12 ms·
Leaking the email of any YouTube user for $10k
- zoklet-enjoyer 2y agoPixel Recorder is an "old forgotten product"? I have used it at least once a week for years. I used it a bunch yesterday. Very good app. I hope Google doesn't kill it.
- michpoch 2y agoAm I very naive expecting the payout to be significantly higher?
- ec109685 2y agoInteresting that the bounty amount went down due to how obscure the attack vector was.
- SXX 2y agoUnfortunately high payouts is just not how cyber security industry work. Instead of high payouts you get vanity and higher chance to get well-paid job.
- immibis 2y agoYou can get a high payout if you're also willing to risk your life. Companies are relying on researchers doing the ethical thing instead of the profitable thing.
- cesarb 2y agoTo me, that payout felt quite high; it's bigger than the average monthly salary for a senior IT professional where I live. To put it another way, that bounty alone would be like being paid for several months of full-time employment.
- deleted 2y ago[deleted]
- tgsovlerkhgsel 2y agoYes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd actually consider that a surprisingly high amount, and I would expect that many companies wouldn't consider this class of bug a bounty-worthy issue at all - "thanks for the report", maybe fix it maybe not, but no bounty.
- robin_reala 2y agoI’d misunderstood the title to refer to $10k of GPU compute or something like that. Unfortunately I suspect there’ll be tens or hundreds of occurrences of this bug given that they just picked one old Google product and immediately found a hole.
- SXX 2y ago> given that they just picked one old Google product and immediately found a hole. This is just not how it works. Most likely author spent weeks or months digging into different products until he found something worthville.
- saretup 2y agoI misunderstood it to mean they are selling any YouTuber’s email address for $10k
- nullderef 2y agoBreaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.
- robin_reala 2y agoUnfortunately with the number of users Google has, any deprecation will be met with cries of pain / I-rely-on-the-spacebar-to-heat-up-my-computer. See https://killedbygoogle.com/ https://killedbygoogle.com/.
- ramon156 2y agoSide note, what is that reference from? Searching "i rely on the spacebar to heat up my computer" directs me back to this comment (6 mins ago).
- 55555 2y agoThis is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.
- croisillon 2y agothe burden of being consciencious, i guess
- aimazon 2y agoMajor YouTube channels are typically managed by multiple people through the channel management features and brand accounts. I don't think it's possible to even log in to the brand account (which has a generated email address like channel-000000000000000000000@pages.plusgoogle.com) instead it can only be accessed through an authorized user's account (which are distinct from the channel, i.e: it's not the email address that would be surfaced by this attack). Granted, things have changed over the years, so there may be old channels lingering with Google account linked email addresses, but from what I can tell, all channels were converted a while back. https://support.google.com/youtube/answer/7001996?hl=en-GB https://support.google.com/youtube/answer/7001996?hl=en-GB edit: My hunch is that the channels the OP's attack was able to target are not actual channels but rather YouTube users (who have a "channel" because that's how YouTube represents users): so "YouTube User" is the correct description of this attack, which is distinct from what you're thinking of as a channel.
- imdsm 2y agoThink this is puny — I found the ability to reveal emails in npmjs.org but as it hadn't been included in the new GitHub/Microsoft bug bounty scope yet, I was given a t-shirt and $1000. Talk about puny!
- KomoD 2y agoI think this is puny: I was able to take over accounts on a cybersecurity platform just by knowing their account email and was only paid $200
- suyash 2y agoQuestion is is this patched or the vulnerability still exists?
- croisillon 2y ago"09/02/25 - Confirm to vendor that both parts of the exploit have been fixed (T+147 days since disclosure)"
- billpg 2y agoIt's (channel-name)@gmail.com I'll take a cheque.
- fnordian_slip 2y agoVery nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.
- blagie 2y ago$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation: 1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time. 2) Working out something like this is much more than 0.25-3 weeks. More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting. The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously? Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.
- tptacek 2y agoIt's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.
- doctorhandshake 2y agoIs it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast? EDIT: oh I see .. DD/MM/YY is a new one to me
- gilbertbw 2y agoThat’s the date format used in the UK
- aimazon 2y agoSmall correction: that's the date format used by most every country except the United States. https://en.wikipedia.org/wiki/List_of_date_formats_by_country https://en.wikipedia.org/wiki/List_of_date_formats_by_countr...
