Leaking the email of any YouTube user for $10k

https://brutecat.com/articles/leaking-youtube-emails

by brutecat • 1 year ago

1624 464 1 year ago

brutecat.com

michpoch• 1 year ago

Am I very naive expecting the payout to be significantly higher?

ec109685• 1 year ago

Interesting that the bounty amount went down due to how obscure the attack vector was.

SXX2• 1 year ago

Unfortunately high payouts is just not how cyber security industry work. Instead of high payouts you get vanity and higher chance to get well-paid job.

immibis• 1 year ago

You can get a high payout if you're also willing to risk your life. Companies are relying on researchers doing the ethical thing instead of the profitable thing.

cesarb3• 1 year ago

To me, that payout felt quite high; it's bigger than the average monthly salary for a senior IT professional where I live. To put it another way, that bounty alone would be like being paid for several months of full-time employment.

tgsovlerkhgsel• 1 year ago

Yes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd actually consider that a surprisingly high amount, and I would expect that many companies wouldn't consider this class of bug a bounty-worthy issue at all - "thanks for the report", maybe fix it maybe not, but no bounty.

robin_reala2• 1 year ago

I’d misunderstood the title to refer to $10k of GPU compute or something like that. Unfortunately I suspect there’ll be tens or hundreds of occurrences of this bug given that they just picked one old Google product and immediately found a hole.

SXX2• 1 year ago

given that they just picked one old Google product and immediately found a hole.

This is just not how it works. Most likely author spent weeks or months digging into different products until he found something worthville.

saretup• 1 year ago

I misunderstood it to mean they are selling any YouTuber’s email address for $10k

nullderef• 1 year ago

Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.

robin_reala2• 1 year ago

Unfortunately with the number of users Google has, any deprecation will be met with cries of pain / I-rely-on-the-spacebar-to-heat-up-my-computer. See https://killedbygoogle.com/.

ramon156• 1 year ago

Side note, what is that reference from? Searching "i rely on the spacebar to heat up my computer" directs me back to this comment (6 mins ago).

aeonik• 1 year ago

They really aren't shy about massive breaking changes.

I'm still upset about Google Reader.

https://killedbygoogle.com/

hkwerf• 1 year ago

You're essentially suggesting a Drake equation [1] equivalent for the number of security vulnerabilities based on NLoC. What other factors would be part of this equation?

[1] https://en.wikipedia.org/wiki/Drake_equation

maximus-decimus• 1 year ago

How close to the Balmer peak the programmer was when he wrote the code.

CSMastermind• 1 year ago

Language or framework definitely plays a role (isn't that what the Rust people are so excited about). Maybe say like the materials/tools used.

There's definitely some measure of complexity. I still like simple cyclomatic but I know there are better ones out there that try to capture the cognitive load of understanding the code.

The attack surface of the system is definitely important. The more ways that more people have to interface with the code, the more likely it is that there will be a mistake.

Security practices need to be captured in some way (maybe a factor that gets applied). If you have vulnerability scanning enabled that's going to catch some percentage of bugs. So will static analysis, code reviews, etc.

zwnow4• 1 year ago

The point is: security is fake. No app is truly secure. You can spend millions on app security and all it takes to breach that is one slip up of a human user.

TheDong3• 1 year ago

I'd take away "security is complicated and multi-faceted", not "fake".

It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess".

Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the app was secure, right? At least secure enough? Signal so far has been "secure enough in practice" for most people, while iMessage has in practice been "secure enough if you're a normal person, but with serious security issues for anyone who might be subject to serious targeted attacks"

Say more about what you mean by "no app is truly secure"? Especially in the context of signal?

rpigab• 1 year ago

That's probably another reason why Google kills so many products that are successful, but not successful enough for Google's whole system to justify keeping them alive and secure.

echelon2• 1 year ago

100%. Every product not a part of the core mission is attack surface area, ongoing maintenance to ensure it works with the rest of Google services and infra, and drag on the rest of the team and velocity.

The part that sucks for consumers is that they often kill things that people like. I wish they had a better way of doing this.

Bravo to brutecat for this excellent discovery, productionization, and writeup.

ragazzina7• 1 year ago

Maybe Apple should do the same and kill their many half-baked software products.

goldfish3• 1 year ago

There's a lot of truth to that. Older projects often get bogged down by new security & compliance horizontals, to the point where maintenance is just no longer worth it.

vladms• 1 year ago

I would challenge you to give me examples where security feels "real" and how does that help.

Most software products rely on very complex software stacks, and if you trust 100% all the libraries and the OS you use I would say it's a wrong mindset. There were bugs even in the processor (meltdown). Security is a continuous battle and you never know if you won, only (sometimes) if you loose.

tialaramex• 1 year ago

You can tell security is real the same way as lots of other things, reality doesn't give a fuck. Like how you can tell the difference between man's laws (e.g. "The Offside Rule" or "Constitutional Rights") and Mother Nature's laws (e.g. Thermodynamics). Try it, kick the ball even though the rule says you mustn't - if you get lucky the referee doesn't notice and play continues. But if you try to make a system more ordered without expending energy it does not work. Reality doesn't give a fuck.

When I breeze through your login process with the wrong credentials that's because your security was fake, if it was real that would break because it didn't know who I was, so if some bug lets me past login I don't somehow successfully log in as me, I'm logging in as nobody at all which is clearly nonsense.

This is "Make Invalid States Unrepresentable" at scale, and it's difficult to do, but not impossible.

