Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we got read access on Google’s production servers

blog.detectify.com

Post reply on HN
Print view View original

191–197 of 197 posts

Re: How we got read access on Google’s production servers

#191

Post by frozenport »

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

You are a scumbag, but the math is right. You would need to discover 10 of these a year to make a living wage in SF - maybe 50 if you are a team of 5. They should pay what they pay their engineers.

Re: How we got read access on Google’s production servers

#192

Post by smprk »

chmars wrote: post #83

The guys behind this report have an interesting pricing model: Pay what you want! https://detectify.com/pricing The pricing models has apparently worked so far. Are any active users of Detectify here and can share their experience?

Very interesting in deed. There is a auto driver in India (a taxi like vehicle) who uses the same pricing model for his services - http://www.thebetterindia.com/4813/tbi-heroes-ahmedabad-no-r...

Nice to know about such things :-)

Re: How we got read access on Google’s production servers

#193

Post by ithkuil »

eric_cc wrote: post #163
derefr wrote: post #158

Earlier quoted context omitted.

There should be a security equivalent to hiring a lawyer to write strongly-worded letters for you. Maybe someone could set up a firm where individuals could hand them a vuln report, and then the firm would contact the vulnerable company on the individual's behalf. The firm would do the long, boring dance of "we suspect you're vulnerable to X, though we haven't tested it, but we'd like to do a free vulnerability test…

So you pay money to hire somebody to send a company a letter informing the company of the companies problem in hopes that maybe, just maybe, the company will reward the the firm a small sum of money and you will get a small amount back. I think you have a winner on your hands.

I might be living in a country with very few banks (3). I may benefit from letting them know about a security issue, especially if because of that issue I could potentially go to jail

I may not have the option of changing bank because the others are even worse.

however I don't know how much I would pay for that. Probably some kind of class action would work.

Re: How we got read access on Google’s production servers

#194

Post by ithkuil »

skj wrote: post #43
antocv wrote: post #8

So, when you have read access to googles prod servers, what else would be fun to do besides reading /etc/passwd ? Getting the source?

The source is not generally accessible from prod servers - only binaries and supporting data, and only the ones running on that computer. I guess it's possible you could find a computer that hosted both search and the codebase. But, since search is for external and the codebase is for internal, I'd be that they don't share clusters.

what if that file is per container and every software runs isolated? it's still a potential issue because you could retrieve other sensible information (log files?).

Re: How we got read access on Google’s production servers

#195

Post by skj »

ithkuil wrote: post #194
skj wrote: post #43

Earlier quoted context omitted.

The source is not generally accessible from prod servers - only binaries and supporting data, and only the ones running on that computer. I guess it's possible you could find a computer that hosted both search and the codebase. But, since search is for external and the codebase is for internal, I'd be that they don't share clusters.

what if that file is per container and every software runs isolated? it's still a potential issue because you could retrieve other sensible information (log files?).

Sure. I was only addressing the concern of accessing source.

Re: How we got read access on Google’s production servers

#196

Post by jrockway »

jmillikin wrote: post #189
jrockway wrote: post #147

Earlier quoted context omitted.

More likely, they'll just write bindings to libxml2.

I wrote a libxml2 binding in Haskell ( http://hackage.haskell.org/package/libxml-sax ). It was an absolute nightmare, in part because handling entities safely requires a lot of hoop-jumping (and I'm not even 100% I caught all the places libxml2 does unsafe stuff).

"absolute nightmare" sounds like you did pretty well for libxml2.

Re: How we got read access on Google’s production servers

#197

Post by [deleted] »

snowwrestler wrote: post #35
4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

How does selling an exploit to criminals not pose a moral question?

[deleted]
Post reply on HN