Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we got read access on Google’s production servers

blog.detectify.com

Post reply on HN
Print view View original

161–170 of 197 posts

Re: How we got read access on Google’s production servers

#161

Post by bananas »

TallGuyShort wrote: post #94
borski wrote: post #87

Earlier quoted context omitted.

I am really glad about how they responded. Whenever Tinfoil has found vulnerabilities in companies like United Airlines[0], for example, those companies mostly respond with anger rather than graciousness. [0] https://www.tinfoilsecurity.com/blog/132969897

Exactly. I just saw that the local bank my parents use is still vulnerable to the Heartbleed Bug. But you know what? I don't want to go down there and talk to them because I'm quite certain they'll call the police because I "hacked into their systems".

That's what pastebin is for.

Re: How we got read access on Google’s production servers

#162

Post by opendais »

detectifyuser wrote: post #90
halflings wrote: post #76

I hope it doesn't get unnoticed that the guys who discovered this vulnerability created a really great product, Detectify : https://detectify.com/ They also discovered vulnerabilities in many big websites (dropbox, facebook, mega, ...). Their blog also has many great write-ups : http://blog.detectify.com/

While they are probably good at doing this manually, their automated tool finds very little. And they were kind of assholes on support :(

Odd, I had the opposite experience. They seemed fine to me.

Re: How we got read access on Google’s production servers

#163

Post by eric_cc »

derefr wrote: post #158
TallGuyShort wrote: post #94

Earlier quoted context omitted.

Exactly. I just saw that the local bank my parents use is still vulnerable to the Heartbleed Bug. But you know what? I don't want to go down there and talk to them because I'm quite certain they'll call the police because I "hacked into their systems".

There should be a security equivalent to hiring a lawyer to write strongly-worded letters for you. Maybe someone could set up a firm where individuals could hand them a vuln report, and then the firm would contact the vulnerable company on the individual's behalf. The firm would do the long, boring dance of "we suspect you're vulnerable to X, though we haven't tested it, but we'd like to do a free vulnerability test…

So you pay money to hire somebody to send a company a letter informing the company of the companies problem in hopes that maybe, just maybe, the company will reward the the firm a small sum of money and you will get a small amount back.

I think you have a winner on your hands.

Re: How we got read access on Google’s production servers

#164

Post by theboss »

tptacek wrote: post #156
flylib wrote: post #145

Earlier quoted context omitted.

"dumb web vulnerabilities" that have huge implications could fetch a pretty penny for sure

No, they can't. Read the inverse of my bulleted list to see what makes money: * Bugs that fit readily into operational frameworks (ie: it would be reasonable to have a UI with a button invoking that bug and/or any of the 15 other bugs like it) * Bugs that can't be killed with a single patch cycle by a single entity * Bugs that provide long-term access, or access that is unlikely to get your entire syndicate caught Ex…

I think you two disagree on what a "dumb web vulnerability" is.

Re: How we got read access on Google’s production servers

#165

Post by derefr »

eric_cc wrote: post #163
derefr wrote: post #158

Earlier quoted context omitted.

There should be a security equivalent to hiring a lawyer to write strongly-worded letters for you. Maybe someone could set up a firm where individuals could hand them a vuln report, and then the firm would contact the vulnerable company on the individual's behalf. The firm would do the long, boring dance of "we suspect you're vulnerable to X, though we haven't tested it, but we'd like to do a free vulnerability test…

So you pay money to hire somebody to send a company a letter informing the company of the companies problem in hopes that maybe, just maybe, the company will reward the the firm a small sum of money and you will get a small amount back. I think you have a winner on your hands.

They wouldn't be doing it for the money. The EFF would be a good example of a firm that could take this practice up.

Re: How we got read access on Google’s production servers

#166

Post by meowface »

tptacek wrote: post #101
4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

That vulnerability does not sell for 10x on "the black market". * It fits into nobody's existing operational framework (no crime syndicate has a UI with a button labeled "read files off Google's prod servers") * A single patch run by a single organization kills it entirely * The odds of anyone, having extended access and pivoted into Google's data center, keeping that access is zero. I'm not an authority on how much…

Exactly. Unless this could somehow be pivoted into write access, with the ability to modify server responses to clients (for phishing or installing malware), no black hat would care about this.

Re: How we got read access on Google’s production servers

#167

Post by d0m »

detectify wrote: post #107
enscr wrote: post #12

Is there a startup that can help automate custom attacks on websites? Like guide the webmaster to look for holes in their setup. I'm guessing some security expert can do a good job educating new businesses on how to prepare for the big bad world.

Hi! In fact, that's exactly what we do at Detectify. Just check out https://detectify.com !

I think you just proved that writing an excellent blog post like you did is an amazing way to get new customers!! Maybe make it a tad more explicit in the post (or page) what detectify do. I personally had no idea.. but I just checked the homepage because I liked the design and was curious, and it's only then I realized what you guys were doing.

Re: How we got read access on Google’s production servers

#168

Post by Peaker »

gamegoblin wrote: post #159
Peaker wrote: post #153

Earlier quoted context omitted.

We're not talking about a malicious XML library here, though. We're talking about a misunderstanding regarding what happens during legitimate parsing of XML.

I was just responding to you about pure functions. You can make a Haskell function with a pure type signature that includes a call to unsafePerformIO.

You can, but:

A) Legitimate libraries don't (unless the IO action is in fact pure)

B) Rogue libraries that do this will not generally work: laziness, optimizations, RTS races can all make the IO action run 0..N times, arbitrarily.

C) It doesn't change the fact that in Haskell, the XML library exposes the weird XML behavior of looking up external entities by being in IO (my original point) -- because of A.

Re: How we got read access on Google’s production servers

#169

Post by enneff »

thrownaway2424 wrote: post #106
kirab wrote: post #98

I think they couldn’t read /etc/shadow, so it’s not that bad at first. But then they could surely access some configuration file of the application itself, probably containing DB creds and of course more information which helps to find more vulns.

It's shocking to me that baking "db creds" into a binary or configuration file is still so common that anyone would expect it to be true on a randomly selected server. Is this still the industry standard?

That's certainly not how we do it at Google.
Post reply on HN