Google Bug Bounty – The $5k Error Page

https://slashcrypto.org/2017/05/17/5k_Error_Page/

by louis-paul • 9 years ago

486 125 9 years ago

rprime2• 9 years ago

I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)

terminalcommand• 9 years ago

I am a bit jealous :).

I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites.

A subdomain search leaded to 95 subdomains under corp.google.com.

There is some strange javascript in those pages, there is a function called riskMi.

I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).

throw9912• 9 years ago

How did you subdomain search? Was it a brute force / dict search?

rprime2• 9 years ago

Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D.

I guess it's as much mindset as it's skill.

microcolonel2• 9 years ago

riskMi is probably from CA Technologies RiskMinder™.

Buge2• 9 years ago

A few weeks ago? It says a temporary fix was done by February 10.

arnioxux• 9 years ago

In at least two other companies I've worked at we also use query params to enable debug information on live production sites. At one of those companies the only requirement was that you be on a corporate ip address but it actually still works if you're on our guest wifi.

ensiferum• 9 years ago

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

sushid• 9 years ago

Google's known for their fast triage/response time. They're also fairly generous with their bounties.

nodesocket• 9 years ago

Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.

to3m• 9 years ago

Most of their consumer-facing services are not, shall we say, famous for being high-touch...

But presumably different people look after the security side of things.

kristianp• 9 years ago

This story from yesterday has raised some resentment about google's support:

A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409

carvalho4• 9 years ago

Depending on the severity of your finding, your report could wake up a senior security engineer.

When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report.

Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.

i336_• 9 years ago

Interesting. What'd you find? :)

Macuyiko2• 9 years ago

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one train an agent that goes off and tries this sort of things autonomously? Might be fun to translate the HTTP intrusion domain into a deep learning architecture.

Similar things are being applied on the "defensive" side of things already anyway (i.e. Iranian, Turkish, Chinese firewall systems using machine learning to identify and block new patterns), so why not apply this on the offensive side.

*: Not to demean the author in any way; I understand that putting the time in to explore these things is easier said than done in hindsight.

wslh• 9 years ago

It is an interesting subject to research but not easy. Finding and the exploiting a bug is art and science.

Augmenting fuzzying with AI is an interesting approach.

komali22• 9 years ago

I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.

em3rgent0rdr• 9 years ago

If the good people don't do it soon, the bad people will...

asperous• 9 years ago

I think that exists! It's called a vulnerability scanner. Maybe they could be smarter.

wingerlang• 9 years ago

Wouldn't those simply scan and try for already known vulnerabilities? I think the point of the AI would be to look for unknown ones.

chrismarlow92• 9 years ago

Its called a fuzzer. many of them have plugin frameworks where you can tensorflow your heart out.

xyzzyz• 9 years ago

Sure, people thought of it -- Google even sells it as a product, Cloud Security Scanner[1]. The internal version has been running on internal sites for a long time now.

[1] https://cloud.google.com/security-scanner/

Macuyiko2• 9 years ago

Very interesting. Does this really implement some intelligence/learning, however? Or is it just going over a list of known vulns like most scanners do?

GauntletWizard• 9 years ago

As a Xoogler who misses the debug stack, this was some fun nostalgia. Good catch!

Artemis2• 9 years ago

Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.

slashcrypto• 9 years ago

Would be very interesting to know what SFFE means ;)

mh-• 9 years ago

fairly sure it just stands for "staticfile frontend".. nothing too exciting.

edit: some support for that at https://bugs.chromium.org/p/chromium/issues/detail?id=548688...

  /bns/pe/borg/pe/bns/static-on-bigtable/staticfile.frontend.sffe/93

ChuckMcM• 9 years ago

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped. It is too bad the person who caused it didn't file for a bug bounty like this person did, they probably would have had something to show for their efforts besides "hey look at this funny thing you can do, oh wait it doesn't do it any more."

carvalho4• 9 years ago

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

logicallee7• 9 years ago

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds.

The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time.

