7 ms·
> One line of reply was that this is not an exploit, but a bug Denial of service is absolutely a security problem, so I don't think whoever gave this advice is
by cnity 2y ago
> One line of reply was that this is not an exploit, but a bug
Denial of service is absolutely a security problem, so I don't think whoever gave this advice is correct. Sounds like a frustrating experience.
- vdfs 2y agoNot if you DoS your own instance only
- olalonde 2y agoBut who gives DDL/SQL access to untrusted users? It seems to be a rather unusual scenario.
- andyferris 2y agoIt is AWS redshift - a Postgres compatible SQL service. You interact with it via SQL.
- orf 2y agoYes, but generally you don’t give SQL access to the internet or completely unauthenticated users. Any user could likely cause issues for Redshift by running completely nuts queries that exhaust all the servers resources. Is “shit SQL” a bounty worthy issue
- andyferris 2y agoI see, I misunderstood. Yes, having the power to crash your own instance might not be a security issue per se.
- deleted 2y ago[deleted]
- Max-Ganz-II 2y agoGood point. The problem I know of is a bit different, in that it is a direct and immediate server crash. It's not a denial of service by making the cluster slow. It's run-query, crash-server. You are right of course that any normal user can issue crazy queries which hog resources, and hammer performance.
- orf 2y agoI would just reach out to AWS directly: why go through hacker one? They have a direct email and are responsive. If the issue meets their criteria then you get a payout.
- Max-Ganz-II 2y agoI Googled for AWS bug bounty programs. I found nothing. Do you have a URL of any kind, for more information about this, including contacts?
- TheDong 2y agohttps://aws.amazon.com/security/vulnerability-reporting/ https://aws.amazon.com/security/vulnerability-reporting/ I wouldn’t expect a bounty for something like this, but I believe the above is the correct avenue for reporting it.
- orf 2y agoaws-security@amazon.com - it’s very clearly the first result when you search “AWS security report”.
- arbll 2y agoA scenario where as an attacker: - You have raw access to the DB - You don't have enough privileges to get something more valuable than crashing the DB - You don't care to get noticed/caught Does sound pretty unlikely
- Max-Ganz-II 2y agoJust as an aside, I don't think your query is directly logged. I've not actually checked, so I don't know, but knowing how logging works on RS, I think the cluster crashing will mean your killer query is not logged. Your session will have been logged by the time the cluster crashes. OTOH, maybe you were logged in for some time first, or there's connection pooling, or you slipped the query into an existing connection's query stream, and so on. Actually, thinking about it, I think you could reduce the problem to a single query, rather than two, which would help cover tracks.
- olalonde 2y agoI assume the exploit only takes down your own instance, not the whole AWS redshift service. If it's the latter, it should obviously be rewarded with big $.
- Max-Ganz-II 2y agoYes and yes :-)
- gcr 2y ago“Yes” as in “yes, my exploit takes down all of redshift”? Or “yes” as in “yes it only takes down my instance” ?
- Max-Ganz-II 2y ago> I assume the exploit only takes down your own instance, not the whole AWS redshift service. First yes for this. > If it's the latter, it should obviously be rewarded with big $. Second yes for this. :-)
- deleted 2y ago[deleted]
- bflesch 2y agoI see you have never reported a DOS on H1. High-profile millionaire engineers will go out of their way to argue with you that DOS of their TOP100 website is in fact not a security problem. These people don't even know about CIA triad and are gatekeeping four-figure bounty payouts while earning five figures or more every month. I'm extremely salty about this.
- llm_trw 2y agoOne of these days I'll move to Cuba and run all the long list of exploits I've been told aren't exploits by overpaid idiots. https://www.youtube.com/watch?v=pQMuSotWCEs https://www.youtube.com/watch?v=pQMuSotWCEs
- bawolff 2y ago> Denial of service is absolutely a security problem "Security problem" isn't a binary. DoS can be an issue, but often it is acceptable risk. Especially if your DoS is minor. E.g. i can crash the server by sending 50 Gbps of data to it, is not usually a security issue in context. In the parent post they implied they needed privleged access to exploit. That probably makes it not a security issue as it can only be triggered by a trusted user. Additionally most bug bounty programs disallow DoS, due to some combination of reports being low value, and testers being idiots, so it might be out of scope right from the bat.