15 ms·

$36k Google App Engine RCE

602 points by louis-paul 8y ago

Artemis2 8y ago
This report showcases a ton of tenacity and thoroughness. Not his first time as well: https://sites.google.com/site/testsitehacking/10k-host-header https://sites.google.com/site/testsitehacking/10k-host-heade.... Very impressive. “Please stop exploring this further, as it seems you could easily break something” has got to be the best reply one can receive to a bug bounty report.
- ben_jones 8y ago
  That's what struck me. From the well told story I feel like there were several points of "welp probably can't go further then this better move on to something else" but he kept going and going and sure enough he got somewhere. Hope to see more work published by him over the next few years!
- exikyut 8y ago
  I wish all companies had the internal connectedness to be able to react to realtime updates and coordinate the exact split second to hold up the friendly stop sign! There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions). So this the best thing you can hear from that standpoint as well. Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos. That sounds like a "fun" job... --- I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in. There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication. - https://arstechnica.com/information-technology/2018/04/panera-accused-security-researcher-of-scam-when-he-reported-a-major-flaw/ https://arstechnica.com/information-technology/2018/04/paner... - https://news.ycombinator.com/item?id=16739753 https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583 https://news.ycombinator.com/item?id=16737583
guessmyname 8y ago
> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the industry, it must have felt very good to get that mail. Congratulations, and keep the good work.
- Blackstone4 8y ago
  Plus I imagine putting that on your resume/CV will be a big help. An amazing talking point for interviews. Projects a strong sense of integrity. It would help them get a remote job or visa.
- foepys 8y ago
  That's pretty advanced stuff for an 18y/o, even for most senior developers. No doubt Google will try to recruit him after he finishes university.
  - jcims 8y ago
    (Edit: I appear to be a broken record) I spent a spell on a bug bounty program. There are some beasts out there in the 16-20yo age range, it's pretty crazy.
    - toomanybeersies 8y ago
      Their minds probably haven't been numbed by years of fixing shoddy code and writing CRUD apps yet.
  - madeofpalk 8y ago
    What I appreciated most about it (or maybe this is just his writeup skills), but how not advanced each of the things were. It was just mostly him Googling things and making random guesses at the rabbit hole until he found something. The skill, I guess, comes in piecing it all together and consistently making good guesses.
dz0ny 8y ago
Mention of #savetheexpanse in article is nice dedication of sorts :)
funkjunky 8y ago
I used to work support for GAE and recognize all of this. This is really impressive, congrats on the great work and huge bounty. Keep it up!
- haldean 8y ago
  Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
  - puzzle 8y ago
    I didn't work on GAE, but I know a fair amount about how it ran and, as I read, too, I could think of quite a few things I would have done, had I been a malicious actor. Denial of service is the first to come to mind. I'm sure a real security person could do a lot more.
  - TomV1971 8y ago
    I’ve been on the receiving end where hobbyists were trying (and eventually succeeded) to hack our DRM scheme. It was really fun to read the forums and see how, day by day, they managed to get closer. Since it wasn’t really crucial IP to begin with, we were rooting for the little guys to see how close they would get, secure in the knowledge that our algorithm was solid. :-) The final exploit that granted them access was due to a supplier who replaced an earlier validated random generator with something not quite as random, which enabled replay attacks.
  - eyeareque 8y ago
    XXXX == what types of things? I’m curious why there was no auth required for his calls.
    - londons_explore 8y ago
      * Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on them, and all access control configs. You can take your sweet time to audit the 10's of millions of lines of code to find vulnerabilities and get to attack as an authenticated (albeit low privilege) user. A lot of stuff is open to all authenticated internal users. * For example, you could take down any google service by quitting all the application servers at the same time by calling the right debugging RPC. You'd be caught obviously tho.
gigatexal 8y ago
I sure as hell wasnt this competent at 18 let alone now. Kudos to him.
sailfast 8y ago
This is not an inconsequential amount of cash, for sure. Especially at 18! Congrats! And a great write-up to boot. Just awesome. All that said an honest question: why would a company like Google not pay insane amounts of money for these kinds of bug finds? What would they pay their own people to find them? Seems like RCE on App Engine should be worth 100K+ and then some on top for giggles just because they can. Obviously having a standard policy makes sense so that your community understands what to expect but as Google, what's your operational impact if you triple / quadruple vs. market value of the exploits?
