3 ms·
One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat;
by saalweachter 8y ago
One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; hopefully, while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he hopefully could not authenticate to do anything any serious damage or access any sensitive information.
- puzzle 8y agoI agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: https://packetstormsecurity.com/files/129406/Google-App-Engine-Java-VM-Sandbox-Escape.html https://packetstormsecurity.com/files/129406/Google-App-Engi...