Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 132 posts

Re: I have gained admin access to numerous GCloud Organizations by accident

#81

Post by rollcat »

intelVISA wrote: post #71
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

Internal SRE IRC? Too good for the laggy Slack/Teams/etc. CVEware?? I'd be jealous, but then I realized it prob has good uptime whereas using Slack is like a free day off every month with its SLA.

Long time ago, many jobs ago, the whole company was on Skype. We (the ops team) just set up an IRC server on one of the boxes.

(The box was also useful for a lot of other things, like an Openarena server. We tend to play StarCraft 2 these days though.)

Re: I have gained admin access to numerous GCloud Organizations by accident

#82

Post by tazjin »

intelVISA wrote: post #71
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

Internal SRE IRC? Too good for the laggy Slack/Teams/etc. CVEware?? I'd be jealous, but then I realized it prob has good uptime whereas using Slack is like a free day off every month with its SLA.

Yes, SRE doesn't wanna deal with all that crapware. Though as I was leaving, a lot of people were moving over to an IRC bridge to the (absolutely horrible, in my opinion) Google Chat.

Re: I have gained admin access to numerous GCloud Organizations by accident

#83

Post by tazjin »

OJFord wrote: post #78
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

This isn't a Google security incident though, they could fix it, but it's not obvious they should/would care to me? It's the third-party's security team (if there is one, otherwise engineering, contractor hirer, whoever) that should care isn't it?

Yes, but the way that would work is that somehow this should bubble through the security org to someone in Cloud Sales, who can then look in Salesforce who the relevant internal sales contacts (i.e. the people from Google that the affected company is in touch with) are and reach out to them.

Re: I have gained admin access to numerous GCloud Organizations by accident

#84

Post by geraldwhen »

koolba wrote: post #49
tazjin wrote: post #32

Ex-Googler here. Try reporting it through the security disclosure program: https://www.google.com/appserve/security-bugs/m2/new You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. This almost always works :) Maybe edit your OP with a way to contact you , so that someone c…

> You can also assume that by virtue of you having posted this here and being on the frontpage, it's probably made it to the internal Google SRE IRC chat by now and someone is trying to find a contact. In that case no point in following up at all right? Just post on HN and hope someone in the right spot sees it? > This almost always works :) That’s the type of SLA one can rely on! > Maybe edit your OP with a way to c…

Apples anonymous emails may work for this purpose.

Re: I have gained admin access to numerous GCloud Organizations by accident

#85

Post by [deleted] »

quietbritishjim wrote: post #23
leesalminen wrote: post #8

A few months ago I stumbled upon a bug in a state machine that allowed me to obtain stuff without having to pay for it. It was a weird combination of steps and was kind of hard to explain. I submitted a ticket to the support team advising them in painstaking detail the steps needed to reproduce this vulnerability. They could also look at my account and see that I got stuff without paying. A couple days later I got a…

There are quite a few post on Raymond Chen's "The Old New Thing" blog about bogus security reports e.g. this one [1] from 2022 or this one [2] from 2006. They're often described as requiring you to already be "on the other side of this airtight hatchway" (a Hitchhiker's Guide to the Galaxy reference) because you already need admin rights in order to get admin rights. That seems to suggest that Microsoft takes all sec…

[deleted]

Re: I have gained admin access to numerous GCloud Organizations by accident

#86

Post by anonymouskimmer »

anon223345 wrote: post #73
crazygringo wrote: post #65

As other commenters here have noted, a company can't just do this accidentally. If they add an external group, there's a warning message. Because many times it may be a mistake, but there are also many times a company will have a legitimate reason to do so. This isn't a bug, it's a feature. If you want to do the right thing, the correct course of action isn't to notify Google, it's to send an e-mail to the companies…

I’m just going to delete the group

Bad idea. You're a good person, the next person to create the group name (which you've helpfully published here) may not be.

Re: I have gained admin access to numerous GCloud Organizations by accident

#88

Post by anon223345 »

tazjin wrote: post #68
8organicbits wrote: post #51

Earlier quoted context omitted.

> by virtue of you having posted this here But it's not even the first time this issue was posted here. I'm not sure that approach works with Google. https://news.ycombinator.com/item?id=34193047

It's a dice roll, if someone in a timezone where people are working while this post is trending sees it, finds it interesting, and can be bothered to post about it somewhere internally - it can help! Of course, it would be better if there was an actually supported channel for sending this kind of information, but that's really not the fault of the people that end up finding this stuff and posting it internally (who a…

I’ll try that I suppose, it sounds like I’m going to have to delete that google group which is going to be a pain because I actually use it…

I did file a bug bounty hopefully that goes somewhere

Post reply on HN