55555• 1 year ago

This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.

croisillon4• 1 year ago

the burden of being consciencious, i guess

aimazon2• 1 year ago

Major YouTube channels are typically managed by multiple people through the channel management features and brand accounts. I don't think it's possible to even log in to the brand account (which has a generated email address like channel-000000000000000000000@pages.plusgoogle.com) instead it can only be accessed through an authorized user's account (which are distinct from the channel, i.e: it's not the email address that would be surfaced by this attack). Granted, things have changed over the years, so there may be old channels lingering with Google account linked email addresses, but from what I can tell, all channels were converted a while back.

https://support.google.com/youtube/answer/7001996?hl=en-GB

edit: My hunch is that the channels the OP's attack was able to target are not actual channels but rather YouTube users (who have a "channel" because that's how YouTube represents users): so "YouTube User" is the correct description of this attack, which is distinct from what you're thinking of as a channel.

imdsm2• 1 year ago

Think this is puny — I found the ability to reveal emails in npmjs.org but as it hadn't been included in the new GitHub/Microsoft bug bounty scope yet, I was given a t-shirt and $1000.

Talk about puny!

KomoD• 1 year ago

I think this is puny: I was able to take over accounts on a cybersecurity platform just by knowing their account email and was only paid $200

davidmurdoch• 1 year ago

I was able to run JavaScript inside an email in the GMail app on Android (it required the user tap within the email body). I only got a Nexus 7 tablet.

croisillon4• 1 year ago

in an old company of mine they started an intranet but if you opened it as http instead of https you'd see raw codes inclusive sql passwords and everything ; i reported to them, to which they replied "yeah just open it with https like everyone else"

tptacek33• 1 year ago

Serverside vulnerabilities have essentially no market outside of bug bounties. This is a hell of a payout for a web finding.

mosselman• 1 year ago

Unless you build a “get email for all of your viewers” service that streamers use to gather emails

ajross• 1 year ago

What would an appropriate payout be? I mean, the classification ("high exploit probability, abuse-related impact") seems about right to me. Are you saying that abuse bugs should be more valuable? That all bugs should pay more? That this is a rich company so they should pay more?

If they poked around a bit more they may have found a better GAIA->Email vulnerability

They still can! Report more bugs, get more bounties. I don't see how this is related to how much they paid for this one.

A database of emails for every major youtube channel would be worth an awful lot.

It's pretty clear from the article that you can't use this API to scrape at that kind of volume. This kind of thing was never in the offering. As the title says, you can leak "any" email, not "every" email.

xyst• 1 year ago

A database of every YT user then x-referencing them with public services (fb/ig/twitter). Build shadow profiles, sell db to highest bidder.

Or just plain ole pwning them. Most users still tend to use the same password across different services, not use 2FA, and involved in at least 1 high profile leak (I know I’m in at least a dozen so far per haveibeenpwned).

Occasionally you get the victim that uses that same password for their e-mail service and that can allow you to bypass e-mail 2FA if enabled. Even better if the account is used for social SSO (ie, Google, Facebook, Twitter). Then you have access to a treasure trove of services; or just delete them for lulz

astrange• 1 year ago

I once reported a way to see anyone's gift registry shipping address on Amazon.com and they paid me $0 because they don't have a bug bounty. (But they did fix it.)

suyash• 1 year ago

Question is is this patched or the vulnerability still exists?

croisillon4• 1 year ago

"09/02/25 - Confirm to vendor that both parts of the exploit have been fixed (T+147 days since disclosure)"

billpg• 1 year ago

It's (channel-name)@gmail.com

I'll take a cheque.

fnordian_slip• 1 year ago

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.

blagie6• 1 year ago

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout.

Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead.

The amount of work doing something like this is orders of magnitude more than the compensation:

1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time.

2) Working out something like this is much more than 0.25-3 weeks.

More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting.

The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously?

Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.

tptacek33• 1 year ago

It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.

kccqzy4• 1 year ago

Bug bounty payouts are not effort based. It does not matter how much time it took the discoverer to find the vulnerability. So discussing the amount of work involved is irrelevant; it's not like the kindergarten level "oh you tried so there's a consolation prize for effort". Comparing it against the fixed rate salary of a SWE is even more wrong, except that your argument shows it is more profitable for a hypothetical person relying on bug bounty income to instead join Google as an internal red teamer.

The other comment has already addressed the market value question.

yieldcrv2• 1 year ago

salary and compensation are not synonyms, you used them interchangeably

ant6n4• 1 year ago

I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡

sgjohnson• 1 year ago

Zero-click kernel code execution with persistence and kernel PAC bypass

This is what baffles me about Apple's bug bounty program.

$1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device.

This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.

Frieren• 1 year ago

Bounties make sense for open source projects where the main reward is to contribute to the community.

For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort.

Underpaid is an understatement.

doctorhandshake2• 1 year ago

Is it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast?

EDIT: oh I see .. DD/MM/YY is a new one to me

gilbertbw• 1 year ago

That’s the date format used in the UK

aimazon2• 1 year ago

Small correction: that's the date format used by most every country except the United States.

https://en.wikipedia.org/wiki/List_of_date_formats_by_countr...

mattlondon2• 1 year ago

Date format used everywhere apart from US.

eru2• 1 year ago

And in eg Germany, too.

sd9• 1 year ago

MM/DD/YY is an exclusively American standard

https://en.wikipedia.org/wiki/List_of_date_formats_by_countr...

I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.

pcthrowaway• 1 year ago

Canada uses this also, though we also use day-month-year and year-month-day.

Yes, this effectively makes dates nearly impossible to decipher here.

GuB-42• 1 year ago

It seems like it comes from an british convention of spelling dates "February 12, 2025" instead of the now more common "The 12th of February, 2025".

