Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$36k Google App Engine RCE

sites.google.com

Post reply on HN
Print view View original

151–160 of 164 posts

Re: $36k Google App Engine RCE

#151

Post by eyeareque »

z3t4 wrote: post #119
eyeareque wrote: post #62

Earlier quoted context omitted.

XXXX == what types of things? I’m curious why there was no auth required for his calls.

Google API Auth/Access is extremely tedious, so I guess someone just didn't bother. Basically you have to get an token, format it, make a couple of http posts, and finally you will have a token to make an access-token-token ... Now image all the steps you would have to make to create a new type of access to some internal API, that should not have public access anyway. Probably saved six months work. And the libraries…

Sounds plausible. Now I’m curious how much extra work this finding has caused teams at Google. There are probably many other similar insecure paths that need to be cleaned up.

Re: $36k Google App Engine RCE

#152

Post by chrisbennet »

bryandollery wrote: post #142
tptacek wrote: post #79

Earlier quoted context omitted.

There are dozens of firms like this, and have been for something like a decade now. The ostensibly totally above-board ones, like Zerodium, aren't "arms dealers"; they're controlled disclosure venues, which capture a premium from big companies and government buyers for access to threat intelligence information before they sit in vendor bug tracking systems for 3-9 months waiting for patches. There are, of course, rea…

It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class. And, really, dictators don't need help imprisoning dissidents -- it's sort of in the jobspec. It's not likely that a vuln would cause this to happen unless it was in systems created and secured specifically for sedition, in which case a researcher should be consider…

"It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class."

I would find it morally offensive but I'm a naive country bumpkin I guess. I have pointed out something that was mispriced rather than profit from their error. It cost me something like ~$50-100 extra but I slept better.

Re: $36k Google App Engine RCE

#153

Post by thesandlord »

russum wrote: post #135

Huh, so you can run binaries in GAE by downloading a statically linked app to /tmp, chmod'ing & executing it? And there would be no limits on how it's run? That's crazy & pretty cool!

GCP Developer Advocate here:

The Java 8, Node.js (just announced at I/O) and GCF environments use a new sandbox that should allow you to run any binary. Of course there are limits, and you have to pay to run things on App Engine past the free tier, but most things should run just fine.

The older GAE sandboxes didn't let you do this (and had a ton of other limitations as well)

Re: $36k Google App Engine RCE

#154

Post by alexeldeib »

elithrar wrote: post #121
alexeldeib wrote: post #115

Earlier quoted context omitted.

Genuinely curious, what qualifies as one-off in these circumstances? Your phrasing-- "vulnerability...that a single vendor can instantaneously fix worldwide with a single patch" seems to me (non-professional but security interested techizen) to describe what a lot of vulnerabilities are. How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? BTW -…

> How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? In the GAE case, Google can patch all deployments of their service on the same day, which is an "instantaneous fix". If it were an RCE with a webserver, OS or some other popular software, that can't be patched "instantaneously" "worldwide". Each entity who maintains their own (i.e. nginx, Dr…

Thanks, this makes sense. I was thinking perhaps a bit too narrowly from the perspective of someone producing the patch, rather than about that long tail of users on the vulnerable version.

Re: $36k Google App Engine RCE

#155

Post by alexeldeib »

tptacek wrote: post #139
elithrar wrote: post #121

Earlier quoted context omitted.

> How would you (or a company like Zerodium) differentiate between a "one off" RCE exploit vs. the kind they would pay out for? In the GAE case, Google can patch all deployments of their service on the same day, which is an "instantaneous fix". If it were an RCE with a webserver, OS or some other popular software, that can't be patched "instantaneously" "worldwide". Each entity who maintains their own (i.e. nginx, Dr…

Also, if you look at the Zerodium payout chart --- again, I'm skeptical of it, but not of this observation --- you'll notice the serverside RCE stuff is at the bottom of the rate sheet. What buyers really want are clients, not servers. This despite the fact that clients are more efficiently patched than servers (the software targets that command the highest payouts are all auto-updated).

This also seems backwards to me? If you can get RCE or privilege escalation on a server, isn't that much worse? Or is it the difference in purpose between targets/adversaries? E.g., a server side vulnerability maybe you get to dump a companies records but something like no-click jailbreak + a high value individual => all their personal information?

Or else, why do buyers want clients?

Re: $36k Google App Engine RCE

#156

Post by dnr »

londons_explore wrote: post #35

He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...