- blueflow 2y agoWhy is it always americans who are caught with being seemingly unaware of the rest of the world? Is it because we all speak their language? I didn't ever see it with Britons or Australians.
- mattlondon 2y agoDate format used everywhere apart from US.
- eru 2y agoNot everywhere. In Asia you find a lot of YYYY-MM-DD and similar.
- eru 2y agoAnd in eg Germany, too.
- sd9 2y agoMM/DD/YY is an exclusively American standard https://en.wikipedia.org/wiki/List_of_date_formats_by_country https://en.wikipedia.org/wiki/List_of_date_formats_by_countr... I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.
- AznHisoka 2y ago“Applied 1 downgrade from the base amount due to complexity of attack chain required” <— is this common? I’ve only participated in a few vulnerability programs, and most of them reward less if the security flaw is stupidly simple (but serious) such as revealing user emails in the page source.
- tptacek 2y agoI had the opposite impression, that it got dinged for being relatively complex for a web finding.
- kevincox 2y agoYeah, this seems backwards. It should be upgraded from the base amount because they effectively found 2 bugs!
- swyx 2y agomade sense from the pov that if its harder to exploit, it's less damaging of a bug, so worth less
- kevincox 2y agoBut it's not really harder to exploit. It is an API call that any Google account can make. It's not like the second call has complex requirements or only probabilisticly succeeds.
- lolinder 2y agoIt's harder to find, so it's less likely to be noticed and exploited by a bad actor than a glaring issue. My experience has been that this is typical of these programs—you're trying to reward researchers for finding things that are likely to be exploited, so the more arcane bugs are less valuable. I'm not sure I'd apply that logic if I were Google, though. Smaller companies it makes sense because the threat actors that they are most likely to face are mostly script kiddies who give you at most a day before they get bored and try someone else. Google is another matter, since they're always a target for much more sophisticated attackers.
- ForHackernews 2y ago> That params is nothing more than just base64 encoded protobuf, which is a common encoding format used throughout Google. Pour one out for the google dev in charge of b64 encoding their fancy binary message format so it can be jammed inside a JSON blob. If you want a vision of the future, imagine a boot with "worse is better" imprinted on the sole stomping on an engineer's face, forever.
- aleksiy123 2y agoInternally, it would be a b64 protobuf in a protobuf field. The json part is an automatic conversion.
- jeffbee 2y agoWhy would it be b64 encoded? There's nothing that prevents you from putting an encoded protobuf into a protobuf as `bytes` type. `bytes nestedMessage = 42;` Only delimited message formats like JSON or XML need to encapsulate messages before nesting.
- aleksiy123 2y agoBecause it is in a Json? Internally it probably is protobuf with bytes. But the external API is Json and so it needs to be converted at some point. https://stackoverflow.com/questions/49358526/protobuf-message-to-json-conversion-of-bytes-field-converts-string-to-base64 https://stackoverflow.com/questions/49358526/protobuf-messag...
- paulddraper 2y agoHuh? Internally, it is (maybe) a binary field of a protobuf. Then when translating to JSON, it was converted to a string via base64 encoding.
- deleted 2y ago[deleted]
- paulddraper 2y agoJSON string of base64 encoded protocol buffer...you don't need to know what company did that to know what company did that.
- sebstefan 2y ago“Applied 1 downgrade from the base amount due to complexity of attack chain required” The attack chain isn't that complex... It's very lame to be stingy with a bug bounty program.
- hoerzu 2y agoI haven't gotten access to my YouTube channel since it migrated to Google account. If anyone can set me in contact with anyone who can help recover my account, it will be rewarded with karma for life
- ornornor 2y agoHaha a human at google. Good luck. My maps review are almost always blocked because reasons for years, Im still trying to reach a human there.
- shrx 2y agoSame here, I tried to fix the navigation by re-creating this bit of road multiple times but it's always rejected without a reason given. https://maps.app.goo.gl/YkjqBZSRPrjFLvsi8 https://maps.app.goo.gl/YkjqBZSRPrjFLvsi8
- philipwhiuk 2y ago> Some time ago, I was looking for a research target in Google and was digging through the Internal People API (Staging) discovery document Should... should this just be public: https://staging-people-pa.sandbox.googleapis.com/$discovery/rest?key=AIzaSyBOh-LSTdP2ddSgqPk6ceLEKTb8viTIvdw https://staging-people-pa.sandbox.googleapis.com/$discovery/...
