I don't think it's so easy to sell a vulnerability on the black market. If you send the code first they will have no incentive to send the money, if you get the money, you might not send the code.
$36k Google App Engine RCE
91–100 of 164 posts
Re: $36k Google App Engine RCE
#92This report showcases a ton of tenacity and thoroughness. Not his first time as well: https://sites.google.com/site/testsitehacking/10k-host-heade... . Very impressive. “Please stop exploring this further, as it seems you could easily break something” has got to be the best reply one can receive to a bug bounty report.
I wish all companies had the internal connectedness to be able to react to realtime updates and coordinate the exact split second to hold up the friendly stop sign!
There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions).
So this the best thing you can hear from that standpoint as well.
Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos.
That sounds like a "fun" job...
---
I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in.
There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication.
- https://arstechnica.com/information-technology/2018/04/paner...
- https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583
Re: $36k Google App Engine RCE
#93I don't think it's so easy to sell a vulnerability on the black market. If you send the code first they will have no incentive to send the money, if you get the money, you might not send the code.
You don't have to send the quote, you can demonstrate it, e.g. on a dummy shared account where you bypass all quotas.
Re: $36k Google App Engine RCE
#94Earlier quoted context omitted.
On the receiving end if you're non-US-based? You're supposed to figure it out yourself (ie. pay local applicable income tax), they just want a W8BEN. Source: got a Google VRP reward.
so US government does not take an cut ?
The US govt doesn't take a cut if you pay an overseas contractor X for Y.
Re: $36k Google App Engine RCE
#95Any idea how such rewards get taxed ?
I would expect that in most jurisdictions (well, if they're like Australia) that income is income, and it just goes onto your taxable income.
In Australia, only if you are engaged in a business activity. This means that if you come across some small bug and get a bounty of $1000, then it's probably not even taxable income.
Re: $36k Google App Engine RCE
#96Earlier quoted context omitted.
XXXX == what types of things? I’m curious why there was no auth required for his calls.
* Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on t…
Production code has no unauthenticated access to source. In all the cases I know, there was a data push for dynamic configurations from source to production, usually adding access control, auditing, validation, etc. Static configurations would be baked into the container image.
That said, it looks like in this case he would been able to turn on access to google3, through a special flag that is probably meant for internal GAE apps that work on source code. Presumably, the flag allows the app to use a GAE proxy that authenticates to Piper and provides a filesystem-like interface. It's not clear what would have happened at this point, because it is likely there exists a finer grained quota for source access than just all of GAE. These kinds of new RPC traffic would have been visible in Dapper and Census data, plus there are booby traps everywhere aka defense in depth.
Re: $36k Google App Engine RCE
#97Earlier quoted context omitted.
I have not and I haven't been looking for one either. I'm not quite sure what you're getting at here. If you're trying to point out that I haven't done my homework on this and that I don't have a sufficiently specific/workable plan how to approach it - that is accurate. I don't have exploits to sell. In my previous comment I already stated the assumption that I made, if you feel it's incorrect, which clearly you do,…
Sorry, I'm interested in anyone's response to this, since the HN community reaction to any price paid in a bug bounty by a big company always seems to be "people can make more money on the black market". Rather than recapitulating all the previous debates about why that's not true, I'm interested in seeing someone --- doesn't have to be you --- work their way to an educated guess at a black market price for a bug lik…
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
Re: $36k Google App Engine RCE
#98Earlier quoted context omitted.
* Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on t…
Production code has no unauthenticated access to source. In all the cases I know, there was a data push for dynamic configurations from source to production, usually adding access control, auditing, validation, etc. Static configurations would be baked into the container image. That said, it looks like in this case he would been able to turn on access to google3, through a special flag that is probably meant for inte…
Right, but he wasn’t doing this in a production environment, so I wonder if he could’ve got access to source still.. thoughts?
Re: $36k Google App Engine RCE
#99Earlier quoted context omitted.
Sorry, I'm interested in anyone's response to this, since the HN community reaction to any price paid in a bug bounty by a big company always seems to be "people can make more money on the black market". Rather than recapitulating all the previous debates about why that's not true, I'm interested in seeing someone --- doesn't have to be you --- work their way to an educated guess at a black market price for a bug lik…
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
Nothing, but to make a complete argument you have to provide a hypothetical buyer, their price, and why they'd pay it.
Re: $36k Google App Engine RCE
#100Earlier quoted context omitted.
Production code has no unauthenticated access to source. In all the cases I know, there was a data push for dynamic configurations from source to production, usually adding access control, auditing, validation, etc. Static configurations would be baked into the container image. That said, it looks like in this case he would been able to turn on access to google3, through a special flag that is probably meant for inte…
Right, but he wasn’t doing this in a production environment, so I wonder if he could’ve got access to source still.. thoughts?
At the end of the day, even a non-production GAE environment runs on Borg, talks to GFS and Bigtable, etc. They're not going to run the entire stack on bare metal. The environments will have different configurations, will be backed by different Borg jobs, hopefully will run under different Borg identities, etc.
The articles about Piper and co. have made it clear that it ran on top of Bigtable first and then Spanner, i.e. in the production network, spread over ten locations. There's file level auditing and access control. It would be very dumb of them not to have intrusion and anomaly detection in place.