6 ms·

This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD? It’s almost as bad as Apple’s rew

by xyst 6y ago

This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD? It’s almost as bad as Apple’s reward program

deleted 6y ago
[deleted]
gruez 6y ago
>It’s almost as bad as Apple’s reward program Or most/all bug bounty programs, actually.
- julianlam 6y ago
  I hear this refrain often, and it is of course never followed up with a solution. What would you suggest, a bounty calculated via a multiple of company stock price?
  - throwaway2048 6y ago
    I think its pretty obvious the solution to "not paid enough money" is "pay more money"
    - rtx 6y ago
      How should the price be discovered.
      - kreeben 6y ago
        while (recipient_is_unhappy_with_amount) { amount *= 3.14; }
        vermilingua 6y ago
        That’s an effective way for recipients to always be “unhappy” with the bounty.
        Razengan 6y ago
        How should their happiness be ascertained? Their word?
  - ancarda 6y ago
    Offer them a job.
- TedDoesntTalk 6y ago
  If you don’t like how much they pay, maybe don’t brand yourself a “security researcher” and then try to earn the equivalent of full-time pay by finding bugs in other peoples products and blogging about it?
kyrra 6y ago
(Googler, opinions on my own) Are you sure this impacted multiple products? Reading the article the main reason he was able to exploit this for Google docs was the X-Frame-Options header. It's not clear that other products have this.
- sit_i_piz 6y ago
  It works on other Google product that has the "Submit Feedback" link on it. I just tested this out with Google Webmasters and it's an issue there as well.
  - Jabbles 6y ago
    It is unlikely they wouldn't have checked other products as part of the fix. So I'm going to ask for more proof that you "tested this out".
    - wolco2 6y ago
      The parent isn't employed by google. It seems you might be. Perhaps you should check and report back.
      - tptacek 6y ago
        You can't comment like this on HN; accusing other commenters of having secret conflicts of interest is the HN Guideline 'dang corrects most often here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=astroturfing%20author%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
        jtbayly 6y ago
        Doesn’t seem like an accusation of a conflict of interest to me. Just pointing out who has the burden to test. Since one is paid by the company, it does make sense for testing the company’s products would be his responsibility first. Whereas the previous comment was accusing the other one of lying about testing it.
swypych 6y ago
This provides very little incentive for future good actors to search for these exploits... I had no idea the reward would be so low.
tptacek 6y ago
Isn't this essentially a Clickjacking bug? Doesn't the victim have to (1) deliberately have a sensitive document open, (2) be somehow framed by an attacker's malicious IFrame, and then (3) click the "submit feedback" button to report a problem to Google? All three of those conditions are independently rare. The equivalent conditions are rare in all CJ bugs, which is a reason CJs are sort of a running joke in appsec. This bug isn't a joke (look at the target and the impact), but condition (3) is also way more unlikely than the median CJ report somewhere else. If I understand the bug correctly --- maybe I don't --- this researcher got what might perhaps be the largest bounty ever paid for a CJ bug.
- Thorrez 6y ago
  This seems a bit different than clickjacking to me. In CJ, the victim performs sensitive actions because the UI is obscured. Here the UI is unobscured, and the user performs actions that should be fairly unsensitive.
meibo 6y ago
You do need to actually "give feedback" to trigger this, which seems a bit far off for a corporate worker - might be why they didn't think this was high impact, of course it should have been higher though.
jfindley 6y ago
It's definitely a vulnerability, but to be a little more grounded in reality, to exploit this you need to somehow convince your victim to go to your website which contains the document you're trying to get access to. So for this to work you need to know the document ID, and also the person who owns this document. You then need to trick them into looking at their document on your domain, and then from there, need to persuade them somehow to press the send feedback button. I'd also note that the feedback button is a button that I suspect very very few people ever press. I certainly never have. I also don't know the IDs to any documents I might find interesting but can't read, and if I find a document via some random google search that I can't look at, I generally have no way of knowing how to contact the owner so I can try to send them phishing emails to get them to look at their document on a non-google URL. There's been a bunch of cases where google has paid out very substantial bounties, and given the extreme difficulty of both meeting the attack prereqs and then managing to pull off a very sketchy exploit process at the same time I think the sum paid is more than fair.
- treeman79 6y ago
  Way easier to convince customer to share the document.
  - foolmeonce 6y ago
    True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to see) of what happened. These exploits are often not so interesting as written and with current normal setups, but eventually become more interesting if never fixed.
    - tptacek 6y ago
      Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).
IncRnd 6y ago
The level of reward is related to the exploitability and attack vector not just the results of being exploited.
fractionalhare 6y ago
> This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD? They could have also offered nothing, which was common up until a decade ago or so. Moreover there isn't a market for security bugs like this, so it's not like Google is underpaying relative to some independent valuation. The only reason to pay more is out of some ethos that the reporter "deserves" more, but that's not how business works. The value Google obtains by finding any given vulnerability approaches 0. This is why, among other reasons, good product security teams spend most of their time doing things other than searching for vulnerabilities in existing code.

