Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$36k Google App Engine RCE

sites.google.com

Post reply on HN
Print view View original

31–40 of 164 posts

Re: $36k Google App Engine RCE

#31

Post by jcims »

foepys wrote: post #5
guessmyname wrote: post #3

> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the…

That's pretty advanced stuff for an 18y/o, even for most senior developers. No doubt Google will try to recruit him after he finishes university.

(Edit: I appear to be a broken record) I spent a spell on a bug bounty program. There are some beasts out there in the 16-20yo age range, it's pretty crazy.

Re: $36k Google App Engine RCE

#32

Post by thaumasiotes »

jacquesm wrote: post #19
whb07 wrote: post #10

Earlier quoted context omitted.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

You really should read a couple of newspapers every now and then, East Germany no longer exists and most communist countries don't either.

This could be related to the fact that while you still hear a lot about "first-world" and "third-world" countries, you don't ever hear anyone use the term "second-world".

Re: $36k Google App Engine RCE

#33

Post by puzzle »

saalweachter wrote: post #29
puzzle wrote: post #20

Earlier quoted context omitted.

Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.

One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; hopefully , while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he hopefully could not authenticate to do anything any serious damage or access any sensitive information.

I agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: https://packetstormsecurity.com/files/129406/Google-App-Engi...

Re: $36k Google App Engine RCE

#34

Post by freyir »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

You're getting downvoted, but you're right.

A "third-world country" was a country that wasn't aligned to either the Western countries (first world) or the Communist Bloc (second world).

These terms have become outdated, and "developing" countries is more commonly used now by, e.g., the press.

Re: $36k Google App Engine RCE

#36

Post by [deleted] »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

[deleted]

Re: $36k Google App Engine RCE

#37

Post by wodenokoto »

armanini_io wrote: post #9
guessmyname wrote: post #3

> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the…

Uruguay is not third world country.

According to Wikipedia, it is a developing country, which is basically the modern way of saying third world.

https://en.wikipedia.org/wiki/Developing_country#Country_lis...

Re: $36k Google App Engine RCE

#38

Post by dang »

whb07 wrote: post #10
armanini_io wrote: post #9

Earlier quoted context omitted.

Uruguay is not third world country.

Yes it is. I do not want to be that stickler but this is the charts for that term: 1st world: US, UK, West Germany, essentially western countries 2nd world: Soviets, East Germany, communist countries 3rd world: everyone who doesn’t fit the Cold War theater. Either way, a GDP per capita of $15k isn’t considered “first” at whatever category you want to assign it by. Unfortunately there are no “1st world” countries in L…

Come on you guys. There's no need to descend into one of these circles of hell.

Re: $36k Google App Engine RCE

#40

Post by q3k »

Karishma1234 wrote: post #39

Any idea how such rewards get taxed ?

On the receiving end if you're non-US-based? You're supposed to figure it out yourself (ie. pay local applicable income tax), they just want a W8BEN.

Source: got a Google VRP reward.

Post reply on HN