Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#111

Post by hackernewds »

kadoban wrote: post #98
nightpool wrote: post #61

Earlier quoted context omitted.

Agreed. I know Google is famously hard to get in touch with, but I don't understand how this fall on Google's plate or is really Google's fault at all. Maybe if they shared some more info about what IAM group they created that managed to trick people into adding it Google could create rules to ban group names like that from being created?

It's Google's fault because there's no "remove me from having access to this" button.

if one is conscientious enough to report themselves be removed, they could also simply ignore the access

Re: I have gained admin access to numerous GCloud Organizations by accident

#112

Post by secondcoming »

ghusto wrote: post #25
secondcoming wrote: post #17

Be very careful. Even though you're trying to do The Right Thing don't alert these companies to the fact you've been accessing their accounts without permission.

I'm seeing a lot of these kinds of comments, and think this might just be an American worry (because it's such a litigious place)? People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things. I can't imagine them doing anything other than thanking you profusely. I mention this because I'd rather this kind of attitude wasn't imported to Europe.

I’m not American and live in the UK.

Lawyers aren’t chill about anything, and it could be financially ruinous to try find out.

Re: I have gained admin access to numerous GCloud Organizations by accident

#113

Post by lowbloodsugar »

tapoxi wrote: post #20
elzbardico wrote: post #18

Earlier quoted context omitted.

Out of curiosity, I tried to search for the specific function of Support Engineer both for AWS and Google on several job boards. It is a mostly un-scientific approach of course, but the results are as expected. It doesn't even look like google hires Support Engineers. LOL

They outsource it. I'm on the U.S. East Coast. My last GCP support ticket ended up in Romania.

Google is a global company. How do you know they aren't google employees in Romania?

Re: I have gained admin access to numerous GCloud Organizations by accident

#114

Post by kadoban »

hackernewds wrote: post #111
kadoban wrote: post #98

Earlier quoted context omitted.

It's Google's fault because there's no "remove me from having access to this" button.

if one is conscientious enough to report themselves be removed, they could also simply ignore the access

There's liability in having access to some random crap, even if you don't intentionally use it.

If something goes wrong, someone accesses or modifies something that they shouldn't have, you having access is going to be at _best_ confusing to everyone. At worst the cops or lawyers will come calling. Sure you'll _probably_ be able to talk them down, but does that sound like fun?

Or what if someone breaks in to _your_ account and accesses that way? Untangling that mess will not be a good time.

Re: I have gained admin access to numerous GCloud Organizations by accident

#115

Post by ehPReth »

lowbloodsugar wrote: post #113
tapoxi wrote: post #20

Earlier quoted context omitted.

They outsource it. I'm on the U.S. East Coast. My last GCP support ticket ended up in Romania.

Google is a global company. How do you know they aren't google employees in Romania?

I mean, you can't be 100% sure in any one case but they do have a lot of third-party companies listed for support: https://cloud.google.com/terms/subprocessors

Re: I have gained admin access to numerous GCloud Organizations by accident

#116

Post by ajb »

AugurCognito wrote: post #70
leesalminen wrote: post #12

Earlier quoted context omitted.

I’ve had access to both Google’s and Amazon’s paid support options (up to and including enterprise support). Amazon’s support has gone above and beyond for me over the years in ways I didn’t even expect or ask them to. In comparison, I agree with you that Google’s support is useless. My experiences with AWS support have actually left me with a positive impression of the platform, while my experiences with Google rein…

Will choose AWS just for support anyday over alternatives. I'm not even a paying customer and I had a slight issue regarding multiple emails registered under the same account and such. I was just starting with AWS. The support was really helpful and provided me with information I didn't even know I needed.

Agree. AWS charge a minimum of 3% of your bill towards support. Which is fine, it makes support scaleable and even a profit centre.

What's weird is that GCP charge the same but apparently don't deliver

Re: I have gained admin access to numerous GCloud Organizations by accident

#117

Post by anon223345 »

Update #2 - they actually responded to my bug bounty request. Seems they think it may be worth fixing but not a big enough deal to pay out a bounty to me. Obviously I’d like the bounty but if I got any recognition that would be awesome

—- Hi,

Thanks again for your report.

I've filed a bug with the responsible product team based on your report. The product team will evaluate your report and decide if a fix is required. We'll let you know if the issue was fixed.

Regarding our Vulnerability Reward Program: At first glance, it seems this issue is not severe enough to qualify for a reward. However, the VRP panel will take a closer look at the issue at their next meeting. We'll update you once we've come to a decision.

If you don't hear back from us in 2-3 weeks or have additional information, let us know!

Regards, Google Security Team

Re: I have gained admin access to numerous GCloud Organizations by accident

#118

Post by anon223345 »

koolba wrote: post #49
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

> You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. In that case no point in following up at all right? Just post on HN and hope someone in the right spot sees it? > This almost always works :) That’s the type of SLA one can rely on! > Maybe edit your OP with a way to c…

It seems they actually responded to the bug bounty request, I put the response up above

Re: I have gained admin access to numerous GCloud Organizations by accident

#119

Post by NavinF »

toomuchtodo wrote: post #48
jonas-w wrote: post #42

Earlier quoted context omitted.

Like security.txt? https://securitytxt.org For example: https://www.google.com/.well-known/security.txt

You and I know this, but if you're not a security practitioner, you might not know. It might as well then be behind a door for a room with a sign that says "Beware of the Leopard." I understand some scrappy startups like Google don't have the resources to have someone review security incident reports that come through a web form, but maybe they should if they want to be a legit cloud provider? Googling "report google…

The 3rd result for "report google cloud vulnerability" is productive

Re: I have gained admin access to numerous GCloud Organizations by accident

#120

Post by kevingmccall »

anon223345 wrote: post #117

Update #2 - they actually responded to my bug bounty request. Seems they think it may be worth fixing but not a big enough deal to pay out a bounty to me. Obviously I’d like the bounty but if I got any recognition that would be awesome —- Hi, Thanks again for your report. I've filed a bug with the responsible product team based on your report. The product team will evaluate your report and decide if a fix is required…

You have my respect!
Post reply on HN