13 ms·

Google Bug Bounty – The $5k Error Page

486 points by louis-paul 9y ago

rprime 9y ago
I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)
- terminalcommand 9y ago
  I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).
  - throw9912 9y ago
    How did you subdomain search? Was it a brute force / dict search?
    - yeukhon 9y ago
      DNS recon tool should be able to do it. If you look around for DNS online tool couple dozens of Google subdmains will be revealed. With Certificate Transparency this kind of information is not as secret as it used to be. Last year there was a vulnerability I forgot which it was quite big has something to do with a legacy software and it led me to look at what domains are using my company's cert. Qualy's made a tool out of this.
    - dsacco 9y ago
      DNS search. You can use a tool like fierce or subbrute if you're lazy.
    - schwag09 9y ago
      Shameless self-plug: You can use Fierce! A DNS reconnaissance tool - https://github.com/mschwager/fierce https://github.com/mschwager/fierce
  - rprime 9y ago
    Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D. I guess it's as much mindset as it's skill.
    - Ajedi32 9y ago
      I got a bug bounty once because I reported a bug in Chrome that someone else was complaining about in the comments section of a tech blog. If instead of just complaining that commenter had taken the time to fill out a bug report they could have easily gotten the bounty instead. Sometimes it just takes a tiny bit of extra effort to go from noticing something's amiss to actually doing something to get it fixed.
      - dsacco 9y ago
        What was the security issue?
        Ajedi32 9y ago
        CVE-2015-1274 Basically, Chrome allowed users to use the "Always open files of this type" option with executable files. So if anyone was ever foolish enough to set that option after downloading a `.exe` on Windows, any future site they visited could take over their machine just by initiating a download for a malicious executable.
      - rootsudo 9y ago
        Good idea. Imagine if you can do one bug report a month. 5K is nice income.
  - microcolonel 9y ago
    riskMi is probably from CA Technologies RiskMinder™.
- Buge 9y ago
  A few weeks ago? It says a temporary fix was done by February 10.
mickrussom 9y ago
Nice , glad he got paid. Whats truly sad is they did try to chisel him out of his bounty if you read the timeline, he had to prod them to get his bounty. Can any of these top-ten companies that make like 200 million per day (google/alphabet, amazon, microsoft) ever do anything in good faith? One time google stiffed me initially on an RMA with a nexus phone until I stamped my feet a bit complaining that a company that makes 200M/day is stiffing me, the loyal android lover, for a $200 hunk of chinese-made plastic. (and just a short while later with things like SafetyNet I can no longer have root on an $800 pixel that isnt even waterproof). So much for dont be evil. Well, they dropped that in favor of -"do the right thing—follow the law, act honorably, and treat each other with respect" yeah, they can respectably be cheap chiseling money grubbers as long as its legal - like helping locate Falun Gong members in China. And the corporate stewardship -in the hands of the employees - they get blinded by the huge pay and instantly fail to see the bad things that go on. Anyways, glad he got paid. Amazing that a company with 57000 employees (and TONS of contractors, they dont want more employees who get benefits and stock when they can string contractors along) needs some random guy to find holes in the back door.
- foota 9y ago
  I find it much more likely that they just dropped the ball on paying them, rather than maliciously trying to deny them a bounty.
  - mickrussom 9y ago
    Try arguing with them about an SLA violation they had with their cloud infrastructure. The game is setup where they can chisel and have these guffaw and aw garsh moments but every adword and every billable second on their cloud will get paid hell or high water.
    - dsacco 9y ago
      Did you seriously come to hijack a story about a Google bug bounty so you could complain about an irrelevant issue?
arnioxux 9y ago
In at least two other companies I've worked at we also use query params to enable debug information on live production sites. At one of those companies the only requirement was that you be on a corporate ip address but it actually still works if you're on our guest wifi.
ensiferum 9y ago
I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!
- sushid 9y ago
  Google's known for their fast triage/response time. They're also fairly generous with their bounties.
- nodesocket 9y ago
  Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.
  - to3m 9y ago
    Most of their consumer-facing services are not, shall we say, famous for being high-touch... But presumably different people look after the security side of things.
  - kristianp 9y ago
    This story from yesterday has raised some resentment about google's support: A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409 https://news.ycombinator.com/item?id=14356409
    - joatmon-snoo 9y ago
      Their customer/enterprise support is notoriously sketchy, at least from the outside (a la HN) looking in. That's not the same at all as their bug bounty program, which is generally one of the best out there.
- carvalho 9y ago
  Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.
Macuyiko 9y ago