- dgacmu 8y ago
  They pay their own people a salary - having a dependable living (at a very, very nice rate) is a pretty awesome thing. Sometimes there are bonuses involved, but they're usually not on the order of magnitude of external bug bounties. My understanding of the pricing is that it's designed to make ethical behavior profitable enough that fewer people are tempted to sell the exploits on the black market, not necessarily to out-compete the black market entirely. I think this person's find is a great example - it's a resume-booster, a great experience, a very nice cash infusion, and helps, instead of hindering, their job prospects with future employers.
pcardoso 8y ago
Cute base amount, $31337... :)
- dsnuh 8y ago
  Took me a minute to realize why the strange payout number.
- gitgud 8y ago
  For anyone not informed like me... https://www.urbandictionary.com/define.php?term=31337 https://www.urbandictionary.com/define.php?term=31337
throwaway66666 8y ago
Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google. How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify". Put yourselves and your work/findings out there people!
- puzzle 8y ago
  Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.
  - saalweachter 8y ago
    One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; hopefully, while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he hopefully could not authenticate to do anything any serious damage or access any sensitive information.
    - puzzle 8y ago
      I agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: https://packetstormsecurity.com/files/129406/Google-App-Engine-Java-VM-Sandbox-Escape.html https://packetstormsecurity.com/files/129406/Google-App-Engi...
gnl 8y ago
Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.
- jcims 8y ago
  As someone who worked in a bug bounty program, the skill and age of this individual isn't what sets them apart. It's the write up.
  - sethherr 8y ago
    As someone who has been on the other end of receiving incoherent and inaccurate bug bounty reports, this! To find the bug is impressive. To write about it so well is truly exceptional.
    - bitexploder 8y ago
      I always "joke" to people we are professional writers. Actually professional infosec consultants, but our life blood is coherently documenting everything we find and making pretty executive summaries. It is hard to overstate how much I have seen the reporting differentiate infosec consulting firms over then years. Which is not to say we don't value the hard technical skills, but writing is really, really important too.
      - jcims 8y ago
        The best part is when your kids complain about having to write a 1500 word essay and you show them what's up.
- tptacek 8y ago
  Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it? What price do they assign to it? For instance: if you think you can sell it for $50k, who's paying that, and for what purpose? Finally, what are the steps you take to safely complete the transaction? (This is intended only to clarify arguments about the market for vulnerabilities like these, and not to suggest that the finding and the writeup aren't excellent, which they sure appear to be.)
neosavvy 8y ago
Google should send this guy a request to be hired. Clearly he's as good as their internal engineering team and his write up was great.
- hinkley 8y ago
  As has been discussed to death here, Google’s hiring process doesn’t care what you did last week, or last year (eg Max Howell). This would not improve his odds.
  - nyxxie 8y ago
    Anecdotal, but I got my job at Google through participating in their bug bounty program. The first set of interviews you have that ask general CS questions might not care what you did last week or last year, but when you talk with the team who wants to hire you they certainly do care.
    - GFischer 8y ago
      That's the thing, he might get rejected from the screening questions...
londons_explore 8y ago
He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...
- tejasmanohar 8y ago
  Source? Is there really no authentication around it?
  - sulam 8y ago
    He had read access to G3. Exfiltrating it all would have been hard, but he could have gotten a chunk of it for sure.
  - joatmon-snoo 8y ago
    You want the part of the write-up where it mentions he gets FILE_GOOGLE3_ACCESS. I'm not sure what access that actually gives, but that email thread showing people getting +cc'd on the ticket speaks pretty obviously to the severity and magnitude of the problem. (Am Googler.)
- memory_grep 8y ago
  Yeah, I wonder if the google3 access may have been the real reason they asked him to stop poking around.
- TeMPOraL 8y ago
  What is "Google3"? Incidentally, Google isn't helpful in finding out - all I get as results is garbage and some node.js package placeholders.
  - joatmon-snoo 8y ago
