GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
1–10 of 54 posts
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#2Oh boy someone's not going to have a fun long weekend
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#3I'm pretty impressed with the GCP response, both the fact that they identified the behavior and took the first step in reaching out.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#4I don’t know why, but I was disappointed they didn’t disclose how much the reward was.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#5Oh boy someone's not going to have a fun long weekend
As the article says, the vulnerability was fixed in April and the people who discovered it have already been rewarded under Google's Vulnerability Reward Program. Google also proactively detected the problem before being notified by the researchers.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#6Oh boy someone's not going to have a fun long weekend
It's already been resolved by Google and is not exploitable, so yes hopefully sysadmins using SQL Server on CloudSQL will indeed have an actually fun long weekend.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#7Oh boy someone's not going to have a fun long weekend
It's responsibly disclosed after the hole is patched.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#8I'm pretty impressed with the GCP response, both the fact that they identified the behavior and took the first step in reaching out.
I'm going to take a guess that reading files like /etc/shadow are 'tripwires', which trigger a review by an engineer.
With seccompbpf it's pretty simple to have systemwide tripwires on certain files/syscalls/network operations. Even if the attacker gains root, your tripwire will probably alert you before they can disable it.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#9I don’t know why, but I was disappointed they didn’t disclose how much the reward was.
Hopefully not very much... They were 'caught' by googles security team.
Who knows - if Google hadn't detected the intrusion, this attack might be on the black market by now.
Re: GCP CloudSQL Vulnerability Leads to Internal Container Access and Data Exposure
#10I'm pretty impressed with the GCP response, both the fact that they identified the behavior and took the first step in reaching out.
The other way to see it, is that it took them 8 days to notice a full compromise of the hosting OS and an open access to Google’s internal docker image repository URL.