So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one train an agent that goes off and tries this sort of things autonomously? Might be fun to translate the HTTP intrusion domain into a deep learning architecture. Similar things are being applied on the "defensive" side of things already anyway (i.e. Iranian, Turkish, Chinese firewall systems using machine learning to identify and block new patterns), so why not apply this on the offensive side. *: Not to demean the author in any way; I understand that putting the time in to explore these things is easier said than done in hindsight.
- wslh 9y ago
  It is an interesting subject to research but not easy. Finding and the exploiting a bug is art and science. Augmenting fuzzying with AI is an interesting approach.
- komali2 9y ago
  I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.
  - em3rgent0rdr 9y ago
    If the good people don't do it soon, the bad people will...
    - chrismarlow9 9y ago
      not really, there's enough bad schemes that already work to bother with fancy technical exploits
GauntletWizard 9y ago
As a Xoogler who misses the debug stack, this was some fun nostalgia. Good catch!
- Artemis2 9y ago
  Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.
  - slashcrypto 9y ago
    Would be very interesting to know what SFFE means ;)
    - CiPHPerCoder 9y ago
      Static File Front-End?
      - puzzle 9y ago
        The hostname is static.corp and the service is static-on-bigtable, so...
    - SparkyMcUnicorn 9y ago
      I'm pretty certain it's a server name. It's a similar convention as some of their other names such as GRFE (Groups), bsfe (Blog Search Front-End). https://googlesystem.blogspot.com/2007/09/googles-server-names.html#gsc.tab=0 https://googlesystem.blogspot.com/2007/09/googles-server-nam...
  - mh- 9y ago
    fairly sure it just stands for "staticfile frontend".. nothing too exciting. edit: some support for that at https://bugs.chromium.org/p/chromium/issues/detail?id=548688#c6 https://bugs.chromium.org/p/chromium/issues/detail?id=548688... /bns/pe/borg/pe/bns/static-on-bigtable/staticfile.frontend.sffe/93
hackjam600 9y ago
We do supply high quality medical marijuana (indoors and Outdoors) with great Sativa and Indica strong THC and CBD strains, Our products are of the grade A quality type Such as White widow Purple haze Afghan kush Durban poison And lot more Contact: hackjam600@gmail.com
ChuckMcM 9y ago
Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped. It is too bad the person who caused it didn't file for a bug bounty like this person did, they probably would have had something to show for their efforts besides "hey look at this funny thing you can do, oh wait it doesn't do it any more."
- carvalho 9y ago
  On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.
  - logicallee 9y ago
    It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words, was to just download a project gutenberg of the complete works of shakespeare, and find the longest string consisting of just stop words in there, then search for it as a literal quote. The longest one I found was: "From what it is to a". Let me see how long Google takes to do it now :) 2.04 seconds! Nice :) - http://i.imgur.com/IhPTpr6.png http://i.imgur.com/IhPTpr6.png that took 30+ seconds 'back in the day'.
    - sova 9y ago
      Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?
louprado 9y ago
Here's a link to the Google Security Rewards Program https://www.google.com/about/appsecurity/programs-home/ https://www.google.com/about/appsecurity/programs-home/
ArlenBales 9y ago
> 10/02/2017 – Google already fixed the issue but forgot to tell me … I contacted them asking for an update > 19/02/2017 – Got a response, they implemented a short-term fix and forgot to sent my report to the VRP panel … I hope Google forgetting to follow up on bug bounties and needing to be reminded isn't a common occurrence.
- jcims 9y ago
  Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporters and bogged down by working the bug through the pipeline. There are systems and processes to help with all of this of course, but at the end of the day it's still a pretty tricky job to get perfect all the time.
  - daddyo 9y ago
    What's the general signal to noise ratio for bug reports?
    - dsacco 9y ago
      About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports like (I kid you not): "You have the OPTIONS method allowed on your site this is really serious." The last time I looked at the numbers, Google had over 80,000 bug bounty reports per year, with about 10% of them being valid and maybe another order of magnitude being high severity (I'm fuzzy on the last bit). It's probably over 100,000 per year at this point. It's not uncommon for recognizable but smaller companies to receive one or more per day. I'm aware of full-time security engineers at Facebook and Google who do almost nothing but respond to bug bounty reports. It's a lot like resumes - people who have essentially no qualifications, experience or (most importantly) a real vulnerability finding will nevertheless spam boilerplate bug reports to as many companies as they can. Take a look at the list of exclusions on a given program - you'll see that many of them explicitly call out common invalid findings that are so ridiculous it's kafkaesque. HackerOne and Bugcrowd provide a lot of technical sophistication to prime companies for success, but there is an organizational component that is very difficult. If your program is very active, it requires dedication to tune it so you're not flushing engineer-hours away responding to nonsense. This is not to say they're bad - quite the opposite, I think they're fantastic. But I generally recommend smaller companies set up a vulnerability disclosure program through a solid third party, and do so without a monetary reward until they can commit to dealing with a reasonable deluge of reports.