    It's the Google monorepo: https://cacm.acm.org/magazines/2016/7/204032-why-google-stores-billions-of-lines-of-code-in-a-single-repository/pdf https://cacm.acm.org/magazines/2016/7/204032-why-google-stor...
- 8y ago
Karishma1234 8y ago
Any idea how such rewards get taxed ?
- q3k 8y ago
  On the receiving end if you're non-US-based? You're supposed to figure it out yourself (ie. pay local applicable income tax), they just want a W8BEN. Source: got a Google VRP reward.
  - Karishma1234 8y ago
    so US government does not take an cut ?
    - dannyw 8y ago
      The US govt doesn't take a cut if you pay an overseas contractor X for Y.
- madeofpalk 8y ago
  I would expect that in most jurisdictions (well, if they're like Australia) that income is income, and it just goes onto your taxable income.
  - dannyw 8y ago
    In Australia, only if you are engaged in a business activity. This means that if you come across some small bug and get a bounty of $1000, then it's probably not even taxable income.
    - madeofpalk 8y ago
      Of course it's taxable. Unless its a gift which, a payout from a company for completing work which the ATO will say is not a gift, then it's income and it'll get added onto your taxable income and tax appropriately. For something like a bug bounty payout, you'll have to declare it yourself as other income.
ggg9990 8y ago
It would be no skin of Google’s back to multiply these bug bounties by 10, and they should.
- jhall1468 8y ago
  But that's would be counter to their interests. They want to hire this kid when he graduates. If they paid 10x their current bounty rates they'd have paid over $400,000 to him in the last couple of years of his free time. That's a great way to never be able to hire him.
  - facetube 8y ago
    I suspect the bug bounties are much more about deterring the sale of exploits to bad actors than about recruiting employees.
    - jhall1468 8y ago
      It's both. You could do the former by throwing huge sums of money at the problem.
      - deleted 8y ago
        [deleted]
      - facetube 8y ago
        What's your definition of huge?
  - Reedx 8y ago
    > That's a great way to never be able to hire him. Why's that? It's not retirement money. 400k (salary+stock) is one year of compensation for some Google engineers.
    - jhall1468 8y ago
      Dude has cashed out a $10k and $30k bug bounty at the age of 18. Either he's lucky or he's very good. If he's the latter that $400k turns into an annual bounty. And very, very few Google engineers make that kind of money.
mabbo 8y ago
"When issuing the reward, we'll take into account what you could have achieved with this access" makes me laugh. How scary must that be for the Google team? You know you've messed up so badly and the person who is investigating is doing so blindly with no knowledge or accountability if he breaks something. Yikes. Kudos to everyone for doing the right things. And great bounty- the average yearly income in Uruguay is $2000-$3000 USD per household. This guy just got awarded more than ten times that.
- gnl 8y ago
  Are you sure that's accurate? According to this [1] it's about 10 000 USD per capita. [1] https://www.ceicdata.com/en/indicator/uruguay/annual-household-income-per-capita https://www.ceicdata.com/en/indicator/uruguay/annual-househo...
  - mabbo 8y ago
    Ah you may be right- I did a cursory Google search only. Still, multiple years of income in one bug isn't bad at all.
  - deleted 8y ago
    [deleted]
degenerate 8y ago
Looks like the "Hall of Fame" link in the bounty confirmation email is broken / not rendering: https://www.google.com/about/appsecurity/hall-of-fame/ https://www.google.com/about/appsecurity/hall-of-fame/
- splonk 8y ago
  It appears to be hosted at https://bughunter.withgoogle.com/rank/hof https://bughunter.withgoogle.com/rank/hof (From following this error: "Refused to display 'https://bughunter.withgoogle.com/0x0A?embed=1' https://bughunter.withgoogle.com/0x0A?embed=1' in a frame because it set 'X-Frame-Options' to 'deny'.")
doesnt_know 8y ago
I have almost 15 years on the OP and aren't even half as talented. It looks like they've received almost $60k from Google across five bug bounties, very impressive.
jotadambalakiri 8y ago
I don't think it's so easy to sell a vulnerability on the black market. If you send the code first they will have no incentive to send the money, if you get the money, you might not send the code.
- dannyw 8y ago
  You don't have to send the quote, you can demonstrate it, e.g. on a dummy shared account where you bypass all quotas.
russum 8y ago
Huh, so you can run binaries in GAE by downloading a statically linked app to /tmp, chmod'ing & executing it? And there would be no limits on how it's run? That's crazy & pretty cool!
- thesandlord 8y ago
  GCP Developer Advocate here: The Java 8, Node.js (just announced at I/O) and GCF environments use a new sandbox that should allow you to run any binary. Of course there are limits, and you have to pay to run things on App Engine past the free tier, but most things should run just fine. The older GAE sandboxes didn't let you do this (and had a ton of other limitations as well)