by xyst 6y ago

This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD? It’s almost as bad as Apple’s reward program

deleted 6y ago

[deleted]

gruez 6y ago

>It’s almost as bad as Apple’s reward program Or most/all bug bounty programs, actually.

julianlam 6y ago
I hear this refrain often, and it is of course never followed up with a solution. What would you suggest, a bounty calculated via a multiple of company stock price?
- throwaway2048 6y ago
  I think its pretty obvious the solution to "not paid enough money" is "pay more money"
  - rtx 6y ago
    How should the price be discovered.
    - kreeben 6y ago
      while (recipient_is_unhappy_with_amount) { amount *= 3.14; }
      - vermilingua 6y ago
        That’s an effective way for recipients to always be “unhappy” with the bounty.
      - Razengan 6y ago
        How should their happiness be ascertained? Their word?
- ancarda 6y ago
  Offer them a job.
TedDoesntTalk 6y ago
If you don’t like how much they pay, maybe don’t brand yourself a “security researcher” and then try to earn the equivalent of full-time pay by finding bugs in other peoples products and blogging about it?

kyrra 6y ago

(Googler, opinions on my own) Are you sure this impacted multiple products? Reading the article the main reason he was able to exploit this for Google docs was the X-Frame-Options header. It's not clear that other products have this.

sit_i_piz 6y ago
It works on other Google product that has the "Submit Feedback" link on it. I just tested this out with Google Webmasters and it's an issue there as well.
- Jabbles 6y ago
  It is unlikely they wouldn't have checked other products as part of the fix. So I'm going to ask for more proof that you "tested this out".
  - wolco2 6y ago
    The parent isn't employed by google. It seems you might be. Perhaps you should check and report back.
    - tptacek 6y ago
      You can't comment like this on HN; accusing other commenters of having secret conflicts of interest is the HN Guideline 'dang corrects most often here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=astroturfing%20author%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
      - jtbayly 6y ago
        Doesn’t seem like an accusation of a conflict of interest to me. Just pointing out who has the burden to test. Since one is paid by the company, it does make sense for testing the company’s products would be his responsibility first. Whereas the previous comment was accusing the other one of lying about testing it.

swypych 6y ago

This provides very little incentive for future good actors to search for these exploits... I had no idea the reward would be so low.

tptacek 6y ago

Isn't this essentially a Clickjacking bug? Doesn't the victim have to (1) deliberately have a sensitive document open, (2) be somehow framed by an attacker's malicious IFrame, and then (3) click the "submit feedback" button to report a problem to Google? All three of those conditions are independently rare. The equivalent conditions are rare in all CJ bugs, which is a reason CJs are sort of a running joke in appsec. This bug isn't a joke (look at the target and the impact), but condition (3) is also way more unlikely than the median CJ report somewhere else. If I understand the bug correctly --- maybe I don't --- this researcher got what might perhaps be the largest bounty ever paid for a CJ bug.

Thorrez 6y ago
This seems a bit different than clickjacking to me. In CJ, the victim performs sensitive actions because the UI is obscured. Here the UI is unobscured, and the user performs actions that should be fairly unsensitive.

meibo 6y ago

You do need to actually "give feedback" to trigger this, which seems a bit far off for a corporate worker - might be why they didn't think this was high impact, of course it should have been higher though.

jfindley 6y ago

It's definitely a vulnerability, but to be a little more grounded in reality, to exploit this you need to somehow convince your victim to go to your website which contains the document you're trying to get access to. So for this to work you need to know the document ID, and also the person who owns this document. You then need to trick them into looking at their document on your domain, and then from there, need to persuade them somehow to press the send feedback button. I'd also note that the feedback button is a button that I suspect very very few people ever press. I certainly never have. I also don't know the IDs to any documents I might find interesting but can't read, and if I find a document via some random google search that I can't look at, I generally have no way of knowing how to contact the owner so I can try to send them phishing emails to get them to look at their document on a non-google URL. There's been a bunch of cases where google has paid out very substantial bounties, and given the extreme difficulty of both meeting the attack prereqs and then managing to pull off a very sketchy exploit process at the same time I think the sum paid is more than fair.

treeman79 6y ago
Way easier to convince customer to share the document.
- foolmeonce 6y ago
  True, but I think a business account can disable the simple "share" to outside accounts and there would be more logs (of the type the business would be able to see) of what happened. These exploits are often not so interesting as written and with current normal setups, but eventually become more interesting if never fixed.
  - tptacek 6y ago
    Can you lay out a realistic exploitation scenario for this bug? It seems to have several predicates: 1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits). 2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs). 3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage. What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).

IncRnd 6y ago

The level of reward is related to the exploitability and attack vector not just the results of being exploited.

fractionalhare 6y ago

> This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD? They could have also offered nothing, which was common up until a decade ago or so. Moreover there isn't a market for security bugs like this, so it's not like Google is underpaying relative to some independent valuation. The only reason to pay more is out of some ethos that the reporter "deserves" more, but that's not how business works. The value Google obtains by finding any given vulnerability approaches 0. This is why, among other reasons, good product security teams spend most of their time doing things other than searching for vulnerabilities in existing code.