komali2 9y ago
Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png http://i.imgur.com/m9YWcNj.png
- derefr 9y ago
  Looks like a mobile layout that is "responsive" in higher resolutions only by adding some extra elements to surround the fixed-width central container.
- eslaught 9y ago
  The page appears to have about 70 characters on a line: >>> len("which is nothing more than a simple login page (seems to be for Google") 70 This is within the generally accepted guidelines for line length: https://www.google.com/#q=characters+per+line https://www.google.com/#q=characters+per+line The bigger issue is, I think, font size. I could imagine that on certain displays this font might look rather small.
- microcolonel 9y ago
  I prefer narrow columns for reading personally. Snap the article window to the side and scale it down for maximum enjoyment.
  - lmm 9y ago
    You can make any site have a narrow column like that - the site should give those of us who prefer wider text a way to get that too.
ncal 9y ago
"forgot"
- Buge 9y ago
  What do you think the motivation would be to intentionally "forget"? To save money? If that's the motivation why not pay the reporter $500 instead of $5000 for a small info leak. It's illogical that they would intentionally "forget" then pay such a high bounty.
idonotknowwhy 9y ago
I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...
- annnnd 9y ago
  You should also publish it. Not out of revenge, but to alert customers of the quality of the software they are using and to put additional pressure on Wickr to fix it. Project Zero does that too (as do most of other security researchers). Of course, you should give them enough time (90 days?) but after that it's publish time...
- developer2 9y ago
  That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" instead of the correct "WHERE id = :id AND deleted = false". Managing soft-deletes on a database table requires an attention to detail, with every single query ever touching that table, that many developers lack the discipline to handle. Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary. Finally, ORM abstractions often automate soft-delete in such a way that makes it exhausting for developers to validate every query. I've seen this bug over and over again at every company I've worked for. Happens so often it's impossible to keep count.
  - RandomBK 9y ago
    It's issues like this that really highlight the benefits of shuffling deleted data to a separate archive table through triggers, or leveraging temporal tables. It may not necessarily be as efficient as maintaining a flag, but it dryastically reduces the mental overhead placed on users of the database.
carvalho 9y ago
Good catch! Also studied Google's 404 pages. Seems like they have unified all but a few of them. One of them I found was vulnerable to old utf-7 injection (specified customizable page title before character encoding) and another was vulnerable to XSS. Got a bounty for the XSS one, the utf-7 one targeted too old browsers, out of scope for the program (I do wonder how many IE6 users Google sees).
- joatmon-snoo 9y ago
  It's a very low percentage, somewhere in the low single digits (if not an even lower order of magnitude). Still high enough for it to be worth paying engineers to maintain the backwards compatibility :)
netheril96 9y ago
Such a refreshing story after countless of security researchers get threatened or sued when they report security vulnerabilities to the company that should have thanked them instead.
- lucb1e 9y ago
  Haven't read one of those in years. Did one come by on HN recently?
  - frenchie14 9y ago
    This one comes to mind: https://news.ycombinator.com/item?id=14166966 https://news.ycombinator.com/item?id=14166966 > Raneri questioned my motivation and I said that I want to give the vendor ample time to resolve the issue and then I want to publish academically. He was very threatened by this and made thinly veiled threats that the FBI or other institutions would "protect him". Then he continued with statements including "we want to hire you but you must sign this NDA first." He also recommended that I only make disclosure through FINRA, SDI, NCTFA and other private fraud threat sharing organizations for financial institutions.
dmead 9y ago
thefacebook.com redirected to facebook.com/intern/vod up until last week.
swetabhsuman8 9y ago
Secrets of Super and Professional Hackers | Download free Hackers HandBook http://hackernucleus.com/secrets-of-super-and-professional-hackers/ http://hackernucleus.com/secrets-of-super-and-professional-h...
nickcw 9y ago
I found a bug in Go which turned into this CVE https://www.cvedetails.com/cve/CVE-2015-8618/ https://www.cvedetails.com/cve/CVE-2015-8618/ I applied for a bug bounty, but alas was turned down as Go isn't a Google service and it wasn't in scope for the Patch Reward Program. I did get into the hall of fame though!
roemerb 9y ago
Am I the only person who had to enlarge the page to read the article? Nice catch though.
hackjam600 9y ago
We do supply high quality medical marijuana (indoors and Outdoors) with great Sativa and Indica strong THC and CBD strains, Our products are of the grade A quality type Such as White widow Purple haze Afghan kush Durban poison And lot more Contact: hackjam600@gmail.com
deleted 9y ago
[deleted]