602 points by louis-paul 8y ago

This report showcases a ton of tenacity and thoroughness. Not his first time as well: https://sites.google.com/site/testsitehacking/10k-host-header https://sites.google.com/site/testsitehacking/10k-host-heade.... Very impressive. “Please stop exploring this further, as it seems you could easily break something” has got to be the best reply one can receive to a bug bounty report.

ben_jones 8y ago
That's what struck me. From the well told story I feel like there were several points of "welp probably can't go further then this better move on to something else" but he kept going and going and sure enough he got somewhere. Hope to see more work published by him over the next few years!
exikyut 8y ago
I wish all companies had the internal connectedness to be able to react to realtime updates and coordinate the exact split second to hold up the friendly stop sign! There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions). So this the best thing you can hear from that standpoint as well. Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos. That sounds like a "fun" job... --- I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in. There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication. - https://arstechnica.com/information-technology/2018/04/panera-accused-security-researcher-of-scam-when-he-reported-a-major-flaw/ https://arstechnica.com/information-technology/2018/04/paner... - https://news.ycombinator.com/item?id=16739753 https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583 https://news.ycombinator.com/item?id=16737583

guessmyname 8y ago

> I am 18-year-old student at the University of the Republic [Uruguay] interested in computer security Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the industry, it must have felt very good to get that mail. Congratulations, and keep the good work.

Blackstone4 8y ago
Plus I imagine putting that on your resume/CV will be a big help. An amazing talking point for interviews. Projects a strong sense of integrity. It would help them get a remote job or visa.
foepys 8y ago
That's pretty advanced stuff for an 18y/o, even for most senior developers. No doubt Google will try to recruit him after he finishes university.
- jcims 8y ago
  (Edit: I appear to be a broken record) I spent a spell on a bug bounty program. There are some beasts out there in the 16-20yo age range, it's pretty crazy.
  - toomanybeersies 8y ago
    Their minds probably haven't been numbed by years of fixing shoddy code and writing CRUD apps yet.
- madeofpalk 8y ago
  What I appreciated most about it (or maybe this is just his writeup skills), but how not advanced each of the things were. It was just mostly him Googling things and making random guesses at the rabbit hole until he found something. The skill, I guess, comes in piecing it all together and consistently making good guesses.

dz0ny 8y ago

Mention of #savetheexpanse in article is nice dedication of sorts :)

funkjunky 8y ago

I used to work support for GAE and recognize all of this. This is really impressive, congrats on the great work and huge bounty. Keep it up!

haldean 8y ago
Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
- puzzle 8y ago
  I didn't work on GAE, but I know a fair amount about how it ran and, as I read, too, I could think of quite a few things I would have done, had I been a malicious actor. Denial of service is the first to come to mind. I'm sure a real security person could do a lot more.
- TomV1971 8y ago
  I’ve been on the receiving end where hobbyists were trying (and eventually succeeded) to hack our DRM scheme. It was really fun to read the forums and see how, day by day, they managed to get closer. Since it wasn’t really crucial IP to begin with, we were rooting for the little guys to see how close they would get, secure in the knowledge that our algorithm was solid. :-) The final exploit that granted them access was due to a supplier who replaced an earlier validated random generator with something not quite as random, which enabled replay attacks.
- eyeareque 8y ago
  XXXX == what types of things? I’m curious why there was no auth required for his calls.
  - londons_explore 8y ago
    * Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo) * Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc. * With the above two things, you know the location of services and every RPC endpoint on them, and all access control configs. You can take your sweet time to audit the 10's of millions of lines of code to find vulnerabilities and get to attack as an authenticated (albeit low privilege) user. A lot of stuff is open to all authenticated internal users. * For example, you could take down any google service by quitting all the application servers at the same time by calling the right debugging RPC. You'd be caught obviously tho.

gigatexal 8y ago

I sure as hell wasnt this competent at 18 let alone now. Kudos to him.

sailfast 8y ago

This is not an inconsequential amount of cash, for sure. Especially at 18! Congrats! And a great write-up to boot. Just awesome. All that said an honest question: why would a company like Google not pay insane amounts of money for these kinds of bug finds? What would they pay their own people to find them? Seems like RCE on App Engine should be worth 100K+ and then some on top for giggles just because they can. Obviously having a standard policy makes sense so that your community understands what to expect but as Google, what's your operational impact if you triple / quadruple vs. market value of the exploits?