Like US customary units, imported from the british, but the UK modernized its system, not the US.

SigmundA2• 1 year ago

To me its sounds better and more correct to say:

February 12th, 2025

Rather than:

12 February 2025

And is easier to say than:

The 12th of February 2025

So it's always been natural to write the numeric form the same way, but I am American. I can appreciate day first being easier to sort by machines and having an agreed upon international standard.

voytec3• 1 year ago

For a person born and raised in metric system, MM/DD/YY is just as bonkers as if someone decided that MM:HH:SS makes sense.

natebc• 1 year ago

I've always thought it was because we say:

February Twelfth Two Thousand and Twenty Five

Feb 12 2025

02/12/2025

I know it's cool for Europeans ... and everyone else to hate on us for it but it does seem to make sense given the way we typically say the date.

doctorhandshake2• 1 year ago

Agreed - MMDDYY is truly unintuitive but even DDMMYY is ambiguous if it’s early enough in the morning.

mattlondon2• 1 year ago

Day-Month-Year is the standard everywhere in the world apart from the US.

Big and little endian dates are the only way that makes sense I think. Doing it the US way where day is inexplicably between year and month just feels corrupted to my mind.

cesarb3• 1 year ago

Day-Month-Year is the standard everywhere in the world apart from the US.

IIRC, Japan uses Year-Month-Day, which is the other order which makes sense.

duohedron• 1 year ago

Not standard in China, Japan, Hungary, Mongolia, South Korea, Taiwan, and of course ISO 8601.

ant6n4• 1 year ago

Day-Month-Year is the standard everywhere in the world apart from the US

Nope, the standards are day.month.year, year-month-day, or month/day/year. The problem happens when the delimiter doesn't match the ordering.

andy81• 1 year ago

Exactly the reason that you should always use yyyy-mm-dd.

thomassmith65• 1 year ago

yyyy-mm-dd is the most sensible, yes. For one thing, it sorts properly.

hennell• 1 year ago

DMY is the most common format internationally. There's a growing move (and ISO standard) for YMD but its a slow change, I think it's only North America that uses MDY.

riffic2• 1 year ago

ISO 8601 was set in 1988:

https://xkcd.com/1179/

AznHisoka• 1 year ago

“Applied 1 downgrade from the base amount due to complexity of attack chain required” <— is this common?

I’ve only participated in a few vulnerability programs, and most of them reward less if the security flaw is stupidly simple (but serious) such as revealing user emails in the page source.

tptacek33• 1 year ago

I had the opposite impression, that it got dinged for being relatively complex for a web finding.

kevincox2• 1 year ago

Yeah, this seems backwards. It should be upgraded from the base amount because they effectively found 2 bugs!

swyx2• 1 year ago

made sense from the pov that if its harder to exploit, it's less damaging of a bug, so worth less

ForHackernews2• 1 year ago

That params is nothing more than just base64 encoded protobuf, which is a common encoding format used throughout Google.

Pour one out for the google dev in charge of b64 encoding their fancy binary message format so it can be jammed inside a JSON blob. If you want a vision of the future, imagine a boot with "worse is better" imprinted on the sole stomping on an engineer's face, forever.

aleksiy1232• 1 year ago

Internally, it would be a b64 protobuf in a protobuf field.

The json part is an automatic conversion.

jeffbee• 1 year ago

Why would it be b64 encoded? There's nothing that prevents you from putting an encoded protobuf into a protobuf as `bytes` type. `bytes nestedMessage = 42;` Only delimited message formats like JSON or XML need to encapsulate messages before nesting.

paulddraper3• 1 year ago

Huh?

Internally, it is (maybe) a binary field of a protobuf.

Then when translating to JSON, it was converted to a string via base64 encoding.

paulddraper3• 1 year ago

JSON string of base64 encoded protocol buffer...you don't need to know what company did that to know what company did that.

caust1c• 1 year ago

It's everywhere and it's the worst. I sometimes ponder whether or not the volume of protobuf bytes represented as b64 encoded protobuf in JSON exceeds that of actual protobuf bytes sent over the wires of the internet, and then I pour one out for myself.

ForHackernews2• 1 year ago

JSON's not even that bad if it's gzipped! It compresses relatively well.

If only there were some way to easily send this binary gzip data to this API that accepts JSON...

sebstefan• 1 year ago

“Applied 1 downgrade from the base amount due to complexity of attack chain required”

The attack chain isn't that complex...

It's very lame to be stingy with a bug bounty program.

hoerzu• 1 year ago

I haven't gotten access to my YouTube channel since it migrated to Google account. If anyone can set me in contact with anyone who can help recover my account, it will be rewarded with karma for life

ornornor• 1 year ago

Haha a human at google. Good luck. My maps review are almost always blocked because reasons for years, Im still trying to reach a human there.

shrx• 1 year ago

Same here, I tried to fix the navigation by re-creating this bit of road multiple times but it's always rejected without a reason given. https://maps.app.goo.gl/YkjqBZSRPrjFLvsi8

philipwhiuk• 1 year ago

Some time ago, I was looking for a research target in Google and was digging through the Internal People API (Staging) discovery document

Should... should this just be public: https://staging-people-pa.sandbox.googleapis.com/$discovery/...

kccqzy4• 1 year ago

It's just an automatically translated schema file from their internal .proto definition. Google relies on real cryptography not security through obscurity.

Furthermore the discovery endpoint is publicly documented[0] and specifically meant for external users. Nobody internal would read the discovery endpoint: they would just pull up the .proto file through code search.

