Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#61

Post by nightpool »

elzbardico wrote: post #13

Even if you manage to reach out to Google, I doubt they will do anything like remove your group from those roles. From their POV you could be just trying to social engineer them into removing someone who has legitimate access. I think you have better chances contacting people in the org who added your group to those roles.

Agreed. I know Google is famously hard to get in touch with, but I don't understand how this fall on Google's plate or is really Google's fault at all. Maybe if they shared some more info about what IAM group they created that managed to trick people into adding it Google could create rules to ban group names like that from being created?

Re: I have gained admin access to numerous GCloud Organizations by accident

#62

Post by anon223345 »

thecarokann wrote: post #40

This is a known 'issue': https://news.ycombinator.com/item?id=34193047

Ha! This is exactly what I’m seeing…

I’m looking through these comments to see how I can reach out to google cloud from these links

I do not even want this access…!!!

Re: I have gained admin access to numerous GCloud Organizations by accident

#63

Post by anon223345 »

darkwater wrote: post #38

Just to better understand, was it a "generic enough" Google Group name that people used its name in the policy thinking they were granting access to their own "google cloud administrators"? Or were people/companies actively part of that Google Group you created?

Yes exactly, it’s a group with just a generic name I made many years ago…

Re: I have gained admin access to numerous GCloud Organizations by accident

#65

Post by crazygringo »

As other commenters here have noted, a company can't just do this accidentally. If they add an external group, there's a warning message. Because many times it may be a mistake, but there are also many times a company will have a legitimate reason to do so.

This isn't a bug, it's a feature. If you want to do the right thing, the correct course of action isn't to notify Google, it's to send an e-mail to the companies so they can revoke access to the group. It's not Google's problem.

Or if you don't want to deal with that and the group isn't used for anything anymore and you still want to be a good citizen, just delete everybody else from the group.

Re: I have gained admin access to numerous GCloud Organizations by accident

#67

Post by anon223345 »

mikyd1954 wrote: post #37

Not sure what support could do for you that you could not do yourself, ie: undertake to degrade the 'years ago group' and alert responders as needed.

Good call, the problem is I use the group for my own projects…

I will painstakingly change that to not use groups and then delete the group if it lets me

It’s just kinda stupid people are allowed to just add my group with my group not even confirming

Re: I have gained admin access to numerous GCloud Organizations by accident

#68

Post by tazjin »

8organicbits wrote: post #51
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

> by virtue of you having posted this here But it's not even the first time this issue was posted here. I'm not sure that approach works with Google. https://news.ycombinator.com/item?id=34193047

It's a dice roll, if someone in a timezone where people are working while this post is trending sees it, finds it interesting, and can be bothered to post about it somewhere internally - it can help!

Of course, it would be better if there was an actually supported channel for sending this kind of information, but that's really not the fault of the people that end up finding this stuff and posting it internally (who are often not even related to the problem, posting more of a "hey, anyone know anyone who can help this guy?" message).

FWIW, the security disclosure form I posted will end up reaching a human, which is why I suggested doing that anyways.

Re: I have gained admin access to numerous GCloud Organizations by accident

#69

Post by anon223345 »

we_never_see_it wrote: post #11

I have hard times feeling any sympathy for these companies. When you trust an ad company like Google what did you expect? Maybe Google will shutdown this product and fix the secuity hole in the process.

What it’s doing is actually useful, using a group to easily add people to roles is great

Not making the group do confirmation, or even acknowledging the addition is super stupid

Re: I have gained admin access to numerous GCloud Organizations by accident

#70

Post by AugurCognito »

leesalminen wrote: post #12
invalidname wrote: post #7

As a person who paid for Google's "Gold" support. They are less than useless. Don't go into these accounts at all. Not even to try and help/contact them. Laws about this are very vague and no one within the ORG would want to admit that they made a mistake by adding you.

I’ve had access to both Google’s and Amazon’s paid support options (up to and including enterprise support). Amazon’s support has gone above and beyond for me over the years in ways I didn’t even expect or ask them to. In comparison, I agree with you that Google’s support is useless. My experiences with AWS support have actually left me with a positive impression of the platform, while my experiences with Google rein…

Will choose AWS just for support anyday over alternatives. I'm not even a paying customer and I had a slight issue regarding multiple emails registered under the same account and such. I was just starting with AWS. The support was really helpful and provided me with information I didn't even know I needed.
Post reply on HN