dgacmu 8y ago
They pay their own people a salary - having a dependable living (at a very, very nice rate) is a pretty awesome thing. Sometimes there are bonuses involved, but they're usually not on the order of magnitude of external bug bounties. My understanding of the pricing is that it's designed to make ethical behavior profitable enough that fewer people are tempted to sell the exploits on the black market, not necessarily to out-compete the black market entirely. I think this person's find is a great example - it's a resume-booster, a great experience, a very nice cash infusion, and helps, instead of hindering, their job prospects with future employers.

pcardoso 8y ago

Cute base amount, $31337... :)

dsnuh 8y ago
Took me a minute to realize why the strange payout number.
gitgud 8y ago
For anyone not informed like me... https://www.urbandictionary.com/define.php?term=31337 https://www.urbandictionary.com/define.php?term=31337

throwaway66666 8y ago

Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google. How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify". Put yourselves and your work/findings out there people!

puzzle 8y ago
Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.
- saalweachter 8y ago
  One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; hopefully, while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he hopefully could not authenticate to do anything any serious damage or access any sensitive information.
  - puzzle 8y ago
    I agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: https://packetstormsecurity.com/files/129406/Google-App-Engine-Java-VM-Sandbox-Escape.html https://packetstormsecurity.com/files/129406/Google-App-Engi...

gnl 8y ago

Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.

jcims 8y ago
As someone who worked in a bug bounty program, the skill and age of this individual isn't what sets them apart. It's the write up.
- sethherr 8y ago
  As someone who has been on the other end of receiving incoherent and inaccurate bug bounty reports, this! To find the bug is impressive. To write about it so well is truly exceptional.
  - bitexploder 8y ago
    I always "joke" to people we are professional writers. Actually professional infosec consultants, but our life blood is coherently documenting everything we find and making pretty executive summaries. It is hard to overstate how much I have seen the reporting differentiate infosec consulting firms over then years. Which is not to say we don't value the hard technical skills, but writing is really, really important too.
    - jcims 8y ago
      The best part is when your kids complain about having to write a 1500 word essay and you show them what's up.
tptacek 8y ago
Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it? What price do they assign to it? For instance: if you think you can sell it for $50k, who's paying that, and for what purpose? Finally, what are the steps you take to safely complete the transaction? (This is intended only to clarify arguments about the market for vulnerabilities like these, and not to suggest that the finding and the writeup aren't excellent, which they sure appear to be.)

neosavvy 8y ago

Google should send this guy a request to be hired. Clearly he's as good as their internal engineering team and his write up was great.

hinkley 8y ago
As has been discussed to death here, Google’s hiring process doesn’t care what you did last week, or last year (eg Max Howell). This would not improve his odds.
- nyxxie 8y ago
  Anecdotal, but I got my job at Google through participating in their bug bounty program. The first set of interviews you have that ask general CS questions might not care what you did last week or last year, but when you talk with the team who wants to hire you they certainly do care.
  - GFischer 8y ago
    That's the thing, he might get rejected from the screening questions...

londons_explore 8y ago

He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...

tejasmanohar 8y ago
Source? Is there really no authentication around it?
- sulam 8y ago
  He had read access to G3. Exfiltrating it all would have been hard, but he could have gotten a chunk of it for sure.
- joatmon-snoo 8y ago
  You want the part of the write-up where it mentions he gets FILE_GOOGLE3_ACCESS. I'm not sure what access that actually gives, but that email thread showing people getting +cc'd on the ticket speaks pretty obviously to the severity and magnitude of the problem. (Am Googler.)
memory_grep 8y ago
Yeah, I wonder if the google3 access may have been the real reason they asked him to stop poking around.
TeMPOraL 8y ago
What is "Google3"? Incidentally, Google isn't helpful in finding out - all I get as results is garbage and some node.js package placeholders.
- joatmon-snoo 8y ago
  It's the Google monorepo: https://cacm.acm.org/magazines/2016/7/204032-why-google-stores-billions-of-lines-of-code-in-a-single-repository/pdf https://cacm.acm.org/magazines/2016/7/204032-why-google-stor...
8y ago

Karishma1234 8y ago

Any idea how such rewards get taxed ?