486 points by louis-paul 9y ago

I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)

terminalcommand 9y ago
I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).
- throw9912 9y ago
  How did you subdomain search? Was it a brute force / dict search?
  - yeukhon 9y ago
    DNS recon tool should be able to do it. If you look around for DNS online tool couple dozens of Google subdmains will be revealed. With Certificate Transparency this kind of information is not as secret as it used to be. Last year there was a vulnerability I forgot which it was quite big has something to do with a legacy software and it led me to look at what domains are using my company's cert. Qualy's made a tool out of this.
  - dsacco 9y ago
    DNS search. You can use a tool like fierce or subbrute if you're lazy.
  - schwag09 9y ago
    Shameless self-plug: You can use Fierce! A DNS reconnaissance tool - https://github.com/mschwager/fierce https://github.com/mschwager/fierce
- rprime 9y ago
  Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D. I guess it's as much mindset as it's skill.
  - Ajedi32 9y ago
    I got a bug bounty once because I reported a bug in Chrome that someone else was complaining about in the comments section of a tech blog. If instead of just complaining that commenter had taken the time to fill out a bug report they could have easily gotten the bounty instead. Sometimes it just takes a tiny bit of extra effort to go from noticing something's amiss to actually doing something to get it fixed.
    - dsacco 9y ago
      What was the security issue?
      - Ajedi32 9y ago
        CVE-2015-1274 Basically, Chrome allowed users to use the "Always open files of this type" option with executable files. So if anyone was ever foolish enough to set that option after downloading a `.exe` on Windows, any future site they visited could take over their machine just by initiating a download for a malicious executable.
    - rootsudo 9y ago
      Good idea. Imagine if you can do one bug report a month. 5K is nice income.
- microcolonel 9y ago
  riskMi is probably from CA Technologies RiskMinder™.
Buge 9y ago
A few weeks ago? It says a temporary fix was done by February 10.

