Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#21

Post by elzbardico »

peddling-brink wrote: post #16
we_never_see_it wrote: post #11

I have hard times feeling any sympathy for these companies. When you trust an ad company like Google what did you expect? Maybe Google will shutdown this product and fix the secuity hole in the process.

Google should shut down Cloud because they allow groups to be added to IAM? That’s an interesting take.

I think you misinterpreted OP. He is making a pun with the widespread beliefs that

a) Google doesn't care about giving user support for their products even if you pay

b) Over a not-so-long time the survival rate of every Google product seems to drop to zero unless it is related to search and ads.

So, the joke is that the problem would solve itself when google predictably kills this product.

Re: I have gained admin access to numerous GCloud Organizations by accident

#22

Post by ghusto »

peddling-brink wrote: post #16
we_never_see_it wrote: post #11

I have hard times feeling any sympathy for these companies. When you trust an ad company like Google what did you expect? Maybe Google will shutdown this product and fix the secuity hole in the process.

Google should shut down Cloud because they allow groups to be added to IAM? That’s an interesting take.

Fair enough, but it's also worth noting that this mistake is difficult to make in AWS. You can do it, but you have to be so explicit about what you're doing that I can't imagine anyone managing it accidentally.

The system is broken if this has happened _multiple_ times to this guy.

Re: I have gained admin access to numerous GCloud Organizations by accident

#23

Post by quietbritishjim »

leesalminen wrote: post #8

A few months ago I stumbled upon a bug in a state machine that allowed me to obtain stuff without having to pay for it. It was a weird combination of steps and was kind of hard to explain. I submitted a ticket to the support team advising them in painstaking detail the steps needed to reproduce this vulnerability. They could also look at my account and see that I got stuff without paying. A couple days later I got a…

There are quite a few post on Raymond Chen's "The Old New Thing" blog about bogus security reports e.g. this one [1] from 2022 or this one [2] from 2006. They're often described as requiring you to already be "on the other side of this airtight hatchway" (a Hitchhiker's Guide to the Galaxy reference) because you already need admin rights in order to get admin rights.

That seems to suggest that Microsoft takes all security reports seriously even if most turn out to be bogus.

[1] https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=10...

[2] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Re: I have gained admin access to numerous GCloud Organizations by accident

#25

Post by ghusto »

secondcoming wrote: post #17

Be very careful. Even though you're trying to do The Right Thing don't alert these companies to the fact you've been accessing their accounts without permission.

I'm seeing a lot of these kinds of comments, and think this might just be an American worry (because it's such a litigious place)?

People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things. I can't imagine them doing anything other than thanking you profusely.

I mention this because I'd rather this kind of attitude wasn't imported to Europe.

Re: I have gained admin access to numerous GCloud Organizations by accident

#26

Post by boilerupnc »

I would have thought that being "added" to anything is a two-way confirmation:

1. One from the party wanting to add the group to their account. Based on a prior comment, sounds like you are prompted to confirm an external group being added as admin.

2. One from the party administering/owning an external google group being requested to be added. Is there any confirmation here?

Without the 2nd confirm, I start imagining security exposures in the family of Ransomware - let's call it "RansomAdd". You randomly add external google groups until you get someone to poke around "too much" and then threaten them with legal action unless they pay up. Ugh.

Re: I have gained admin access to numerous GCloud Organizations by accident

#28

Post by [deleted] »

boilerupnc wrote: post #26

I would have thought that being "added" to anything is a two-way confirmation: 1. One from the party wanting to add the group to their account. Based on a prior comment, sounds like you are prompted to confirm an external group being added as admin. 2. One from the party administering/owning an external google group being requested to be added. Is there any confirmation here? Without the 2nd confirm, I start imaginin…

[deleted]
Post reply on HN