Another observation: from my experience at Google it took multiple weeks of effort fighting against the bureaucracy to be able to expose an API to the public. It's not like an AWS S3 bucket that could just be accidentally public. The team knew this is public and had fought the bureaucracy to make it public.

[0] https://developers.google.com/discovery/v1/getting_started

kensai• 1 year ago

I hear heads rolling...

neilv3• 1 year ago

$10k seems too small, for discovering a bad security mess-up by employees each getting paid 20 to 70 times that amount (or more).

andrewstuart• 1 year ago

$10,000 ain’t much for that.

tptacek33• 1 year ago

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations:

* Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneously, that has effectively no half-life once discovered, and whose exploitation will generate reliable telemetry from the target.

* Similarly, bugs like full-chain Android/Chrome go for hundreds of thousands of dollars because Google competes with a well-established grey market; a firm can take that bug and sell it to potentially 6 different agencies at a single European country.

* Even then, bounty vs. grey market is an apples-oranges comparison. Google will pay substantially less than the grey market, because Google doesn't need a reliable exploit (just proof that one can be written) and doesn't need to pay maintenance. The rest of the market will pay a total amount that is heavily tranched and subject to risk; Google can offer a lump-sum payment which is attractive even if discounted.

* Threat actors buy vulnerabilities that fit into existing business processes. They do not, as a general rule, speculate on all the cool things they might do with some new kind of vulnerability and all the ways they might make money with it. Collecting payment information? Racking up thousands of machines for a botnet? Existing business processes. Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no.

A bounty payout is not generally a referendum on how clever or exciting a bug is. Here, it kind of is, though, because $10,000 feels extraordinarily high for a server-side web bug.

For people who make their nut finding these kinds of bugs, the business strategy is to get good at finding lots of them. It's not like iOS exploit development, where you might sink months into a single reliable exploit.

This is closer to the kind of vulnerability research I've done recently in my career than a lot of other vuln work, so I'm reasonably confident. But there are people on HN who actually full-time do this kind of bounty work, and I'd be thrilled to be corrected by any of them.

asah• 1 year ago

Also, Google can monitor the grey/black market and buy these exploits under false identities. For less urgent vulnerabilities (such as the YT email hack), this severely caps the bounty size.

dan-robertson• 1 year ago

My guess was that people selling vulnerabilities generally know who they’re selling to. Is there a big market for people selling exploits to unknown/anonymous customers?

mmsc4• 1 year ago

Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no.

Absolutely, yes. Spam and targeted phishing attacks are in high demand.

My understanding is that it is possible to retrieve every public youtube channel ID, if not also Google Maps/Play reviewers, quite easily. This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created.

brookst2• 1 year ago

But then what? Given the number of accounts Google has, odds are that nearly every alphanumeric combo less than 8 or 10 characters plus “@gmail.com” is a google account. This vulnerability gets you other domains, but still not seeing it. Massive databases of email addresses are a dime a dozen.

The only angle I can imagine is phishing for high profile creators, and at most this is a “makes it easier” and not a “creates the problem” bug.

kasey_junk3• 1 year ago

And then what?

Exploits need to plug into a business plan. Like any business plan there has to be somewhere that money gets extracted and that money needs to be more than the exploit cost & infrastructure costs & a risk premium.

If you can’t trivially say how the exploit explicitly gets turned into cash you probably are on the wrong track. Doubly so if it’s not a known standard and commoditized way that’s happened before.

jeffwask3• 1 year ago

Honestly, that leaves straight up harassment of YouTubers by other YouTubers and fans off the table which by itself would motivate a few of them. Some of the same people who play in the black and grey hat worlds are the same people buying DDOS attacks and swatting streamers. They would have a party with their emails.

lolinder5• 1 year ago

This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created.

Massive email databases are extremely cheap, often free. For this vulnerability to be worth more than $10k there would have to be something about it being a near-complete library of Google accounts (rather than just another massive mailing list).

And that's assuming the prospective buyer believed that they could exploit this vulnerability in full before discovery. If I'm reading this exploit right, each email recovered requires two requests, one of which needs to make one of the fields 2.5 million characters long in order to error out the notification email sent to the victim. Presumably that email sending error would show up in a log somewhere, so the prospective attacker would have to send billions of requests fast enough that Google can't block them as suspicious or patch the vulnerability, all the while knowing full well that they're filling up an error log somewhere and leaving an extremely suspicious pattern of megabyte-sized request bodies on a route that normally doesn't even reach kilobytes.

I'm honestly not seeing how you could make an email list out of this that is anywhere near complete, and even if you could I'm not sure where the value to it would be.

edanm2• 1 year ago

I don't remember if I've ever thanked you for the dose or reality you bring to these discussions, but if not - thank you! Before I started reading your comments on bug bounty payouts I'd probably have made the typical thoughtless (in my case) remark that the bounties are tiny, without actually thinking through the realistic dollar value of bugs found.

Not to mention not really thinking through how obviously stupid it is to immediately compare a legal activity to a highly illegal one, as if they're real alternatives for most people.

tptacek33• 1 year ago

https://www.youtube.com/watch?v=Y0pdQU87dc8

neilv3• 1 year ago

Threat actors buy vulnerabilities that fit into existing business processes

Isn't there a market for this? For example, "Reveal who is behind this account that's criticizing our sketchy company/government, so we can neutralize them".

I'll also argue there's separate incentives, than the market value to threat actors... Although a violent stalker of an online personality might not be a lucrative market for a zero-day exploit for this "threat actor" market, the vulnerability is still a liability (and ethical) risk for the company that could negligently disclose the identity of target to violent stalker.