mickrussom 9y ago

Nice , glad he got paid. Whats truly sad is they did try to chisel him out of his bounty if you read the timeline, he had to prod them to get his bounty. Can any of these top-ten companies that make like 200 million per day (google/alphabet, amazon, microsoft) ever do anything in good faith? One time google stiffed me initially on an RMA with a nexus phone until I stamped my feet a bit complaining that a company that makes 200M/day is stiffing me, the loyal android lover, for a $200 hunk of chinese-made plastic. (and just a short while later with things like SafetyNet I can no longer have root on an $800 pixel that isnt even waterproof). So much for dont be evil. Well, they dropped that in favor of -"do the right thing—follow the law, act honorably, and treat each other with respect" yeah, they can respectably be cheap chiseling money grubbers as long as its legal - like helping locate Falun Gong members in China. And the corporate stewardship -in the hands of the employees - they get blinded by the huge pay and instantly fail to see the bad things that go on. Anyways, glad he got paid. Amazing that a company with 57000 employees (and TONS of contractors, they dont want more employees who get benefits and stock when they can string contractors along) needs some random guy to find holes in the back door.

foota 9y ago
I find it much more likely that they just dropped the ball on paying them, rather than maliciously trying to deny them a bounty.
- mickrussom 9y ago
  Try arguing with them about an SLA violation they had with their cloud infrastructure. The game is setup where they can chisel and have these guffaw and aw garsh moments but every adword and every billable second on their cloud will get paid hell or high water.
  - dsacco 9y ago
    Did you seriously come to hijack a story about a Google bug bounty so you could complain about an irrelevant issue?

arnioxux 9y ago

In at least two other companies I've worked at we also use query params to enable debug information on live production sites. At one of those companies the only requirement was that you be on a corporate ip address but it actually still works if you're on our guest wifi.

ensiferum 9y ago

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

sushid 9y ago
Google's known for their fast triage/response time. They're also fairly generous with their bounties.
nodesocket 9y ago
Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.
- to3m 9y ago
  Most of their consumer-facing services are not, shall we say, famous for being high-touch... But presumably different people look after the security side of things.
- kristianp 9y ago
  This story from yesterday has raised some resentment about google's support: A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409 https://news.ycombinator.com/item?id=14356409
  - joatmon-snoo 9y ago
    Their customer/enterprise support is notoriously sketchy, at least from the outside (a la HN) looking in. That's not the same at all as their bug bounty program, which is generally one of the best out there.
carvalho 9y ago
Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.

Macuyiko 9y ago

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one train an agent that goes off and tries this sort of things autonomously? Might be fun to translate the HTTP intrusion domain into a deep learning architecture. Similar things are being applied on the "defensive" side of things already anyway (i.e. Iranian, Turkish, Chinese firewall systems using machine learning to identify and block new patterns), so why not apply this on the offensive side. *: Not to demean the author in any way; I understand that putting the time in to explore these things is easier said than done in hindsight.

wslh 9y ago
It is an interesting subject to research but not easy. Finding and the exploiting a bug is art and science. Augmenting fuzzying with AI is an interesting approach.
komali2 9y ago
I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.
- em3rgent0rdr 9y ago
  If the good people don't do it soon, the bad people will...
  - chrismarlow9 9y ago
    not really, there's enough bad schemes that already work to bother with fancy technical exploits

GauntletWizard 9y ago

As a Xoogler who misses the debug stack, this was some fun nostalgia. Good catch!