My method to find a long string consisting entirely of stop words, was to just download a project gutenberg of the complete works of shakespeare, and find the longest string consisting of just stop words in there, then search for it as a literal quote.

The longest one I found was: "From what it is to a".

Let me see how long Google takes to do it now :)

2.04 seconds! Nice :) - http://i.imgur.com/IhPTpr6.png

that took 30+ seconds 'back in the day'.

vochinch• 9 years ago

Nice! Do you still have the link to the Quora question or an example of the query?

dsacco4• 9 years ago

Do you have a link to that? I'd be interested in reading it his response and I can't see it by searching Quora.

ClassyJacket• 9 years ago

and he/she came into the thread to kindly ask us to stop messing up their statistics.

Shouldn't someone with a job in statistics know how to account for outliers?

hoschicz• 9 years ago

This is his answer: "I work on search at Google, and I have to say, very clever answers! Now, please stop. :-p"

I don't think that he did it because it's his job to stop random people on the Internet from running slow queries. I think she was just surprised how creative people are and found it funny.

kw71• 9 years ago

Something to show for effort. This matters a bit.

One of my young-adulthood colleagues went on to be an early googler who is influential in relevant policies. We built our relationship sharing bugs and analysis techniques. Quite a few years ago some scoundrels whose trust I gained proudly showed me how they were using youtube links to drop malware. Since my old mate worked there, I mentioned it and they were quite interested.

We hadn't shared anything in a while, both of us demonstrating loyalty to our employers and not talking about work details. I said that it would be really cool to have a one dollar check from Google for a bug report. I probably offered to send something cool from my workplace too.

They said, "We don't pay for bugs" Fifty cents? "We don't pay for bugs!"

I felt like I was simply after a piece of paper and the evildoers were a mildly useful source, but I could easily do without them and the souvenir would have been treasured.

I was unreasonably miffed that I couldn't get that piece of paper, though. So I reviewed the links I'd collected and passed some general information but withheld details that would be obviously unique to these attackers. They expressed disappointment with me the next time we spoke. It turns out that what I gave wasn't specific enough to easily identify the lame cross site exploit, despite my actual intent to lead them to the bug.

Interesting they have a bounty program now.

louprado• 9 years ago

Here's a link to the Google Security Rewards Program

https://www.google.com/about/appsecurity/programs-home/

ArlenBales• 9 years ago

10/02/2017 – Google already fixed the issue but forgot to tell me … I contacted them asking for an update
19/02/2017 – Got a response, they implemented a short-term fix and forgot to sent my report to the VRP panel …

I hope Google forgetting to follow up on bug bounties and needing to be reminded isn't a common occurrence.

jcims3• 9 years ago

Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporters and bogged down by working the bug through the pipeline.

There are systems and processes to help with all of this of course, but at the end of the day it's still a pretty tricky job to get perfect all the time.

daddyo• 9 years ago

What's the general signal to noise ratio for bug reports?

dingaling• 9 years ago

I'll don my corporate hat and say: those are completely unacceptable excuses for poor client communication.

I'd perhaps accept 'I was so deep in the code!' once from a very junior developer, as a learning experience.

To the person that reported a bug, that one report makes or breaks their entire opinion of your organisation. We lost customers because of poor communication, and on the other hand made some very happy repeat-customers even when we had to say 'we can't fix that yet' - but they were in the loop for the whole process and understood why.

komali22• 9 years ago

Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png

derefr• 9 years ago

Looks like a mobile layout that is "responsive" in higher resolutions only by adding some extra elements to surround the fixed-width central container.

eslaught• 9 years ago

The page appears to have about 70 characters on a line:

    >>> len("which is nothing more than a simple login page (seems to be for Google")
    70

This is within the generally accepted guidelines for line length:

https://www.google.com/#q=characters+per+line

The bigger issue is, I think, font size. I could imagine that on certain displays this font might look rather small.

microcolonel2• 9 years ago

I prefer narrow columns for reading personally. Snap the article window to the side and scale it down for maximum enjoyment.