IMHO, if you're paying well a gazillion Leetcode performance artists, to churn out massive amounts of code with imperfect attention to security, then you should also pay well the people who help you catch and fix their gazillion mistakes, before bad things happens.

lolinder5• 1 year ago

then you should also pay well the people who help you catch and fix their gazillion mistakes before bad things happens.

You missed their point about the business model of the security researchers here: their business model is finding a large number of small value vulnerabilities. Those who are good at this are very very good at this.

My company has a bug bounty program and some of the researchers participating in it make double or more my salary off of our program, but we never pay out more than this for a single report. And it's not like we're particularly vulnerable, we just get a steady stream of very small issues and we pay accordingly.

pwillia7• 1 year ago

Yeah, _should_ but businesses make money and not reporting and using the vulnerability in any other way is illegal, so they get to set the price as they're the only buyer. They know this.

portaouflop• 1 year ago

You are imagining a market that doesn’t exist.

First there are only very few gobs/companies that are sketchy enough to do this - and for those a huge number of non-anonymous people exist with huge reach that are very critical for years. If such a market would exist they would assassinate all those first - you don’t need the email if you have the face, voice, and name - since that is not happening they just don’t care that much about it.

zemnmez• 1 year ago

i think what's being conflated here is that there are reasonably buyers for this kind of vulnerability but there's no market in the truest sense. I think a correctly connected individual could well sell this vuln to a state actor or a contractor to one; but the ecosystem of bug sales to these parties has no aggregate appetite for them, thus, there is nothing driving the price up. People in the market for cyberweapons want point and shoot vulns that have broad usage beyond a specific server for a specific company or parts for them, and ones that will last beyond a single corporation patching something. They are willing to pay such big $$$ for this that the whole market is optimized for it. The power players here would much rather buy a gun and shoot the lock off a door than a specialised set of picks that work for that lock in that building.

tart-lemonade• 1 year ago

The only real market (that I can see) are shady data aggregators. Governments just file subpoenas, and abusive megacorps can file lawsuits (all the anti-SLAPP statues in the world can't prevent your Google account from being unmasked and having to pay for a lawyer). There is a limited market in the form of internet addicts who want to harass people for kicks (since finding an email gives them another route to do that with), but it's a small one. These people also tend to be entitled pricks, so they're not a very good customer base to have.

jovial_cavalier• 1 year ago

The bounty is not a market. It's a subsidized incentive to subvert the market, and to give greyhat hackers a reason to be white-tinged instead of black-tinged. I would conservatively guess this guy could have found at least 30 people willing to pay $500 for details on this exploit, and he would've netted $5000 more than Google paid him to do the right thing.

Probably the risk of going to jail outweighs the extra $5k, but if a company is serious about the bug bounty program, they would offer a reward that's competitive with what you could extract from the black market, and I don't think that's hard to do.

wepple8• 1 year ago

Threat actors buy vulnerabilities that fit into existing business processes

Selling crazy stories to the media is as old as time.

This vuln would give you a lookup table from email->YT

SELECT * FROM table WHERE email LIKE “%.gov”

tsunamifury• 1 year ago

And? So what. You can spam them?

Come on.

hedora• 1 year ago

Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced.

If we apply your analysis to other things, we’ll find that the upper bound price for a new car stereo or bike is ~ $100, and the price of any copyrighted good is bounded by the cost of transferring it over the network.

I think it is more useful to divide the amount Google paid by the number of hours spent on this and any unsuccessful exploit attempts since the last bounty was paid.

I’d guess that the vast majority of people in this space are making less than US minimum wage for their efforts, with a six figure per year opportunity cost.

That tells you exactly how much Google values the security and preserving the privacy of its end users. The number is significantly lower than what they pay other engineers orders of magnitude more to steal personal information from the same group of people.

UncleMeat7• 1 year ago

Bug bounty programs are not the only (or even primary) way that security researchers get paid. Google pays employees salaries to find vulns. Bounty programs are a pretty recent development and the idea that they should be scalable and stable well paying employment for a lot of people is a bit strange to me.

If security researchers want to have stable employment doing this sort of work, there's oodles of job applications they can send out.

notpushkin4• 1 year ago

and the price of any copyrighted good is bounded by the cost of transferring it over the network

It sure has worked out pretty much like this for music. The cost is not exactly zero, but pretty close to that.

jonas21• 1 year ago

Most other fields produce things that can be sold in the legal market - and so the value of those things can be determined by the market.

bee_rider• 1 year ago

They mentioned the grey market a couple time, although some of their examples did seem like applications that would be more useful for the black market.

Anyway, I’m not 100% sure what they meant by grey market. It looks like they were talking about maybe selling to “agencies” which, I guess, could include state intelligence agencies. If that’s what they meant, it wouldn’t be that surprising to find that the black market and grey market prices influence each other, right?

I mean we could ask our intelligence agencies why they are shopping in the same markets as criminals but I guess they will say something like “it is important that we <redacted> on the <redacted>, which will allow us to better serve the <redacted> and keep the <redacted> safe.”

demosthanos2• 1 year ago

Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced.
If we apply your analysis to other things

This analysis doesn't work for a few reasons:

* For physical goods, used items always fetch a lower price than new items due to unrelated effects. And if we're only looking at the used price, we do find that the black market price is just about equal to the used item's value minus the risk associated with dealing with stolen goods (unless the buyer is unaware of the theft, in which case the black market value is the same as the used value).

