Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$36k Google App Engine RCE

sites.google.com

Post reply on HN
Print view View original

141–150 of 164 posts

Re: $36k Google App Engine RCE

#141

Post by bryandollery »

tptacek wrote: post #50
was_boring wrote: post #47

Earlier quoted context omitted.

You don't have to think about it too hard, there's companies that will help you with the transaction. https://www.zerodium.com/

First, you can just go look at Zerodium's website and see what they'll buy. Notice that one-off vulnerabilities aren't there at all: there are no vulnerability types on their rate sheet that a single vendor can instantaneously fix worldwide with a single patch. Notice also that with just a couple exceptions, RCEs in extremely widespread serverside web components are valued at $10k (if you believe their price list; I'…

Why wouldn't you just do both? You can get Zerodium to pay you and then go to the 'target' and submit the vuln through their channels. It seems plausible.

Re: $36k Google App Engine RCE

#142

Post by bryandollery »

tptacek wrote: post #79
gowld wrote: post #68

Earlier quoted context omitted.

Wow, a digital arms dealer. How is that they have not been destroyed or captured by someone's military?

There are dozens of firms like this, and have been for something like a decade now. The ostensibly totally above-board ones, like Zerodium, aren't "arms dealers"; they're controlled disclosure venues, which capture a premium from big companies and government buyers for access to threat intelligence information before they sit in vendor bug tracking systems for 3-9 months waiting for patches. There are, of course, rea…

It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class.

And, really, dictators don't need help imprisoning dissidents -- it's sort of in the jobspec. It's not likely that a vuln would cause this to happen unless it was in systems created and secured specifically for sedition, in which case a researcher should be considerate of the potential damage.

Re: $36k Google App Engine RCE

#143

Post by bryandollery »

cc81 wrote: post #41
guessmyname wrote: post #3

> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the…

Selling and getting paid in the black market is probably not very easy unless you already have quite a lot of contacts.

That's not necessarily true, there are brokers that are relatively easy to find. It's more risky at a personal level to go into crime though.

Re: $36k Google App Engine RCE

#144

Post by tptacek »

bryandollery wrote: post #141
tptacek wrote: post #50

Earlier quoted context omitted.

First, you can just go look at Zerodium's website and see what they'll buy. Notice that one-off vulnerabilities aren't there at all: there are no vulnerability types on their rate sheet that a single vendor can instantaneously fix worldwide with a single patch. Notice also that with just a couple exceptions, RCEs in extremely widespread serverside web components are valued at $10k (if you believe their price list; I'…

Why wouldn't you just do both? You can get Zerodium to pay you and then go to the 'target' and submit the vuln through their channels. It seems plausible.

It seems plausible to you that you can get Zerodium to pay you for a vulnerability that their FAQ specifically says they're not interested in buying?

Re: $36k Google App Engine RCE

#145

Post by tptacek »

bryandollery wrote: post #142
tptacek wrote: post #79

Earlier quoted context omitted.

There are dozens of firms like this, and have been for something like a decade now. The ostensibly totally above-board ones, like Zerodium, aren't "arms dealers"; they're controlled disclosure venues, which capture a premium from big companies and government buyers for access to threat intelligence information before they sit in vendor bug tracking systems for 3-9 months waiting for patches. There are, of course, rea…

It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class. And, really, dictators don't need help imprisoning dissidents -- it's sort of in the jobspec. It's not likely that a vuln would cause this to happen unless it was in systems created and secured specifically for sedition, in which case a researcher should be consider…

I don't know what to tell you. Maybe you'd have an easier time selling vulnerabilities than I would.

Re: $36k Google App Engine RCE

#146

Post by bryandollery »

londons_explore wrote: post #67
eyeareque wrote: post #62

Earlier quoted context omitted.

XXXX == what types of things? I’m curious why there was no auth required for his calls.

* Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on t…

Software architecture isn't like that. Nobody has a list of all the software running in every datacenter -- not in any large corporation anywhere in the world, and an API isn't going to change that.

And, you can't quit all application servers at the same time. These are distributed, self-healing, and highly-redundant -- meaning that there are thousands of copies of each service, and the system will bring up new copies to replace the ones you kill, without loosing service (though you could, potentially, affect quality of service).

Even the control mechanisms that allow all this magic to happen are run on the same platform, meaning that you can't affect the managers in this way either.

The sort of things you can do are: affect billing and reporting, find sensitive company data, and, potentially, execute code remotely (though that will probably be in a container, and not have access to much else).

Grabbing source code is problematic. There is more than one repo -- in an org this size there are probably millions. The code is huge, so downloading it will take forever, and then you'd have to read it. Finally, it's written in dozens of programming languages, some, like Golang, are unreadable to anyone but experts.

Re: $36k Google App Engine RCE

#147

Post by ponyfleisch »

bryandollery wrote: post #146
londons_explore wrote: post #67

Earlier quoted context omitted.

* Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on t…

Software architecture isn't like that. Nobody has a list of all the software running in every datacenter -- not in any large corporation anywhere in the world, and an API isn't going to change that. And, you can't quit all application servers at the same time. These are distributed, self-healing, and highly-redundant -- meaning that there are thousands of copies of each service, and the system will bring up new copie…

> Grabbing source code is problematic. There is more than one repo -- in an org this size there are probably millions.

Google is using a monorepo.

Re: $36k Google App Engine RCE

#148

Post by aepiepaey »

rsto wrote: post #124
tptacek wrote: post #79

Earlier quoted context omitted.

There are dozens of firms like this, and have been for something like a decade now. The ostensibly totally above-board ones, like Zerodium, aren't "arms dealers"; they're controlled disclosure venues, which capture a premium from big companies and government buyers for access to threat intelligence information before they sit in vendor bug tracking systems for 3-9 months waiting for patches. There are, of course, rea…

I guess IC means "Intelligence Community", but what is a LEO? A Google search didn't provide meaningful results.

Law Enforcement Officers.

Re: $36k Google App Engine RCE

#149

Post by celticninja »

tptacek wrote: post #43
gnl wrote: post #23

Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.

Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it?…

I don't think you even need to go to the darknet. There are plenty of legal avenues open to you for selling exploits.

Re: $36k Google App Engine RCE

#150

Post by eyeareque »

londons_explore wrote: post #138
eyeareque wrote: post #81

Earlier quoted context omitted.

Wow, that is quite significant. 36k is not a small bounty for an RCE, but I feel like this is more critical to Google than the highest Android payout, for which they pay up to 200k for: https://www.google.com/about/appsecurity/android-rewards/

Android is wormable, and potentially not repairable by google. For example, with a decent remote android exploit, I could distribute a patched Google Play Services to all vulnerable handsets which disables updates and then listens to my own command and control infrastructure for further actions. I can now hold the phones hostage and extort google for money to regain control of them.

That would be pretty brutal and cause people to quit trusting android phones.

But I think the same could be accomplished with the access he had, or worse, but would have taken a lot more work. He also would have needed to avoid detection too. His access sounds more troubling than the Aroura attacks they had years ago.

Post reply on HN