Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$36k Google App Engine RCE

sites.google.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: $36k Google App Engine RCE

#131

Post by brann0 »

toomanybeersies wrote: post #128
guessmyname wrote: post #3

> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the…

That's a lot of money, even in a first world country. That could get you a new car, or a deposit on a house (depending on where you are), or pay off a substantial chunk of your student loan (or all of it, if you're not in the USA).

OT: Luckily for him, he studies at a public university so much likely he doesn't even need a student loan.

Students shouldn't need loans. It's an aberration.

Re: $36k Google App Engine RCE

#132

Post by csomar »

tptacek wrote: post #43
gnl wrote: post #23

Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.

Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it?…

That will be the equivalent of a 21 year old with no backgrounds robbing a bank. He'll just get caught, somehow. Either through financial transactions, taxes, leaves a trace somewhere, get involved with that criminal organization, etc... He'll eventually mess up.

But back to your question. If I remember correctly, the big companies started giving higher bounties because they noticed that some of the bugs are being sold on the dark market. Some of these bugs are certainly not unmarktable but the companies have to keep the promise.

Also I'm not an expert on these things. Maybe there is an entity buying whatever bug you can find and giving generous money. Think governmental institution who might be interested with whatever backdoor they can get.

Re: $36k Google App Engine RCE

#133

Post by toomanybeersies »

brann0 wrote: post #131
toomanybeersies wrote: post #128

Earlier quoted context omitted.

That's a lot of money, even in a first world country. That could get you a new car, or a deposit on a house (depending on where you are), or pay off a substantial chunk of your student loan (or all of it, if you're not in the USA).

OT: Luckily for him, he studies at a public university so much likely he doesn't even need a student loan. Students shouldn't need loans. It's an aberration.

I'm on the fence about student loans, obviously American student loans are obscene, but smaller ones seem reasonable to me.

It's not fair on those who went directly into the workforce or became an apprentice that the university students get free money for living costs for 3 or 4 years.

The current system in New Zealand (simplified slightly) is that university is free, there are no fees, and you can get up to $180 per week for living costs as an interest free loan. I think it's a perfectly reasonable system. That amount isn't really enough to cover all your expenses unless you are especially frugal, so students still need to go out and get a job (or work in the summer), which I think is perfectly fair.

Re: $36k Google App Engine RCE

#134

Post by madeofpalk »

dannyw wrote: post #95
madeofpalk wrote: post #87

Earlier quoted context omitted.

I would expect that in most jurisdictions (well, if they're like Australia) that income is income, and it just goes onto your taxable income.

In Australia, only if you are engaged in a business activity. This means that if you come across some small bug and get a bounty of $1000, then it's probably not even taxable income.

Of course it's taxable. Unless its a gift which, a payout from a company for completing work which the ATO will say is not a gift, then it's income and it'll get added onto your taxable income and tax appropriately. For something like a bug bounty payout, you'll have to declare it yourself as other income.

Re: $36k Google App Engine RCE

#135

Post by russum »

Huh, so you can run binaries in GAE by downloading a statically linked app to /tmp, chmod'ing & executing it? And there would be no limits on how it's run? That's crazy & pretty cool!

Re: $36k Google App Engine RCE

#136

Post by tinco »

toomanybeersies wrote: post #133
brann0 wrote: post #131

Earlier quoted context omitted.

OT: Luckily for him, he studies at a public university so much likely he doesn't even need a student loan. Students shouldn't need loans. It's an aberration.

I'm on the fence about student loans, obviously American student loans are obscene, but smaller ones seem reasonable to me. It's not fair on those who went directly into the workforce or became an apprentice that the university students get free money for living costs for 3 or 4 years. The current system in New Zealand (simplified slightly) is that university is free, there are no fees, and you can get up to $180 per…

Every year spent studying you miss out on working at some entry level job for ~25k/y. After 5 years of study, you (in Europe) have accumulated a debt of ~$25k-$50k depending on whether you've had a side job or help from your parents. That means you've lived for ~$10k/y for 5 years, where someone in the workforce lives on significantly more, and at the end you're in debt as well.