- kccqzy 2y agoIt's just an automatically translated schema file from their internal .proto definition. Google relies on real cryptography not security through obscurity. Furthermore the discovery endpoint is publicly documented[0] and specifically meant for external users. Nobody internal would read the discovery endpoint: they would just pull up the .proto file through code search. Another observation: from my experience at Google it took multiple weeks of effort fighting against the bureaucracy to be able to expose an API to the public. It's not like an AWS S3 bucket that could just be accidentally public. The team knew this is public and had fought the bureaucracy to make it public. [0]: https://developers.google.com/discovery/v1/getting_started https://developers.google.com/discovery/v1/getting_started
- kensai 2y agoI hear heads rolling...
- neilv 2y ago$10k seems too small, for discovering a bad security mess-up by employees each getting paid 20 to 70 times that amount (or more).
- andrewstuart 2y ago$10,000 ain’t much for that.
- tptacek 2y agoSince every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneously, that has effectively no half-life once discovered, and whose exploitation will generate reliable telemetry from the target. * Similarly, bugs like full-chain Android/Chrome go for hundreds of thousands of dollars because Google competes with a well-established grey market; a firm can take that bug and sell it to potentially 6 different agencies at a single European country. * Even then, bounty vs. grey market is an apples-oranges comparison. Google will pay substantially less than the grey market, because Google doesn't need a reliable exploit (just proof that one can be written) and doesn't need to pay maintenance. The rest of the market will pay a total amount that is heavily tranched and subject to risk; Google can offer a lump-sum payment which is attractive even if discounted. * Threat actors buy vulnerabilities that fit into existing business processes. They do not, as a general rule, speculate on all the cool things they might do with some new kind of vulnerability and all the ways they might make money with it. Collecting payment information? Racking up thousands of machines for a botnet? Existing business processes. Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no. A bounty payout is not generally a referendum on how clever or exciting a bug is. Here, it kind of is, though, because $10,000 feels extraordinarily high for a server-side web bug. For people who make their nut finding these kinds of bugs, the business strategy is to get good at finding lots of them. It's not like iOS exploit development, where you might sink months into a single reliable exploit. This is closer to the kind of vulnerability research I've done recently in my career than a lot of other vuln work, so I'm reasonably confident. But there are people on HN who actually full-time do this kind of bounty work, and I'd be thrilled to be corrected by any of them.
- asah 2y agoAlso, Google can monitor the grey/black market and buy these exploits under false identities. For less urgent vulnerabilities (such as the YT email hack), this severely caps the bounty size.
- arajnoha 2y agohaha the title sounds like you are a blackhat, offering emails for 10k
- mschoch 2y agogoogle insiders will leak for considerably less, no exploit needed
- yieldcrv 2y agoOn one hand I doing really see the hack here. They didn’t get access to any email address, just a potential privacy leak On the other hand, a spearfishing campaign could be valuable. And launch a memecoin on some people’s account to make millions
- donatj 2y agoAfter reading the article top to bottom I still had to come to the comments to find out what the "for $10,000" was about. It's the payout for a bug bounty.
- binarysneaker 2y agoSame. Oddly worded title.
- ggregoire 2y agoBottom of the article: > Timeline > 05/11/24 - Panel awards $3,133. > 12/12/24 - Panel awards an additional $7,500.
- progforlyfe 2y agoWow, until the very last paragraph for some reason I was thinking that it COST $10,000 to leak the email of any YouTube user, like either a black market cost or purchasing cloud resources =) -- Very nice exploit though!
- riffic 2y agothe date formats in the Timeline section trigger me for some reason.
- renewiltord 2y agoEveryone on HN has this addiction to “vulnerability” like it’s some grand thing and then concocts complicated “it could be worth millions; you then use it to find out their Swiss bank account number; and they watch the money go down as you drain it!” It feels like most software sites are now populated by people who think software is like in the movies.
- ta988 2y ago147 days to fix that is just ridiculously long.This really shows the inefficiency of the whole google engineering layercake.
