" had exposed web services retrievable by Ajax for logged in users as part of AppEngine and THAT was exploited via the SIMPLE XSS hack?

It makes no sense. Why do we just brush stuff under the rug when it's Google or some other major player that's generally well liked?

Re: Google App Engine page already owned by hackers

#9

Post by jmzachary » Wed, Apr 09, 2008, 1:42 PM UTC

dcurtis wrote: post #5

staunch wrote: post #3

Most everyone doing lots of web apps gets bitten by XSS at some point. Nothing embarrassing about it IMHO.

But Google has probably hired ten PhDs just to make sure none of their products gets exploited like this. But the PhDs failed. Thus, it's newsworthy.

Hiring PhDs for this task was their first mistake.