q3k 8y ago
On the receiving end if you're non-US-based? You're supposed to figure it out yourself (ie. pay local applicable income tax), they just want a W8BEN. Source: got a Google VRP reward.
- Karishma1234 8y ago
  so US government does not take an cut ?
  - dannyw 8y ago
    The US govt doesn't take a cut if you pay an overseas contractor X for Y.
madeofpalk 8y ago
I would expect that in most jurisdictions (well, if they're like Australia) that income is income, and it just goes onto your taxable income.
- dannyw 8y ago
  In Australia, only if you are engaged in a business activity. This means that if you come across some small bug and get a bounty of $1000, then it's probably not even taxable income.
  - madeofpalk 8y ago
    Of course it's taxable. Unless its a gift which, a payout from a company for completing work which the ATO will say is not a gift, then it's income and it'll get added onto your taxable income and tax appropriately. For something like a bug bounty payout, you'll have to declare it yourself as other income.

ggg9990 8y ago

It would be no skin of Google’s back to multiply these bug bounties by 10, and they should.

jhall1468 8y ago
But that's would be counter to their interests. They want to hire this kid when he graduates. If they paid 10x their current bounty rates they'd have paid over $400,000 to him in the last couple of years of his free time. That's a great way to never be able to hire him.
- facetube 8y ago
  I suspect the bug bounties are much more about deterring the sale of exploits to bad actors than about recruiting employees.
  - jhall1468 8y ago
    It's both. You could do the former by throwing huge sums of money at the problem.
    - deleted 8y ago
      [deleted]
    - facetube 8y ago
      What's your definition of huge?
- Reedx 8y ago
  > That's a great way to never be able to hire him. Why's that? It's not retirement money. 400k (salary+stock) is one year of compensation for some Google engineers.
  - jhall1468 8y ago
    Dude has cashed out a $10k and $30k bug bounty at the age of 18. Either he's lucky or he's very good. If he's the latter that $400k turns into an annual bounty. And very, very few Google engineers make that kind of money.

mabbo 8y ago

"When issuing the reward, we'll take into account what you could have achieved with this access" makes me laugh. How scary must that be for the Google team? You know you've messed up so badly and the person who is investigating is doing so blindly with no knowledge or accountability if he breaks something. Yikes. Kudos to everyone for doing the right things. And great bounty- the average yearly income in Uruguay is $2000-$3000 USD per household. This guy just got awarded more than ten times that.

gnl 8y ago
Are you sure that's accurate? According to this [1] it's about 10 000 USD per capita. [1] https://www.ceicdata.com/en/indicator/uruguay/annual-household-income-per-capita https://www.ceicdata.com/en/indicator/uruguay/annual-househo...
- mabbo 8y ago
  Ah you may be right- I did a cursory Google search only. Still, multiple years of income in one bug isn't bad at all.
- deleted 8y ago
  [deleted]

degenerate 8y ago

Looks like the "Hall of Fame" link in the bounty confirmation email is broken / not rendering: https://www.google.com/about/appsecurity/hall-of-fame/ https://www.google.com/about/appsecurity/hall-of-fame/

splonk 8y ago
It appears to be hosted at https://bughunter.withgoogle.com/rank/hof https://bughunter.withgoogle.com/rank/hof (From following this error: "Refused to display 'https://bughunter.withgoogle.com/0x0A?embed=1' https://bughunter.withgoogle.com/0x0A?embed=1' in a frame because it set 'X-Frame-Options' to 'deny'.")

doesnt_know 8y ago

I have almost 15 years on the OP and aren't even half as talented. It looks like they've received almost $60k from Google across five bug bounties, very impressive.

jotadambalakiri 8y ago

I don't think it's so easy to sell a vulnerability on the black market. If you send the code first they will have no incentive to send the money, if you get the money, you might not send the code.

dannyw 8y ago
You don't have to send the quote, you can demonstrate it, e.g. on a dummy shared account where you bypass all quotas.

russum 8y ago

Huh, so you can run binaries in GAE by downloading a statically linked app to /tmp, chmod'ing & executing it? And there would be no limits on how it's run? That's crazy & pretty cool!

thesandlord 8y ago
GCP Developer Advocate here: The Java 8, Node.js (just announced at I/O) and GCF environments use a new sandbox that should allow you to run any binary. Of course there are limits, and you have to pay to run things on App Engine past the free tier, but most things should run just fine. The older GAE sandboxes didn't let you do this (and had a ton of other limitations as well)