Artemis2 9y ago
Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.
- slashcrypto 9y ago
  Would be very interesting to know what SFFE means ;)
  - CiPHPerCoder 9y ago
    Static File Front-End?
    - puzzle 9y ago
      The hostname is static.corp and the service is static-on-bigtable, so...
  - SparkyMcUnicorn 9y ago
    I'm pretty certain it's a server name. It's a similar convention as some of their other names such as GRFE (Groups), bsfe (Blog Search Front-End). https://googlesystem.blogspot.com/2007/09/googles-server-names.html#gsc.tab=0 https://googlesystem.blogspot.com/2007/09/googles-server-nam...
- mh- 9y ago
  fairly sure it just stands for "staticfile frontend".. nothing too exciting. edit: some support for that at https://bugs.chromium.org/p/chromium/issues/detail?id=548688#c6 https://bugs.chromium.org/p/chromium/issues/detail?id=548688... /bns/pe/borg/pe/bns/static-on-bigtable/staticfile.frontend.sffe/93

hackjam600 9y ago

We do supply high quality medical marijuana (indoors and Outdoors) with great Sativa and Indica strong THC and CBD strains, Our products are of the grade A quality type Such as White widow Purple haze Afghan kush Durban poison And lot more Contact: hackjam600@gmail.com

ChuckMcM 9y ago

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped. It is too bad the person who caused it didn't file for a bug bounty like this person did, they probably would have had something to show for their efforts besides "hey look at this funny thing you can do, oh wait it doesn't do it any more."

carvalho 9y ago
On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.
- logicallee 9y ago
  It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words, was to just download a project gutenberg of the complete works of shakespeare, and find the longest string consisting of just stop words in there, then search for it as a literal quote. The longest one I found was: "From what it is to a". Let me see how long Google takes to do it now :) 2.04 seconds! Nice :) - http://i.imgur.com/IhPTpr6.png http://i.imgur.com/IhPTpr6.png that took 30+ seconds 'back in the day'.
  - sova 9y ago
    Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

louprado 9y ago

Here's a link to the Google Security Rewards Program https://www.google.com/about/appsecurity/programs-home/ https://www.google.com/about/appsecurity/programs-home/

ArlenBales 9y ago

> 10/02/2017 – Google already fixed the issue but forgot to tell me … I contacted them asking for an update > 19/02/2017 – Got a response, they implemented a short-term fix and forgot to sent my report to the VRP panel … I hope Google forgetting to follow up on bug bounties and needing to be reminded isn't a common occurrence.

jcims 9y ago
Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporters and bogged down by working the bug through the pipeline. There are systems and processes to help with all of this of course, but at the end of the day it's still a pretty tricky job to get perfect all the time.
- daddyo 9y ago
  What's the general signal to noise ratio for bug reports?
  - dsacco 9y ago
    About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports like (I kid you not): "You have the OPTIONS method allowed on your site this is really serious." The last time I looked at the numbers, Google had over 80,000 bug bounty reports per year, with about 10% of them being valid and maybe another order of magnitude being high severity (I'm fuzzy on the last bit). It's probably over 100,000 per year at this point. It's not uncommon for recognizable but smaller companies to receive one or more per day. I'm aware of full-time security engineers at Facebook and Google who do almost nothing but respond to bug bounty reports. It's a lot like resumes - people who have essentially no qualifications, experience or (most importantly) a real vulnerability finding will nevertheless spam boilerplate bug reports to as many companies as they can. Take a look at the list of exclusions on a given program - you'll see that many of them explicitly call out common invalid findings that are so ridiculous it's kafkaesque. HackerOne and Bugcrowd provide a lot of technical sophistication to prime companies for success, but there is an organizational component that is very difficult. If your program is very active, it requires dedication to tune it so you're not flushing engineer-hours away responding to nonsense. This is not to say they're bad - quite the opposite, I think they're fantastic. But I generally recommend smaller companies set up a vulnerability disclosure program through a solid third party, and do so without a monetary reward until they can commit to dealing with a reasonable deluge of reports.