lmm• 9 years ago

You can make any site have a narrow column like that - the site should give those of us who prefer wider text a way to get that too.

ncal• 9 years ago

"forgot"

Buge2• 9 years ago

What do you think the motivation would be to intentionally "forget"? To save money? If that's the motivation why not pay the reporter $500 instead of $5000 for a small info leak. It's illogical that they would intentionally "forget" then pay such a high bounty.

idonotknowwhy• 9 years ago

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :(

I got all my wickr contacts to switch to signal, which is much less buggy...

annnnd2• 9 years ago

You should also publish it. Not out of revenge, but to alert customers of the quality of the software they are using and to put additional pressure on Wickr to fix it. Project Zero does that too (as do most of other security researchers). Of course, you should give them enough time (90 days?) but after that it's publish time...

developer26• 9 years ago

That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" instead of the correct "WHERE id = :id AND deleted = false".

Managing soft-deletes on a database table requires an attention to detail, with every single query ever touching that table, that many developers lack the discipline to handle. Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary. Finally, ORM abstractions often automate soft-delete in such a way that makes it exhausting for developers to validate every query. I've seen this bug over and over again at every company I've worked for. Happens so often it's impossible to keep count.

RandomBK• 9 years ago

It's issues like this that really highlight the benefits of shuffling deleted data to a separate archive table through triggers, or leveraging temporal tables. It may not necessarily be as efficient as maintaining a flag, but it dryastically reduces the mental overhead placed on users of the database.

elmigranto• 9 years ago

Managing soft-deletes on a database table requires an attention to detail.
Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary.

That's the case where instead of "try harder not to make mistakes", you design a system so it is not possible to make them. One way would be to rename original table `raw_messages` and `create view messages as select * from raw_messages where not deleted`.

stickfigure• 9 years ago

I don't disagree that this is common, but it doesn't require special skills or extra attention to detail. Your code to load the 'thing' should always use a Loader (or whatever you choose to call it) - some abstraction that loads the thing and checks for permission. It's really not that hard, and it's the bare minimum of competence I expect from a junior web developer. If you have littered your code with SQL statements, you're almost certainly doing it wrong.

carvalho4• 9 years ago

Good catch! Also studied Google's 404 pages. Seems like they have unified all but a few of them. One of them I found was vulnerable to old utf-7 injection (specified customizable page title before character encoding) and another was vulnerable to XSS. Got a bounty for the XSS one, the utf-7 one targeted too old browsers, out of scope for the program (I do wonder how many IE6 users Google sees).

joatmon-snoo2• 9 years ago

It's a very low percentage, somewhere in the low single digits (if not an even lower order of magnitude). Still high enough for it to be worth paying engineers to maintain the backwards compatibility :)

netheril96• 9 years ago

Such a refreshing story after countless of security researchers get threatened or sued when they report security vulnerabilities to the company that should have thanked them instead.

lucb1e• 9 years ago

Haven't read one of those in years. Did one come by on HN recently?

frenchie14• 9 years ago

This one comes to mind: https://news.ycombinator.com/item?id=14166966

Raneri questioned my motivation and I said that I want to give the vendor ample time to resolve the issue and then I want to publish academically. He was very threatened by this and made thinly veiled threats that the FBI or other institutions would "protect him". Then he continued with statements including "we want to hire you but you must sign this NDA first." He also recommended that I only make disclosure through FINRA, SDI, NCTFA and other private fraud threat sharing organizations for financial institutions.

dmead• 9 years ago

thefacebook.com redirected to facebook.com/intern/vod up until last week.

nickcw• 9 years ago

I found a bug in Go which turned into this CVE

https://www.cvedetails.com/cve/CVE-2015-8618/

I applied for a bug bounty, but alas was turned down as Go isn't a Google service and it wasn't in scope for the Patch Reward Program.

I did get into the hall of fame though!

roemerb• 9 years ago

Am I the only person who had to enlarge the page to read the article? Nice catch though.

Google Bug Bounty – The $5k Error Page

Related Stories