Hacker News Reader

Comment by throwaway66666 | Hacker News Reader

Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google.

How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify".

Put yourselves and your work/findings out there people!

View on HN

Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.

One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; hopefully, while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he hopefully could not authenticate to do anything any serious damage or access any sensitive information.

I agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: https://packetstormsecurity.com/files/129406/Google-App-Engi...

Reply on news.ycombinator.com