* For both physical and digital goods, there are millions of potential customers for whom breaking the law isn't an option, creating a large market for the legal good that can serve to counter the effect of the black market price. This isn't true of exploits, where the legal market is tiny relative to the black market. We should expect to see the legal market prices track the black market prices more closely when the legal market is basically "the company who built the service and maybe a few other agencies".

nitwit005• 1 year ago

Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced.

They're buying exclusive access to some information, which is a somewhat unusual thing to pay for.

News reporters do take spicy stories to tabloids, rather than the normal press, as the tabloids will pay more.

tptacek33• 1 year ago

I think the right comparison to make here is art. The compensation floor is zero, and, in fact, that's what most vuln research pays.

hammock• 1 year ago

Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced.

What you’re saying can be seen as tautological. The reason a gray/black market exists is precisely because the field is undercompensating (aka in disequilibrium)

Uptrenda• 1 year ago

Yep, I came to the same conclusion. The payments from bug bounties and the uncertainty of payment just isn't worth it. It's like taking a fixed prize contract and adding in a gambling element to get paid. Fixed prized I learned was bad enough if you want to make anything as a software engineer. This is even worse though.

I mean, the technical skills in the article here are basic. But the first finding was significantly good luck, and having the background to know to look towards old Google services for the ID to email part was non-obvious. You would need a lot of high-quality, guiding knowledge like that to make bug bounties work. Still, seems like a very high starting cost.

kccqzy4• 1 year ago

I hate how this HN thread is mostly about discussing the amount of bounty, but I'm afraid it's only natural. Most commenters here are working in the software industry and they want to normalize extremely high bounties. It's an extra income source for them. They want higher bug bounties much like they want SWEs to be a highly compensated profession. It's only natural for workers to demand higher pay for their own profession. No amount of rationalization will change that instinct.

iinnPP5• 1 year ago

It isn't always about money, even when that is the stated problem.

The dollar value of a responsible report going up means more responsibility overall and less problem leaks, exploits, etc.

I would be equally happy to see any solution where the end result is increased security and privacy for everyone, even at zero bounty.

The problem being overlooked is that the actual cost of these exploits and bugs is paid by the people who had no say whatsoever in any matter regarding the issue. Any time a company is being "cheap" at the expense of regular people is a bad time, from my perspective.

Google has the power to limit the exposure of the people who use there products (and this isn't always voluntary exposure mind you) and is choosing to profit a teeny tiny bit more instead. At no immediately obvious cost to them, why not?

rectang• 1 year ago

When bug bounties are priced low, it also irks those among us who care about security — for the sake of the organizations we work for, for the sake of our end users, and for the sake of the world at large.

aqueueaqueue6• 1 year ago

SWE comp is weird in that typically it is zero (see what's on Github!) often it us middle class and sometimes it is small scale CEO (as in the actual job not a founder) level.

I guess bounties fit into the framework somewhere between the Github and middle class engineer.

I think it comes down to supply and demand. It also shows you what Google would pay employees if things were in their favour. On unrelated news, a tech billionaire is almost defacto VP of the US.

mlyle16• 1 year ago

I'm not a SWE anymore and haven't been one for a long time.

I think it's in everyone's interest for bug bounties to be higher than harmful markets for the same bug, and a decent fraction of the harms they prevent. That's what is going to result in the economically efficient amount of bug hunting. And it's going to result in a safer world with less cybercrime.

Cpoll3• 1 year ago

because $10,000 feels extraordinarily high for a server-side web bug.

Am I misunderstanding the bug? In my reading, this bug translates to "a list of the top 1,000 Youtube accounts' email addresses (or as many as you can get until Google detects it and shuts it down)." Why isn't that conceivably worth more than $10,000?

sbarre2• 1 year ago

Perhaps because email addresses are kinda/sorta PII (business emails are categorically not) but not quite comparable to home addresses, tax/payment information, etc..

Our emails get leaked all the time in data breaches, sometimes alongside much more important information such as home addresses etc..

This was certainly a bad leak that could be used to further dox people by connecting the email to other leaked info or other sources, but from Google's perspective, all they did was leak the email.

It was a privacy breach for sure.

But further doxxing based on the email would be "not their problem" I suspect they would say.

reaperducer• 1 year ago

Why isn't that conceivably worth more than $10,000?

As explained by the parent comment, because there isn't a market for it. It's a novelty. Who are you going to sell that exploit to? At this time, nobody. Since Google doesn't have to compete against others for the bug, it pays low.

alt2273• 1 year ago

Why isn't that conceivably worth more than $10,000?

If it exposed passwords as well then that would be worth a lot more, but a list of email addresses is not the most valuable of things on its own.

sushid4• 1 year ago

I think a simple way to think of it is: how much would an adversarial nation state buy this exploit for?

I just don't think Russia would be willing to pay $100,000 to get Mr. Beast's email address, even if that sounds tempting to you.

ldoughty2• 1 year ago

Oh darn, my youtube email was leaked... It certainly stinks that mybusinessname@gmail.com is now known to the world...

There's certainly bad things that CAN be done to a number of people with information when it's a personal email address that's used for numerous purposes... but the 3 people I talked to about having youtube (or any streaming) accounts all have mentioned it as being a separate account.

So the only threat I can see in most cases is just better phishing attempts, which is not necessarily an easy money maker... Unless they can steal the entire account? It is impossible to get support from Google, so it's quite possible you could change the bank info and get a month or two of payments before someone gets in the loop to stop it... and realistically, the more money someone is making on YouTube, the less likely they have troubles contacting someone at Google by some side channel... and the less likely it's a personal email address that reaches the actual star of the channel.. so the more popular the person, the less valuable the email address

fy20• 1 year ago

The majority of the top 1000 YouTube accounts will actually have an email address publicly available, as they are a business and they want people to be able to reach out to them for sponsorships or brand collaborations.