That's probably not quite true. "google3 file access" most likely means the ability to open paths with the "google3 file library", which lets you use paths like "/gfs//...", and similar for all the different storage services. But you'd also need an identity with permissions to read whatever you're reading. Without an identity that's in ACLs and stuff, you'd only be able to see "world-readable" data, which is still quite serious because who knows what's lying around, but probably nothing sensitive like source code.

Re: $36k Google App Engine RCE

#157

Post by tptacek »

alexeldeib wrote: post #155
tptacek wrote: post #139

Earlier quoted context omitted.

Also, if you look at the Zerodium payout chart --- again, I'm skeptical of it, but not of this observation --- you'll notice the serverside RCE stuff is at the bottom of the rate sheet. What buyers really want are clients, not servers. This despite the fact that clients are more efficiently patched than servers (the software targets that command the highest payouts are all auto-updated).

This also seems backwards to me? If you can get RCE or privilege escalation on a server, isn't that much worse? Or is it the difference in purpose between targets/adversaries? E.g., a server side vulnerability maybe you get to dump a companies records but something like no-click jailbreak + a high value individual => all their personal information? Or else, why do buyers want clients?

It should now be starting to click that the extant markets for vulnerabilities don't value "severity" (or any other abstract scale message board nerds want to apply to vulnerabilities), but merely utility.

The hypothesis I like to come back to --- I'm pretty sure it's true --- is that vulnerabilities have value on the black market only if they fit into an existing business model, such that they can be dropped in and immediately be used to make money. People have to already be using some other vulnerability to do the exact same thing, and reliably making money with it.

People on HN like to tell stories about how a master criminal could make money with everything from Facebook CSRFs to serverside RCEs. But none of those kinds of exploits support current ongoing business concerns; they're all one-of-a-kind. Nobody buys a vulnerability speculatively to see if they might make a go of it --- they especially don't do that for a vulnerability that could be extinguished universally in moments by Google or Facebook's security team.

Re: $36k Google App Engine RCE

#158

Post by tptacek »

celticninja wrote: post #149
tptacek wrote: post #43

Earlier quoted context omitted.

Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it?…

I don't think you even need to go to the darknet. There are plenty of legal avenues open to you for selling exploits.

Name one that buys vulnerabilities like these.

Re: $36k Google App Engine RCE

#159

Post by alexeldeib »

tptacek wrote: post #157
alexeldeib wrote: post #155

Earlier quoted context omitted.

This also seems backwards to me? If you can get RCE or privilege escalation on a server, isn't that much worse? Or is it the difference in purpose between targets/adversaries? E.g., a server side vulnerability maybe you get to dump a companies records but something like no-click jailbreak + a high value individual => all their personal information? Or else, why do buyers want clients?

It should now be starting to click that the extant markets for vulnerabilities don't value "severity" (or any other abstract scale message board nerds want to apply to vulnerabilities), but merely utility. The hypothesis I like to come back to --- I'm pretty sure it's true --- is that vulnerabilities have value on the black market only if they fit into an existing business model , such that they can be dropped in and…

Aren't we seeing lots instances of the server-side model playing out? e.g., Company XYZ announces they've been breached and leaked XXX million user's data?

I could see an argument here towards the market price of the information -- breaching a company in the above scenario might get you zilch. Breaking an iOS device of an individual of interest gets you a lot of value.

Circling back though -- you're saying that this model isn't one in use. Do you agree with my real-life counterpoint? If so, why wouldn't there be a market? Or, is the market there and the low payouts from the likes of Zerodium reflect the actual low value of the product (and by extension, business model)?

Re: $36k Google App Engine RCE

#160

Post by tptacek »

alexeldeib wrote: post #159
tptacek wrote: post #157

Earlier quoted context omitted.

It should now be starting to click that the extant markets for vulnerabilities don't value "severity" (or any other abstract scale message board nerds want to apply to vulnerabilities), but merely utility. The hypothesis I like to come back to --- I'm pretty sure it's true --- is that vulnerabilities have value on the black market only if they fit into an existing business model , such that they can be dropped in and…

Aren't we seeing lots instances of the server-side model playing out? e.g., Company XYZ announces they've been breached and leaked XXX million user's data? I could see an argument here towards the market price of the information -- breaching a company in the above scenario might get you zilch. Breaking an iOS device of an individual of interest gets you a lot of value. Circling back though -- you're saying that this…

There isn't a "low" payout on Zerodium for these bugs; there is no payout for them. Zerodium explicitly will not buy bugs in individual websites. Every vulnerability Zerodium will buy has a half-life.
Post reply on HN