Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#71

Post by intelVISA »

tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

Internal SRE IRC? Too good for the laggy Slack/Teams/etc. CVEware??

I'd be jealous, but then I realized it prob has good uptime whereas using Slack is like a free day off every month with its SLA.

Re: I have gained admin access to numerous GCloud Organizations by accident

#72

Post by anon223345 »

tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

Thank you will try that…

Re: I have gained admin access to numerous GCloud Organizations by accident

#73

Post by anon223345 »

crazygringo wrote: post #65

As other commenters here have noted, a company can't just do this accidentally. If they add an external group, there's a warning message. Because many times it may be a mistake, but there are also many times a company will have a legitimate reason to do so. This isn't a bug, it's a feature. If you want to do the right thing, the correct course of action isn't to notify Google, it's to send an e-mail to the companies…

I’m just going to delete the group

Re: I have gained admin access to numerous GCloud Organizations by accident

#74

Post by michaelt »

ghusto wrote: post #25
secondcoming wrote: post #17

Be very careful. Even though you're trying to do The Right Thing don't alert these companies to the fact you've been accessing their accounts without permission.

I'm seeing a lot of these kinds of comments, and think this might just be an American worry (because it's such a litigious place)? People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things. I can't imagine them doing anything other than thanking you profusely. I mention this because I'd rather this kind of attitude wasn't imported to Europe.

> People in the Netherlands and England where I also lived for a short while, are pretty chill with these kinds of things.

Imagine that, at 5pm on Friday, you discover your IT system has been the target of a huge hack, possibly by russians or north koreans, that they got access to everything, it's been going on for months, and it's certainly a notifiable breach under GDPR.

Would you be chill?

I can say from experience, many people call the cops and lawyers first, and only find the support ticket that first-level support fobbed off with a canned response much later.

Re: I have gained admin access to numerous GCloud Organizations by accident

#75

Post by tedivm »

yolo3000 wrote: post #50

I think you can reach them on their forum as well, for example https://www.googlecloudcommunity.com/gc/Security/Welcome-to-... .

Most of those "community" forums are not monitored by actual staff. Google uses "communities" as a way to get free tier one support out of the community, and to save even more money they just never bothered with any tiers beyond that.

Re: I have gained admin access to numerous GCloud Organizations by accident

#76

Post by [deleted] »

anon223345 wrote: post #62
thecarokann wrote: post #40

This is a known 'issue': https://news.ycombinator.com/item?id=34193047

Ha! This is exactly what I’m seeing… I’m looking through these comments to see how I can reach out to google cloud from these links I do not even want this access…!!!

[deleted]

Re: I have gained admin access to numerous GCloud Organizations by accident

#77

Post by [deleted] »

anon223345 wrote: post #63
darkwater wrote: post #38

Just to better understand, was it a "generic enough" Google Group name that people used its name in the policy thinking they were granting access to their own "google cloud administrators"? Or were people/companies actively part of that Google Group you created?

Yes exactly, it’s a group with just a generic name I made many years ago…

[deleted]

Re: I have gained admin access to numerous GCloud Organizations by accident

#78

Post by OJFord »

tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

This isn't a Google security incident though, they could fix it, but it's not obvious they should/would care to me?

It's the third-party's security team (if there is one, otherwise engineering, contractor hirer, whoever) that should care isn't it?

Post reply on HN