4 ms·

This is not a part of the vulnerability rewards program? Why?

tantalor 13y ago
It's not in scope, because it's not a "Google operated web service." http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/ (I work for Google.)
- HoochTHX 13y ago
  And potentially shutting down the HVAC for the web servers has no relation?
  - packetslave 13y ago
    What is it that led you to believe Google hosts web servers out of the Sydney office building?
    - Smerity 13y ago
      Google Sydney has servers on site, but they may well just be to be local productivity aids (mirrors for development etc). Google generally don't publicise where their servers are or what they're for. Even if the servers are just like any standard office's servers, this exploit could result in some serious issues. When I was at Google Sydney a few years ago for an internship, the AC died prompting an interesting response. The server temps were rising to unsafe levels and the AC wasn't expected to come back in time. The MacGyver solution was to buy portable AC units and pump the heat into the coder's workspace. That was a distinctly unpleasant afternoon =] If the machines weren't important for production or productivity I'm certain they'd save us the hassle and shut them down. If nothing else, abuse of this office's AC system could severely impact the productivity of the office and spring dozens of people into action. Whilst not under the usual purview of the rewards program, I'd still think it's noteworthy of recognition.
      - NickNameNick 13y ago
        I wonder if that was a similar time to when I visited that office ~feb 2011. The aircon was clearly over capacity then, and there were portable air conditioners scattered around the floor I was on, with flexible ducting feeding up to the return ducts in the ceiling. I assume they've fixed that by now, I know they've gone through at least on remodel since.
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]
  - mseebach 13y ago
    There's a photo and a floor plan - please point to the production servers :) (hint: it's an office building, not a datacenter)
- fnordfnordfnord 13y ago
  Well, not something they meant to operate as a web service.
tptacek 13y ago
Presumably because addressing it does not meaningfully improve the security of Google's customers and users.
- f- 13y ago
  Well, it's actually a bit more complicated than that. The bug is definitely something we wanted to know about, and we're thankful for the report. That said, there are some constraints that we put in place for the reward program to protect researchers from harm. For example, we don't want physical security or the police second-guessing the intent of someone trying to sneak into one of our buildings - so we set a very clear scope for the program, pragmatically focusing on our user-facing applications and excluding things such as attacks on our facilities and corporate infrastructure. It's a broad exclusion, but it's hard to come up with something finer-grained yet clear enough. In the same vein, we ask researches that they don't go after any systems unless it's perfectly clear that the application is owned and operated by us - for example, because it's in an IP range registered to us. Again, while this may be more limiting than we'd like, it protects the community against overly litigious parties if the system proves to belong to somebody else. In several unusually serious cases, we have made case-by-case exceptions and have paid external researchers for nominally non-qualifying bugs; but it's a tricky balance, and we use this power very cautiously. Source: I authored a good chunk of the current rules for Google VRP ;-)
  - swalkergibson 13y ago
    I can definitely see the reasoning behind not wanting to encourage people to don their black ski mask and attempt to weasel their way into the building beneath the cloak of "security researcher." You are absolutely right, the police are not going to split hairs attempting to decipher the intentions of the individual and will act swiftly to neutralize the threat. However, this case is different. While it was absolutely an attack on Google's infrastructure, it was discovered through a vulnerable external web service. Even though the control panel application is not a Google product, it stores user passwords in clear text as decoding it seems to be trivially simple. At the very least, Google should be responsible for picking third party vendors that store passwords using one-way hashes ;). If you ask me, this should be one of those special cases!

It's not in scope, because it's not a "Google operated web service." http://www.google.com/about/appsecurity/reward-program/ http://www.google.com/about/appsecurity/reward-program/ (I work for Google.)

HoochTHX 13y ago
And potentially shutting down the HVAC for the web servers has no relation?
- packetslave 13y ago
  What is it that led you to believe Google hosts web servers out of the Sydney office building?
  - Smerity 13y ago
    Google Sydney has servers on site, but they may well just be to be local productivity aids (mirrors for development etc). Google generally don't publicise where their servers are or what they're for. Even if the servers are just like any standard office's servers, this exploit could result in some serious issues. When I was at Google Sydney a few years ago for an internship, the AC died prompting an interesting response. The server temps were rising to unsafe levels and the AC wasn't expected to come back in time. The MacGyver solution was to buy portable AC units and pump the heat into the coder's workspace. That was a distinctly unpleasant afternoon =] If the machines weren't important for production or productivity I'm certain they'd save us the hassle and shut them down. If nothing else, abuse of this office's AC system could severely impact the productivity of the office and spring dozens of people into action. Whilst not under the usual purview of the rewards program, I'd still think it's noteworthy of recognition.
    - NickNameNick 13y ago
      I wonder if that was a similar time to when I visited that office ~feb 2011. The aircon was clearly over capacity then, and there were portable air conditioners scattered around the floor I was on, with flexible ducting feeding up to the return ducts in the ceiling. I assume they've fixed that by now, I know they've gone through at least on remodel since.
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- mseebach 13y ago
  There's a photo and a floor plan - please point to the production servers :) (hint: it's an office building, not a datacenter)
fnordfnordfnord 13y ago
Well, not something they meant to operate as a web service.

tptacek 13y ago

Presumably because addressing it does not meaningfully improve the security of Google's customers and users.

f- 13y ago
Well, it's actually a bit more complicated than that. The bug is definitely something we wanted to know about, and we're thankful for the report. That said, there are some constraints that we put in place for the reward program to protect researchers from harm. For example, we don't want physical security or the police second-guessing the intent of someone trying to sneak into one of our buildings - so we set a very clear scope for the program, pragmatically focusing on our user-facing applications and excluding things such as attacks on our facilities and corporate infrastructure. It's a broad exclusion, but it's hard to come up with something finer-grained yet clear enough. In the same vein, we ask researches that they don't go after any systems unless it's perfectly clear that the application is owned and operated by us - for example, because it's in an IP range registered to us. Again, while this may be more limiting than we'd like, it protects the community against overly litigious parties if the system proves to belong to somebody else. In several unusually serious cases, we have made case-by-case exceptions and have paid external researchers for nominally non-qualifying bugs; but it's a tricky balance, and we use this power very cautiously. Source: I authored a good chunk of the current rules for Google VRP ;-)
- swalkergibson 13y ago
  I can definitely see the reasoning behind not wanting to encourage people to don their black ski mask and attempt to weasel their way into the building beneath the cloak of "security researcher." You are absolutely right, the police are not going to split hairs attempting to decipher the intentions of the individual and will act swiftly to neutralize the threat. However, this case is different. While it was absolutely an attack on Google's infrastructure, it was discovered through a vulnerable external web service. Even though the control panel application is not a Google product, it stores user passwords in clear text as decoding it seems to be trivially simple. At the very least, Google should be responsible for picking third party vendors that store passwords using one-way hashes ;). If you ask me, this should be one of those special cases!