How we got read access on Google’s production servers • Hacker News Board

Re: How we got read access on Google’s production servers

#31

Post by msantos » Fri, Apr 11, 2014, 11:06 AM UTC

A few webcrawlers[1] out there follow HTTP redirect headers and ignore the change in schemas (this method is different of OP's but achieves the same goal).

So anyone can create a trap link such as

    gold

Or

   trap

once trap.html is requested the server issues a header "Location: file:///etc/passwd"

Then it's just a matter of seat and wait for the result to show up wherever that spider shows its indexed results.

[1] https://github.com/scrapy/scrapy/issues/457

Re: How we got read access on Google’s production servers

#32

Post by NicoJuicy » Fri, Apr 11, 2014, 11:10 AM UTC

dantiberian wrote: post #23

Very cool hack. Is $10,000 around the top end of what Google will pay out? This seems like quite a serious bug as far as they go.

No,

You can see the general payout levels here: http://www.google.com/about/appsecurity/reward-program/ , normally the top payout is about $ 20,000, but the top payout (for Chrome) currently 2 people have been rewarded with $ 60,000. There is an overview of the top payouts though: http://www.chromium.org/Home/chromium-security/hall-of-fame.

Some payouts are $1337 ,$3133.7 or $31336 :P

Microsoft rewards even up to $100.000 for security issues in the latest OS (currently Windows 8.1)

Re: How we got read access on Google’s production servers

#33

Post by rwmj » Fri, Apr 11, 2014, 11:12 AM UTC

ajuc wrote: post #27

twic wrote: post #7

Earlier quoted context omitted.

I would say the flaw is that XML parsers will try to resolve external entities on their own, by resolving file paths or whatever. They shouldn't do this by default: they should instead take a programmer-supplied entity resolver and call into that. They could also provide a canned resolver which hits the local filesystem and/or the web, which programmers could supply if they wanted, but this should not be a default. T…

> They shouldn't do this by default: they should instead take a programmer-supplied entity resolver and call into that. Then the programmers would write their own resolvers with even more bugs most probably. You would have 10 000 broken implementations of that code, half of them copied from stackoverflow example with security left as exercise for reader.

You could have a default implementation that callers have to set, eg:

    xmlSetFileResolver (xml, xmlDefaultFileResolver);

Callers could provide their own, but most will use none or use the supplied default.

Of course nothing helps for people who code by copying and pasting, rather than understanding what the API or library does.

Re: How we got read access on Google’s production servers

#34

Post by ohwp » Fri, Apr 11, 2014, 11:13 AM UTC

enscr wrote: post #12

Is there a startup that can help automate custom attacks on websites? Like guide the webmaster to look for holes in their setup. I'm guessing some security expert can do a good job educating new businesses on how to prepare for the big bad world.

Check the site of the blog post...

Re: How we got read access on Google’s production servers

#35

Post by snowwrestler » Fri, Apr 11, 2014, 11:17 AM UTC

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

How does selling an exploit to criminals not pose a moral question?

Re: How we got read access on Google’s production servers

#36

Post by adaml_623 » Fri, Apr 11, 2014, 11:29 AM UTC

spindritf wrote: post #10

numair wrote: post #2

... And this is why you want to discontinue products and services your engineers can't be motivated to maintain. Amazing. This should scare anyone who has ever left an old side project running; I could see a lot of companies doing a product/service portfolio review based on this as a case study.

Or just move it to some cheap VPS where it cannot damage other services or your infrastructure.

Or your reputation or your ethical and possibly legal duty to protect your clients?

Re: How we got read access on Google’s production servers

#37

Post by skj » Fri, Apr 11, 2014, 11:30 AM UTC

numair wrote: post #2

... And this is why you want to discontinue products and services your engineers can't be motivated to maintain. Amazing. This should scare anyone who has ever left an old side project running; I could see a lot of companies doing a product/service portfolio review based on this as a case study.

But I heard that discontinuing unstaffed projects was evil?

Re: How we got read access on Google’s production servers

#38

Post by cookiecaper » Fri, Apr 11, 2014, 11:32 AM UTC

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

Maybe I just read it wrong but it sounds like Google made an opening offer and the security group felt it was sufficient and decided to take it instead of negotiating. Maybe I'm wrong and they'd already given the details and Google was just trying to keep them happy and provide some cash for what otherwise would've been a Good Samaritan, open-source contributor type of report.

As long as Google is willing to negotiate, I don't see a problem with a group being satisfied with 10k and taking it.

Re: How we got read access on Google’s production servers

#39

Post by Fuxy » Fri, Apr 11, 2014, 11:33 AM UTC

danbruc wrote: post #22

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

[...] why would one not sell this on the black market? Because it is wrong to harm others for personal benefit?

I agree with you however companies are completely the void of morality their only purpose is profit and they will hire shady lawyers to interpret the law in their favor fire people without giving it a second thought or collude with other big companies to keep their employees wages low so why would i treat them differently.

In business morality is a luxury that some companies can't afford and most choose not to have so it shouldn't be expected.

The only thing preventing you from selling it on the black market is the potential fame and business you may get by being able to reveal your find which may or may not be worth it.

That 10k is not really much of an incentive from a business perspective.

Re: How we got read access on Google’s production servers

#40

Post by alternize » Fri, Apr 11, 2014, 11:34 AM UTC

josephagoss wrote: post #18

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

They made $10k plus a huge amount of free advertisement for their company and services (security). I reckon this release alone will earn them far more than your estimated $90k difference. Mind you, your point is certainly valid if this were a random hacker type.

very good advertisement indeed - i haven't heard about their service until today, and am now giving it a try.