Obviously the upside is that you get a job where it is reasonable to expect that you'll be able to repay the loan in about 10 years, but that's something you worked for, and something an ambitious person in the workforce might achieve as well.

Anyway, I don't think you can simply say it's unfair to aid students in their living expenses while they're studying. Obviously they're usually having a great time studying, but they also don't own a car, or a house and instead live in tiny apartments sharing privacy with other students. They usually delay their family building for the entire span of their studies, and often even until they've paid of (most of) their debt. But yeah, have them work some extra in the summer while the workforce is driving their caravans to southern France...

Re: $36k Google App Engine RCE

#137

Post by jcims »

bitexploder wrote: post #106
sethherr wrote: post #42

Earlier quoted context omitted.

As someone who has been on the other end of receiving incoherent and inaccurate bug bounty reports, this! To find the bug is impressive. To write about it so well is truly exceptional.

I always "joke" to people we are professional writers. Actually professional infosec consultants, but our life blood is coherently documenting everything we find and making pretty executive summaries. It is hard to overstate how much I have seen the reporting differentiate infosec consulting firms over then years. Which is not to say we don't value the hard technical skills, but writing is really, really important to…

The best part is when your kids complain about having to write a 1500 word essay and you show them what's up.

Re: $36k Google App Engine RCE

#138

Post by londons_explore »

eyeareque wrote: post #81
londons_explore wrote: post #67

Earlier quoted context omitted.

* Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on t…

Wow, that is quite significant. 36k is not a small bounty for an RCE, but I feel like this is more critical to Google than the highest Android payout, for which they pay up to 200k for: https://www.google.com/about/appsecurity/android-rewards/

Android is wormable, and potentially not repairable by google.

For example, with a decent remote android exploit, I could distribute a patched Google Play Services to all vulnerable handsets which disables updates and then listens to my own command and control infrastructure for further actions.

I can now hold the phones hostage and extort google for money to regain control of them.

Re: $36k Google App Engine RCE

#139

Post by tptacek »

elithrar wrote: post #121
alexeldeib wrote: post #115

Earlier quoted context omitted.

Genuinely curious, what qualifies as one-off in these circumstances? Your phrasing-- "vulnerability...that a single vendor can instantaneously fix worldwide with a single patch" seems to me (non-professional but security interested techizen) to describe what a lot of vulnerabilities are. How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? BTW -…

> How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? In the GAE case, Google can patch all deployments of their service on the same day, which is an "instantaneous fix". If it were an RCE with a webserver, OS or some other popular software, that can't be patched "instantaneously" "worldwide". Each entity who maintains their own (i.e. nginx, Dr…

Also, if you look at the Zerodium payout chart --- again, I'm skeptical of it, but not of this observation --- you'll notice the serverside RCE stuff is at the bottom of the rate sheet. What buyers really want are clients, not servers. This despite the fact that clients are more efficiently patched than servers (the software targets that command the highest payouts are all auto-updated).

Re: $36k Google App Engine RCE

#140

Post by gnl »

rplnt wrote: post #130
gnl wrote: post #23

Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.

> the integrity to not sell something like this on the black market Wouldn't the investigation lead to him? He noted he did not know, at the time, that it was an RCE. So he would need to research further (where he might trigger an alarm). He also noted he utilized staging environment, which he had access to due to previous found vulnerabilities (so Google had his personal details). So, now imagine he found something…

There are companies who buy vulnerabilities/exploits and sell them to the highest, supposedly non-criminal - to whatever extent that can be applied to governments, law enforcement and intelligence agencies - bidder. That's mostly what I had in mind and black market is a misleading term for it, but I can't edit the comment now.

See also tptacek's comments in this thread.

Post reply on HN