Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we got read access on Google’s production servers

blog.detectify.com

Post reply on HN
Print view View original

61–70 of 197 posts

Re: How we got read access on Google’s production servers

#61

Post by claudius »

raverbashing wrote: post #48

This is another reason not to use XML, plain and simple It's too much hidden power in the hands of those who don't know what they're doing (loading external entities pointed in an XML automatically? what kind of joke is that?)

> loading external entities pointed in an XML automatically? what kind of joke is that?

Your browser does much the same when parsing (X)HTML. LaTeX naturally includes ‘external’ resources when building an output file. There are tons of examples like that, loading external entities per se is not wrong, it’s mostly just wrong under these specific circumstances.

Re: How we got read access on Google’s production servers

#62

Post by borplk »

4ad wrote: post #15

Just $10k? This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market. Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid t…

The purpose of the bounty prize is not to outbid or compete with the criminals.

Re: How we got read access on Google’s production servers

#64

Post by acdha »

vidarh wrote: post #6
raesene3 wrote: post #5

Interesting to see this hit big companies like google. The problem, I think, stems from the idea that most people treat XML parsers as a "black box" and don't enquire too closely as to all the functionality that they support. Reading the spec. which led to the implementations, can often reveal interesting things, like support for external entities..

Also horrible defaults in XML parsers. That any XML parsers allow retrieval of DTD's without explicit options specifying allowed sources etc. is beyond me. It's not just local file access, which becomes a security hole when you let users pass you XML files, though that is one of the worst ones. But the number of times I've seen production apps that turn out to behind the scenes request DTD's or schemas from remote se…

The crazy part about this is that I remember having these conversations over a decade ago and it was very clearly recognized as a major security, reliability and performance problem but the greater XML community basically just shrugged it off.

One really interesting aspect of this is that many applications suddenly broke when the Republicans shut down the government last year because a number of XML schemas are managed by government agencies who were suddenly legally unable to provide their normal web services:

http://gis.stackexchange.com/a/73777 http://forums.arcgis.com/threads/94294-Expected-DTD-markup-w... http://www.catalogingrules.com/?p=77

Makes me wonder whether it's time to start contributing patches to disable bad ideas like this by default — some places are clearly paying a significant amount to serve content nobody should need: http://www.w3.org/blog/systeam/2008/02/08/w3c_s_excessive_dt...

Re: How we got read access on Google’s production servers

#65

Post by pbhjpbhj »

laichzeit0 wrote: post #54
pbhjpbhj wrote: post #50

Earlier quoted context omitted.

How would you escrow it so that you can be sure to actually get the funds? Sure they're not going to pay up front and it would be over-trusting to give a crack away on the promise of later funds, so ...

That's not really a problem specific to Bitcoin only. I've seen Bitcoin Escrow services but I'm not sure which ones are trust worthy.

No, indeed I wasn't pitching that as a problem with BTC - just in general how can you ensure a secret transaction will go through. You'd need a trusted escrow, a trusted escrow would probably need to have a business address [and other things] for you to trust them ... but that means they'd be registered to handle money in all likelihood and that means records of your transaction that law enforcement could eventually get hold of?

Re: How we got read access on Google’s production servers

#66

Post by Trufa »

mixmax wrote: post #9

In large production environments it's almost impossible to avoid bugs - and some of them are going to be nasty. What sets great and security conscious companies apart from the rest is how they deal with them. This is an examplary response from google. They respond promptly (with humor no less) and thank the guys that found the bug. Then they proceeded to pay out a bounty of $10.000. Well done google.

Indeed, it's funny that I'm reading about a vulnerability they had and it's actually making me feel more safe about using their products.

Re: How we got read access on Google’s production servers

#67

Post by Fuxy »

lotsofmangos wrote: post #59
Fuxy wrote: post #39

Earlier quoted context omitted.

I agree with you however companies are completely the void of morality their only purpose is profit and they will hire shady lawyers to interpret the law in their favor fire people without giving it a second thought or collude with other big companies to keep their employees wages low so why would i treat them differently. In business morality is a luxury that some companies can't afford and most choose not to have s…

companies are completely the void of morality their only purpose is profit Companies are groups of people and have many different purposes. I understand being worried about the rise in corporate oligarchy, but your argument is itself the attitude you are accusing companies of. The problem isn't companies being immoral, but people rationalising behaviour that they know to be immoral.

That's probably because i treat them the same way they treat me.

Their attitude makes sense and sometimes it's actually necessary for a companies/entities survival.

We all face hard choices between what's moral and what's best for our own survival the only difference is companies put any amount of small profit over morality not just survival.

I don't make the rules i just play the game.

Re: How we got read access on Google’s production servers

#68

Post by lotsofmangos »

Fuxy wrote: post #67
lotsofmangos wrote: post #59

Earlier quoted context omitted.

companies are completely the void of morality their only purpose is profit Companies are groups of people and have many different purposes. I understand being worried about the rise in corporate oligarchy, but your argument is itself the attitude you are accusing companies of. The problem isn't companies being immoral, but people rationalising behaviour that they know to be immoral.

That's probably because i treat them the same way they treat me. Their attitude makes sense and sometimes it's actually necessary for a companies/entities survival. We all face hard choices between what's moral and what's best for our own survival the only difference is companies put any amount of small profit over morality not just survival. I don't make the rules i just play the game.

Are you a bot with a database of platitudes?

Re: How we got read access on Google’s production servers

#69

Post by krapp »

brown9-2 wrote: post #56
raverbashing wrote: post #48

This is another reason not to use XML, plain and simple It's too much hidden power in the hands of those who don't know what they're doing (loading external entities pointed in an XML automatically? what kind of joke is that?)

Sure, but didn't YAML in Rails do mostly the same type of thing? It's not just XML that is dumb like this.

YAML and XML seem too powerful and too complex for their own common use cases (data storage). Markdown too - how many Markdown parsers allow for strict parsing against an HTML whitelist, and don't allow native HTML at all by default?

Re: How we got read access on Google’s production servers

#70

Post by justincormack »

userbinator wrote: post #51
raesene3 wrote: post #5

Interesting to see this hit big companies like google. The problem, I think, stems from the idea that most people treat XML parsers as a "black box" and don't enquire too closely as to all the functionality that they support. Reading the spec. which led to the implementations, can often reveal interesting things, like support for external entities..

I agree, this can be summarised as "abstraction hides bugs". I believe that although abstraction is a powerful tool, there is such a thing as too much of it, and when reading an XML document can cause access to other files, maybe even across the network, perhaps things have gone a little too far. This isn't like an obvious #include or @import, it's much more subtle. When I first noticed that HTML doctypes have URLs i…

They are supposed to be identifiers and not resolved. But using http for something not to be resolved is odd...
Post reply on HN