- ej1 2y ago[dead]
- vetrom 2y agoI see a lot of noise made about responsible disclosure, its drivers, and its rewards. What I don't see is talk about how this is one more datapoint against centralized permanent identities. Every time I see a service purporting that it works best only with a single link to your Real Identity™, I'm reminded that the vendors only abstractly care about actually protecting the user, and then only sometimes. Imagine being able get immediately three or four steps closer to doxing anyone interacting on YouTube. That's the actual impact of this bug IMO. It's good that this was fixed, but I don't think this class of bug goes away anytime soon. What do we need to do to get vendors and big companies to realize that this sort of design is landmines waiting to happen?
- vineyardmike 2y ago> Every time I see a service purporting that it works best only with a single link to your Real Identity™, I'm reminded that the vendors only abstractly care about actually protecting the user, and then only sometimes. I abstractly agree with you. There is a level of obscurity and disposability that should be tolerated in these accounts. They’re just a row in a database somewhere anyways. That said, many people transact with these businesses with real human money. For example, YouTube premium subscribers or content creators. From a practical perspective, that requires IRL identifiers to be stored somewhere with that otherwise disposable account. And due to fraud risks and other realities of banking, that requires giving these businesses actual identities and addresses which they store too. While I don’t give random apps and websites my human-identifying information, anyone I do business with necessarily knows the real me, which is a theoretical point of data leaking.
- patrick451 2y agoThis is a fixable problem if we can get congress to roll back the insane KYC laws.
- Garlef 2y agoIt's also fixable in ways that don't require rolling back KYC laws.
- byearthithatius 2y agoHe could have made WAY more money not disclosing this and that should scare any Google employee reading this
- zhobbs 2y agoCurious if anyone knows, what legality of using a technique like this? I assume illegal, even though it's just making publicly available API calls?
- theogravity 2y agoWhat can one do with a Gaia ID? I don't think the article went into the impact of having it.
- badosu 2y agoUse it on the block user api and get an email address from what I understood.
- aqueueaqueue 2y agoBut what else could definitely or potentially be done? It is an interesting question.
- xeromal 2y agoI think it's mainly a way to discover who's behind a youtube comment or video. Getting their email address often leaks information about them
- badosu 2y agoAfter reading it a bit further, they searched for a service that exposed email via Gaia ID, and found it via Pixel Recorder.
- areyourllySorry 2y agoget google maps reviews and search web archive for google plus and profiles.google.com snapshots
- Sam6late 2y agoLong time ago I discovered a similar google error, accessing youtube got me in other people accounts. I mean just going to a youtube will show me signed in into another user's account. It turned out there was a caching/database issue, and the isp/googlr mingled accounts. Here is the old report:"The issue has been replicated by the editorial teams of both itp.net and Windows Arabic magazine. In testing, the user profiles that were visible were for users that had logged into YouTube only a few hours previously, suggesting that the pages have been cached by either Google or Etisalat’s own servers, and were somehow being accessed in error through the cache. Neither Google nor Etisalat have responded to request for comment at the time of writing. The issue appears to be very similar to a problem which was reported by users of Kuwaiti ISP FASTtelco , who said that they were able to see other users Gmail accounts and other personal details, although this was later denied by the ISP'
- AutistiCoder 2y agowhat if the target has their e-mail set to private?
- deleted 2y ago[deleted]
- ProllyInfamous 2y agoI discovered my favorite PI via a geographic subreddit, over a decade ago. The amount of information this retired peace officer procures is always incredibly useful (e.g. litigation, applicant screening). $100.00 is enough to cause most to blush.
- augbog 2y agoExcellent find and breakdown of the process
- einpoklum 2y agoIt helps not to have a YouTube account. Less tracking - by Google, by its partners, and by its exploiters. (Of course, they can still apply more computational work and possibly identify you without you logging in.)
- rkagerer 2y agoI found this title confusing. For those who didn't make it toward the end of the article: the leaked emails didn't cost them anything (except their time and ingenuity), and they received 10k as the bug bounty.
- sedatk 2y agoI thought they meant providing the services to leak the email of any user for $10K, perhaps per user. :)
- adrianmonk 2y agoI thought they meant it cost $10K of compute time to brute force some process that would reveal one email address.
- raffraffraff 2y agoYeah, probably getting an LLM to do it
- raffraffraff 2y agoThat's what I thought too because that's exactly how it's phrased! Terrible wording.