For example, MrBeast has this in the video description:

For any questions or inquiries regarding this video, please reach out to chucky@mrbeastbusiness.com

The vulnerability here is that you can find the exact email address tied to their YouTube account, which you can't really do anything with if they have strong passwords and use 2FA.

maxed• 1 year ago

It does not make sense to value these kind of (web) bugs by their potential price on the grey market. I think its better to value these bugs by their potential impact, although that is hard to express in money.

In this case there were 4 billion email addresses on the line from being scraped, imagine if this was exploited and the data was leaked. The news would hit the headliners which would definitely be bad for Google's reputation and stock price.

However, the impact of the leak is not that high as it only consists of a channel <> email address mapping, and therefore I think 10k is a fair price

harwoodr• 1 year ago

It sounds like a standard threat-risk assessment applies.

How big of a threat is it/what impact will it have on business/reputation/etc.?

How likely is it to be exploited and how widely would it be considered useful to the market of threat actors?

idiotsecant• 1 year ago

If the value of the bug payout is equal to the grey market payout, why would I ever sell it to Google? I could sell it on the grey market and not pay taxes on the sale, or worry about cumbersome reporting requirements. Google plays a dangerous game with this logic.

dadrian• 1 year ago

I'd also add that the legality of law enforcement exploiting a server-side bug is much more of a gray area (or actually illegal), whereas there is a standard process for law enforcement or the intelligence community to get a court order that enables them to exploit devices that belong to a specific target (phone, laptop, etc).

tptacek33• 1 year ago

There's also the thing where like, as you go from iOS Safari to Windows Chrome to Acrobat Reader or whatever, grey market prices plummet. The top-dollar targets all have multilayered runtime protections and whole teams that do nothing but security refactoring. No serverside software is hardened that way (excepting the Linux kernel, maybe, but Linux kernel bugs are a standard component of clientside exploit chains). You could infer a pretty low price.

I will say: at Matasano, we were once asked by an established security company that turned out to be a broker to find PHPBB vulnerabilities.

gxs• 1 year ago

The fact that the amounts in apple's bounty program can range from 5k-500k for a single category tells me that the answer is it depends.

It's most likely not just a comparison to black market prices or how many lines of code it'd take to patch.

https://security.apple.com/bounty/categories/

newsclues• 1 year ago

What’s the value of the mailing list with every YouTube users email address ?

kazinator2• 1 year ago

The discoverer had these choices:

- monetize the bug themselves; i.e. set up a site where you can submit a YouTube user id, pay some fee using your credit card and get an e-mail address.

- report that they have the ability to convert any YouTube id to an e-mail, with proof: then negotiate over compensation for the disclosure of the details

- just report the problem and be happy with whatever they get.

Ten grand doesn't look too bad for the most timid choice.

nightpool2• 1 year ago

Do any companies pay bounties for path #2? My understanding is that it's forbidden by most bounty programs since it could be seen as a form of extortion.

For #1, as tptacek says, it would be trivially easy for Google to shut a service like that down as soon as it was created, and prosecute the people running the service under the CFAA. Also, the amount of demand for that kind of data is pretty small given the number of email address databases already available online through legal means (e.g. Zoominfo, RocketReach, etc). It's a path filled with a lot of risk and not a ton of reward.

benmmurphy• 1 year ago

There is kind of a market for server side vulnerabilities but I'm not sure if you would call it grey. I suspect ZDI will purchase commodity server side vulnerabilities (https://www.zerodayinitiative.com/). So stuff like apache, nginx, and maybe opensource webapps that have a narrower usage.

tptacek33• 1 year ago

ZDI claims they'll pay for bugs in serverside software, which is a different meaning of the term "serverside" than I'm using (admittedly, that definition is more precise). An nginx bug has a half-life once discovered. A Youtube bug does not.

I'm a little skeptical of published prices for serverside software, though. Do you know anyone who specializes in selling those bugs? I don't.

KennyBlanken• 1 year ago

that has effectively no half-life once discovered

Google knew about this already, and hadn't done anything to fix it...and when it was reported, they didn't fully understand it and were dismissive, until the author came back at them again.

Unmasking Google accounts? Could there be a business there? Sure, maybe

I'm pretty sure there are a _lot_ of youtube channels that private and public entities would love to uncover the identity of, and I would say that it's very unlikely these guys were the first to piece all this together.

The main takeaway for me is how incompetent Googlers seem to be, both in the basic "web application 101" mistakes made (not properly validating/restricting fields) and the clearly rushed evaluation of the security report. Such a report should trigger some folks going "oh, that's not good. I wonder what else is broken about this." Not "meh, not significant, quick patch, fixed."

Nobody at Google wants to work on stuff that isn't going to get them up a rung on the ladder.

EGreg• 1 year ago

If you think Google had underpaid for this, imagine how much they got to underpay for this:

https://www.theverge.com/2016/1/29/10868404/google-reveals-h...

That guy is ridiculous! Could have made $50 million or more probably, if he had used a different registrar than Google itself.

He mentioned that Microsoft also let their domain lapse and that one was actually going to the open market... and what's more, they didn't even care when he contacted them! Oof:

https://www.theregister.com/2003/11/06/microsoft_forgets_to_...

