6 ms·

Steps: 1. Send email that looks like it's from AdWords, claiming the user's CC needs to be updated 2. User logs into Google

Steps: 1. Send email that looks like it's from AdWords, claiming the user's CC needs to be updated 2. User logs into Google after verifying URL is in fact google.com 3. Google literally sends trusting user to attack site... to enter their credit card number How is this not a serious vulnerability?

dsacco 10y ago
First of all, open redirection is not a serious vulnerability. Serious vulnerabilities include remote code execution, SQL injection and cross-slide scripting (depending on the context). Serious vulnerabilities can be used to compromise user accounts without their interaction. Vulnerability severity is always a bit of a touchy subject, but calling open redirection serious is either hyperbolic or report-padding for security consultants. Second, this vulnerability cannot be used to compromise user accounts or data, let alone with or without their interaction. It is a social engineering attack that could work, yes, but the Google Vulnerability Rewards Program is specifically designed to reward researchers for reporting technical security vulnerabilities, not those leveraged through social engineering. Third, this is a rabbit hole. Google's core functionality is redirecting users to third party websites. You can just as easily send someone a link to a Google redirector that occurs in the browser when you click on a search result. It's not feasible to prevent this, and it's not feasible to prevent social engineering in general. Bug bounty programs require a hard line somewhere in order to function. In order for an attack to be acceptable, it must have a clearly demonstrable foundation in a software implementation failure. It must be clearly defined as a logic error, not an error in human reasoning. The only cases where open redirection and social engineering are eligible are those where they are simply peripheral - an actual technical vulnerability that allows these attacks to scale far beyond manual means (an example might be a technical failure in Facebook's linkshim service). I am disappointed in seeing that this story has risen to the top of the HN front page, because I believe there isn't a single security engineer here that would agree this is a technical vulnerability that should be eligible for a reward.
- mangeletti 10y ago
  > Serious vulnerabilities include remote code execution... I just meant "serious" in the general sense of the word, like the way that a bullet would in the stomach is serious, even though one in the head is more serious. > Google's core functionality is redirecting users to third party websites I'm pretty sure that Google's core functionality is ads, which don't require the user to actually be actually visiting pages Google. Pertaining using Google for social auth, the user is actually expecting to go back to the site they just came from, whereas when they login to update their credit card they're logging in to stay on Google, which means that a page that looks exactly like Google... How long this functionality remains on the site will be a better indicator. My guess is not long, esp after the publicity.
  - dsacco 10y ago
    >> I just meant "serious" in the general sense of the word, like the way that a bullet would in the leg is serious, even though one in the head is more serious." To continue your analogy more accurately, open redirection is not a gunshot wound, it's a cold.
    - parent5446 10y ago
      I don't know about a cold. Maybe the flu, since elderly and children are more at risk. ;)
      - xori 10y ago
        Really, people. Are we seriously doing this...
  - tpaksoy 10y ago
    >I'm pretty sure that Google's core functionality is ads You have got to be kidding me... So we're completely going to ignore that everyone is still using Google as a search engine, and not ads? You're making things up just to get your point across.
throwaway5752 10y ago
It's not a serious vulnerability, at least in the commonly understood sense of the word in security. It is phishing and spoofing, as Google accurately describes in their response. Maybe it's functionality for Google to change to prevent social engineering for susceptible users, but it's not something that deserves a bug bounty.
ggggtez 10y ago
Step 1 and step 3 are "trick the user". That alone should make it clear the real vulnerability is social engineering, and not a software flaw.
dewiz 10y ago
"Hey", they don't understand. </sarcasm> After the second "Hey", it started to annoy me, and I was just reading that post. Sounds quite condescending...

dsacco 10y ago

First of all, open redirection is not a serious vulnerability. Serious vulnerabilities include remote code execution, SQL injection and cross-slide scripting (depending on the context). Serious vulnerabilities can be used to compromise user accounts without their interaction. Vulnerability severity is always a bit of a touchy subject, but calling open redirection serious is either hyperbolic or report-padding for security consultants. Second, this vulnerability cannot be used to compromise user accounts or data, let alone with or without their interaction. It is a social engineering attack that could work, yes, but the Google Vulnerability Rewards Program is specifically designed to reward researchers for reporting technical security vulnerabilities, not those leveraged through social engineering. Third, this is a rabbit hole. Google's core functionality is redirecting users to third party websites. You can just as easily send someone a link to a Google redirector that occurs in the browser when you click on a search result. It's not feasible to prevent this, and it's not feasible to prevent social engineering in general. Bug bounty programs require a hard line somewhere in order to function. In order for an attack to be acceptable, it must have a clearly demonstrable foundation in a software implementation failure. It must be clearly defined as a logic error, not an error in human reasoning. The only cases where open redirection and social engineering are eligible are those where they are simply peripheral - an actual technical vulnerability that allows these attacks to scale far beyond manual means (an example might be a technical failure in Facebook's linkshim service). I am disappointed in seeing that this story has risen to the top of the HN front page, because I believe there isn't a single security engineer here that would agree this is a technical vulnerability that should be eligible for a reward.

mangeletti 10y ago
> Serious vulnerabilities include remote code execution... I just meant "serious" in the general sense of the word, like the way that a bullet would in the stomach is serious, even though one in the head is more serious. > Google's core functionality is redirecting users to third party websites I'm pretty sure that Google's core functionality is ads, which don't require the user to actually be actually visiting pages Google. Pertaining using Google for social auth, the user is actually expecting to go back to the site they just came from, whereas when they login to update their credit card they're logging in to stay on Google, which means that a page that looks exactly like Google... How long this functionality remains on the site will be a better indicator. My guess is not long, esp after the publicity.
- dsacco 10y ago
  >> I just meant "serious" in the general sense of the word, like the way that a bullet would in the leg is serious, even though one in the head is more serious." To continue your analogy more accurately, open redirection is not a gunshot wound, it's a cold.
  - parent5446 10y ago
    I don't know about a cold. Maybe the flu, since elderly and children are more at risk. ;)
    - xori 10y ago
      Really, people. Are we seriously doing this...
- tpaksoy 10y ago
  >I'm pretty sure that Google's core functionality is ads You have got to be kidding me... So we're completely going to ignore that everyone is still using Google as a search engine, and not ads? You're making things up just to get your point across.

throwaway5752 10y ago

It's not a serious vulnerability, at least in the commonly understood sense of the word in security. It is phishing and spoofing, as Google accurately describes in their response. Maybe it's functionality for Google to change to prevent social engineering for susceptible users, but it's not something that deserves a bug bounty.

ggggtez 10y ago

Step 1 and step 3 are "trick the user". That alone should make it clear the real vulnerability is social engineering, and not a software flaw.

dewiz 10y ago

"Hey", they don't understand. </sarcasm> After the second "Hey", it started to annoy me, and I was just reading that post. Sounds quite condescending...