- cassepipe 2y agoI think this was the clickbaity intention behind the title
- swyx 2y agoi'd really like a way to email a youtube channel owner though. even if sits in a youtube inbox for a year. most of them don't have email contacts and its hard to reach out for sponsorship or any other deals.
- williamscales 2y agoA long long time ago...in an internet far away... YouTube used to have DMs so you could do this. I don't remember exactly when it was removed. Probably late aughts.
- nashashmi 2y agoDoes google still do those security vulnerability reveal if the thing has not been fixed in 90 days? This was dixed in 147 days.
- jwpapi 2y agoOne commenter already clarified how bounty amount is related to black market value. Now a lot of others might seem how Google doesn’t value security enough. (Or other companies). But one has to understand that for security purposes they SHOULD pay as little as possible. If they pay out more there is more incentive in finding bugs and then there unfortunately you’ll also raise more black market. So GTO strat is to just cut off black market with as little money as possible.
- deleted 2y ago[deleted]
- ouraf 2y agoNice catch! And finding a vulnerability on such a high profile service will look very nice on the resume. Congrats!
- zombiwoof 2y agoClick bait title to an otherwise interesting story
- vednig 2y agoA little Update on the video, seems to be disabled by YouTube ToS
- opello 2y agoLooks like the Internet Archive has saved us once again: https://web.archive.org/web/0id_/http://wayback-fakeurl.archive.org/yt/vy_hkDEQKjA https://web.archive.org/web/0id_/http://wayback-fakeurl.arch...
- hnburnsy 2y agoFrom the article... 15/09/24 - Report sent to vendor ... 29/01/25 - Vendor requests extension for disclosure to 12/02/2025 09/02/25 - Confirm to vendor that both parts of the exploit have been fixed (T+147 days since disclosure) 12/02/25 - Report disclosed So that is 136 days not fixed(?) and Google asks for extension. Then 147 days to fix and 150 days to public disclosure. Compare this to Google Project Zero which gives other companies the following time to fix before disclosure... >"This bug is subject to a 90 day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline." >If the patch is expected to arrive within 14 days of the deadline expiring, then Project Zero may offer an extension...Note however, that the 14-day grace period overlaps with the 30-day patch uptake window, such that any vulnerability fixed within the grace period will still be publicly disclosed on day 120 at the latest (30 days after the original 90-day deadline). >If we don't think a fix will be ready within 14 days, then we will use the original 90-day deadline as the time of disclosure. That means we grant a 14-day grace extension only when there's a commitment by the developer to ship a fix within the 14-day grace period. https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...
- whymarrh 2y agoI don't think this is a useful comparison. This is Google's bug with Google's software vs. Project Zero's discoveries are (as I understand them) typically in software used by multiple people and thus there's a higher urgency to fix them.
- hnburnsy 2y agoIts not apples to apples but i think it shows Google's hypocrisy.
- deviation 2y agoCool attack chain. Regarding the payout-- I'm curious if targeting (in the disclosure video) a CEO/C-Suite exec @ Google would have encouraged a higher amount from the panel.
- nativeit 2y ago> Here's a POC of the exploit in action: This video has been removed for violating YouTube's Terms of Service That's hilarious.
- SZJX 2y agoWeird that it shows that to me at first as well, but now when I opened the article again, the video seems to be available? Not sure if it was restored just now.
- voytec 2y agoMaybe just not yet wiped from all CDN caches.
- aydgn 2y agoOP actually shared an actual existing user’s email address to prove the concept. In the reuploaded video, the email address is blurred.
- alfredosa 2y agoThat's impressive
- tomjen3 2y agoIt took 157 days to resolve per the timeline in the article. That seems extremely long for an organisation as technically competent as google.
- XCSme 2y agoIt's quite clever how the email notification was disabled (setting the email subject length to 2.5million characters, so the email delivery itself would fail).
- vachina 2y agoRight? You’d think at Google’s scale they’d sanitize every single user inputs, like truncate the string and suffix it with “…” instead of the mail delivery throwing an exception.
- DidYaWipe 2y agoRepeatedly refers to "Gaia ID" but never says what that is.
- thomasvn 2y agoMisleading title - the $10k is the bug bounty reward. Still, impressive writeup. Shows how chaining a few reverse engineered endpoints can generate created a significant exploit.