komali2 9y ago

Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png http://i.imgur.com/m9YWcNj.png

derefr 9y ago
Looks like a mobile layout that is "responsive" in higher resolutions only by adding some extra elements to surround the fixed-width central container.
eslaught 9y ago
The page appears to have about 70 characters on a line: >>> len("which is nothing more than a simple login page (seems to be for Google") 70 This is within the generally accepted guidelines for line length: https://www.google.com/#q=characters+per+line https://www.google.com/#q=characters+per+line The bigger issue is, I think, font size. I could imagine that on certain displays this font might look rather small.
microcolonel 9y ago
I prefer narrow columns for reading personally. Snap the article window to the side and scale it down for maximum enjoyment.
- lmm 9y ago
  You can make any site have a narrow column like that - the site should give those of us who prefer wider text a way to get that too.

ncal 9y ago

"forgot"

Buge 9y ago
What do you think the motivation would be to intentionally "forget"? To save money? If that's the motivation why not pay the reporter $500 instead of $5000 for a small info leak. It's illogical that they would intentionally "forget" then pay such a high bounty.

idonotknowwhy 9y ago

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...

annnnd 9y ago
You should also publish it. Not out of revenge, but to alert customers of the quality of the software they are using and to put additional pressure on Wickr to fix it. Project Zero does that too (as do most of other security researchers). Of course, you should give them enough time (90 days?) but after that it's publish time...
developer2 9y ago
That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" instead of the correct "WHERE id = :id AND deleted = false". Managing soft-deletes on a database table requires an attention to detail, with every single query ever touching that table, that many developers lack the discipline to handle. Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary. Finally, ORM abstractions often automate soft-delete in such a way that makes it exhausting for developers to validate every query. I've seen this bug over and over again at every company I've worked for. Happens so often it's impossible to keep count.
- RandomBK 9y ago
  It's issues like this that really highlight the benefits of shuffling deleted data to a separate archive table through triggers, or leveraging temporal tables. It may not necessarily be as efficient as maintaining a flag, but it dryastically reduces the mental overhead placed on users of the database.

carvalho 9y ago

Good catch! Also studied Google's 404 pages. Seems like they have unified all but a few of them. One of them I found was vulnerable to old utf-7 injection (specified customizable page title before character encoding) and another was vulnerable to XSS. Got a bounty for the XSS one, the utf-7 one targeted too old browsers, out of scope for the program (I do wonder how many IE6 users Google sees).

joatmon-snoo 9y ago
It's a very low percentage, somewhere in the low single digits (if not an even lower order of magnitude). Still high enough for it to be worth paying engineers to maintain the backwards compatibility :)

netheril96 9y ago

Such a refreshing story after countless of security researchers get threatened or sued when they report security vulnerabilities to the company that should have thanked them instead.

lucb1e 9y ago
Haven't read one of those in years. Did one come by on HN recently?
- frenchie14 9y ago
  This one comes to mind: https://news.ycombinator.com/item?id=14166966 https://news.ycombinator.com/item?id=14166966 > Raneri questioned my motivation and I said that I want to give the vendor ample time to resolve the issue and then I want to publish academically. He was very threatened by this and made thinly veiled threats that the FBI or other institutions would "protect him". Then he continued with statements including "we want to hire you but you must sign this NDA first." He also recommended that I only make disclosure through FINRA, SDI, NCTFA and other private fraud threat sharing organizations for financial institutions.

dmead 9y ago

thefacebook.com redirected to facebook.com/intern/vod up until last week.

swetabhsuman8 9y ago

Secrets of Super and Professional Hackers | Download free Hackers HandBook http://hackernucleus.com/secrets-of-super-and-professional-hackers/ http://hackernucleus.com/secrets-of-super-and-professional-h...

nickcw 9y ago

I found a bug in Go which turned into this CVE https://www.cvedetails.com/cve/CVE-2015-8618/ https://www.cvedetails.com/cve/CVE-2015-8618/ I applied for a bug bounty, but alas was turned down as Go isn't a Google service and it wasn't in scope for the Patch Reward Program. I did get into the hall of fame though!

roemerb 9y ago

Am I the only person who had to enlarge the page to read the article? Nice catch though.

hackjam600 9y ago

deleted 9y ago

[deleted]