Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I have gained admin access to numerous GCloud Organizations by accident

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 132 posts

I have gained admin access to numerous GCloud Organizations by accident

#1

Post by anon223345 »

in Google Cloud, you can assign admin, billing, etc to a google group.

Years ago I made a google group for google cloud administration

A company in Spain, a bunch of startups, etc have added that google group (by accident) as an IAM user with varying level of roles attached

I now have billing access to one account, admin access to another, can just hop into the database of at least two of the accounts

I try to reach out to google support but because I don’t have “business” or “enterprise” level support I can’t even submit a ticket

I’m trying to let them know but can’t, they do t do chat, no phone number, even billing contact is an automated chatbot only

GCloud should have like “emergency reach out to a person” link or something

Re: I have gained admin access to numerous GCloud Organizations by accident

#3

Post by LinuxBender »

As an admin of their group can you see their group admin contact email address? If so maybe they have an enterprise account and can reach a human in Google. I am not a lawyer but there is probably risk in accessing any of their data, audit trails and all.

Re: I have gained admin access to numerous GCloud Organizations by accident

#4

Post by anon223345 »

LinuxBender wrote: post #3

As an admin of their group can you see their group admin contact email address? If so maybe they have an enterprise account and can reach a human in Google. I am not a lawyer but there is probably risk in accessing any of their data, audit trails and all.

Ya I’m not doing anything, I saw these random orgs on my console and just clicked and it took me to those pages

Didn’t poke around, was more like what the heck is this?

I only noticed because I logged in and the page defaulted to Spanish (it picked the first org, which happens to be a Spanish car company)

Then I noticed in the drop downs. I actually thought I was hacked, then realized what was going on.

Still trying to find a way to get ahold of Google lol

Re: I have gained admin access to numerous GCloud Organizations by accident

#5

Post by LinuxBender »

anon223345 wrote: post #4
LinuxBender wrote: post #3

As an admin of their group can you see their group admin contact email address? If so maybe they have an enterprise account and can reach a human in Google. I am not a lawyer but there is probably risk in accessing any of their data, audit trails and all.

Ya I’m not doing anything, I saw these random orgs on my console and just clicked and it took me to those pages Didn’t poke around, was more like what the heck is this? I only noticed because I logged in and the page defaulted to Spanish (it picked the first org, which happens to be a Spanish car company) Then I noticed in the drop downs. I actually thought I was hacked, then realized what was going on. Still trying…

I have no idea if this [1] is still valid but it has a number that might work. Perhaps tell them you may have experienced a security incident related to a Google UI/UX bug. Another approach could be reaching out to their Project Zero team. [2] or try some of the contacts here [3] and tell them you may have a security incident that has enabled access to other organizations.

[1] - https://www.businessinsider.com/guides/tech/how-to-contact-g...

[2] - https://googleprojectzero.blogspot.com/

[3] - https://about.google/contact-google/

Re: I have gained admin access to numerous GCloud Organizations by accident

#7

Post by invalidname »

As a person who paid for Google's "Gold" support. They are less than useless.

Don't go into these accounts at all. Not even to try and help/contact them. Laws about this are very vague and no one within the ORG would want to admit that they made a mistake by adding you.

Re: I have gained admin access to numerous GCloud Organizations by accident

#8

Post by leesalminen »

A few months ago I stumbled upon a bug in a state machine that allowed me to obtain stuff without having to pay for it. It was a weird combination of steps and was kind of hard to explain.

I submitted a ticket to the support team advising them in painstaking detail the steps needed to reproduce this vulnerability. They could also look at my account and see that I got stuff without paying.

A couple days later I got a reply from a support manager that my concern wasn’t valid and there was no bug.

The next week I happened to be at a conference where the company in question was a sponsor. So, I visited their booth and spoke with the VP of Eng. He asked me to forward the ticket to security@. Within 8 hours I got a reply from them saying that they had fixed the bug.

I guess I’m saying that even if Google let you submit a support ticket it might get ignored because they aren’t trained to deal with security reports.

Re: I have gained admin access to numerous GCloud Organizations by accident

#10

Post by toomuchtodo »

leesalminen wrote: post #8

A few months ago I stumbled upon a bug in a state machine that allowed me to obtain stuff without having to pay for it. It was a weird combination of steps and was kind of hard to explain. I submitted a ticket to the support team advising them in painstaking detail the steps needed to reproduce this vulnerability. They could also look at my account and see that I got stuff without paying. A couple days later I got a…

To your point, there should be some easy way to get a security incident report to the security team through an easily discoverable form or similar. This is as easy as "security incident" option in a support ticket drop down, and triage is required whether this is an ingest point or security@ email.
Post reply on HN