Don't Be Evil?
joshcuppett.com
joshcuppett.com
I'm not seeing where Google treated him like a "bad guy"? It sounds like he was expecting Google to sing his high praises, which of course didn't happen. The bug bounty payout also has qualifications that the author didn't come remotely close to meeting ( http://www.google.com/about/appsecurity/reward-program/ ), so I have no idea why he expected he should get paid.
By his own admission he doesn't know how the attacker got access to his account, nor where the $20k came from. So what vulnerability did he find? I guess Google's failure here was to protect the author from his own lax security.
This point is so obvious that he doesn't bother explaining any further. There was a billing mistake in his account, so therefore there must be an exploit of some kind.
There are other explanations for a billing mistake, but apparently they don't bother consideration.
a) make them aware of the problem b) give them enough of a start to work out what is happening.
So I'd suggest it is worthy of being rewarded if not by the exact rules of the program, at least by the spirit of it.
However, I seriously doubt this is really what happened - he makes a lot of leaps without any corroborating evidence. I am very sure this isn't Google trying to 'screw' the guy.
Can we please downvote this into oblivion? This guy thinks "Reporting a vulerability" is synonymous with reporting that his account was hacked.
Vulnerability rewards programs incentivize security researchers to properly disclose new attack techniques.
They do not exist to reward the reporting of account compromises.
r-shirt, why would this be useful to the hackernews community?
I'd be very surprised if allowing you to log in with an expired card somehow also allowed you to make unlimited successful payments against that expired card. It just doesn't really make sense. Seems like there is perhaps another bug or something else altogether that is responsible for the $20,000.
False. The credit card companies will let the payment through based on the number alone as long as you present an expiry date in the future. But it's illegal to continue to charge past the expiry date of the card for recurring payments after the date that was entered when the subscription started, and you're not allowed to change that expiry date yourself without the customer presenting the card again, with the new expiry date. (It's really easy to guess though, just set it 5 years into the future and that's a pretty good stab at getting it right).
The reason why it works is because you'll get a new card, with a new expiry but with the old number. Still, doing this is against the TOS. Easy to do, not proper and very very bad form towards the customer and the card company.
Stuff like this can cost you your merchant account if a customer decides to take it as far as they can. You are not just making charges on behalf of the customer here, this is a form of fraud by the merchant.
However as to his point that this is a massive imperilment of Google : Not really. Google ads run on a bid system, so introducing fake money doesn't actually reduce the amount of money Google actually makes, and may actually increase it. I get $100+ AdWord credit offers from Google literally monthly, because the effect of my credit is only that I push up the cost for everyone else. Obviously there are limits to this (when advertisers simply bow up) but unless the fraud was really widespread it wouldn't damage Google.
I can tell you that Google exploits on the black market are basically worthless unless 1) it allows Gmail read/send access or 2) facilitates emptying stolen cards in some way.
For other types of exploits (a Facebook login bypass, or Windows RCE for example) are far more useful and the black market community really can't come up with the funds to compete with corporate or government buyers.