Here are a few other doozies:

Apple forgot to renew their certificate for the entire Mac App Store, and didn't care much:

2014: https://www.macrumors.com/2014/05/25/apple-software-update-i...

if that wasn't bad enough... they did it again in 2015:

https://osxdaily.com/2015/11/12/fix-app-is-damaged-cant-be-o...

and almost in 2016:

https://apple.stackexchange.com/a/227787/75628

zeroq• 1 year ago

On top of that I always felt that this is generally aimed towards hobbyist who may accidently stumble on something to give them additional incentive to finish the job and make an actually summary and repro, rather than hollywood hackers.

Sure the gray market will pay more, but how do you contact criminals and make sure that you actually receive payment?

I know nothing about the market, but I think it's similar to buying drugs - we all know that drugs are everywhere and criminals are making a ton of money out of it, but if you haven't been introduced before how do you actually buy them? Go to a club and start asking random people?

(that last part might be different in US, but in EU we don't have people standing on every corner selling cookies)

midtake• 1 year ago

Disagree. 10k seems low considering the value to those who ship OSINT services this would have had. Such services get data from very interesting places.

I also wouldn't call it just a server-side web bug, it's more like data exfiltration. TFA author could have sold it for more money to some gray market dudes if he were willing to accept bitcoin.

arajnoha• 1 year ago

haha the title sounds like you are a blackhat, offering emails for 10k

mschoch• 1 year ago

google insiders will leak for considerably less, no exploit needed

zoklet-enjoyer2• 1 year ago

Pixel Recorder is an "old forgotten product"? I have used it at least once a week for years. I used it a bunch yesterday. Very good app. I hope Google doesn't kill it.

yieldcrv2• 1 year ago

On one hand I doing really see the hack here. They didn’t get access to any email address, just a potential privacy leak

On the other hand, a spearfishing campaign could be valuable. And launch a memecoin on some people’s account to make millions

donatj• 1 year ago

After reading the article top to bottom I still had to come to the comments to find out what the "for $10,000" was about. It's the payout for a bug bounty.

binarysneaker• 1 year ago

Same. Oddly worded title.

ggregoire• 1 year ago

Bottom of the article:

Timeline
05/11/24 - Panel awards $3,133.
12/12/24 - Panel awards an additional $7,500.

progforlyfe• 1 year ago

Wow, until the very last paragraph for some reason I was thinking that it COST $10,000 to leak the email of any YouTube user, like either a black market cost or purchasing cloud resources =) -- Very nice exploit though!

riffic2• 1 year ago

the date formats in the Timeline section trigger me for some reason.

renewiltord• 1 year ago

Everyone on HN has this addiction to “vulnerability” like it’s some grand thing and then concocts complicated “it could be worth millions; you then use it to find out their Swiss bank account number; and they watch the money go down as you drain it!”

It feels like most software sites are now populated by people who think software is like in the movies.

ta988• 1 year ago

147 days to fix that is just ridiculously long.This really shows the inefficiency of the whole google engineering layercake.

vetrom• 1 year ago

I see a lot of noise made about responsible disclosure, its drivers, and its rewards. What I don't see is talk about how this is one more datapoint against centralized permanent identities.

Every time I see a service purporting that it works best only with a single link to your Real Identity™, I'm reminded that the vendors only abstractly care about actually protecting the user, and then only sometimes.

Imagine being able get immediately three or four steps closer to doxing anyone interacting on YouTube. That's the actual impact of this bug IMO. It's good that this was fixed, but I don't think this class of bug goes away anytime soon. What do we need to do to get vendors and big companies to realize that this sort of design is landmines waiting to happen?

vineyardmike2• 1 year ago

Every time I see a service purporting that it works best only with a single link to your Real Identity™, I'm reminded that the vendors only abstractly care about actually protecting the user, and then only sometimes.

I abstractly agree with you. There is a level of obscurity and disposability that should be tolerated in these accounts. They’re just a row in a database somewhere anyways.

That said, many people transact with these businesses with real human money. For example, YouTube premium subscribers or content creators. From a practical perspective, that requires IRL identifiers to be stored somewhere with that otherwise disposable account. And due to fraud risks and other realities of banking, that requires giving these businesses actual identities and addresses which they store too.

While I don’t give random apps and websites my human-identifying information, anyone I do business with necessarily knows the real me, which is a theoretical point of data leaking.

patrick451• 1 year ago

This is a fixable problem if we can get congress to roll back the insane KYC laws.

autoexec• 1 year ago

While I don’t give random apps and websites my human-identifying information, anyone I do business with necessarily knows the real me, which is a theoretical point of data leaking.

Certainly not theoretical. You can be certain that nearly every company who knows your identity has leaked/sold it to others in one fashion or another.

chii• 1 year ago

They don't care because there's no legal consequence for them.

Try and leak some medical data as a medical services provider. You will get your ass handed to you.

byearthithatius• 1 year ago

He could have made WAY more money not disclosing this and that should scare any Google employee reading this

zhobbs• 1 year ago

Curious if anyone knows, what legality of using a technique like this? I assume illegal, even though it's just making publicly available API calls?

theogravity• 1 year ago

What can one do with a Gaia ID? I don't think the article went into the impact of having it.

badosu2• 1 year ago

Use it on the block user api and get an email address from what I understood.

aqueueaqueue6• 1 year ago

But what else could definitely or potentially be done? It is an interesting question.

badosu2• 1 year ago

After reading it a bit further, they searched for a service that exposed email via Gaia ID, and found it via Pixel Recorder.

areyourllySorry• 1 year ago

get google maps reviews and search web archive for google plus and profiles.google.com snapshots

Sam6late• 1 year ago

Long time ago I discovered a similar google error, accessing youtube got me in other people accounts. I mean just going to a youtube will show me signed in into another user's account. It turned out there was a caching/database issue, and the isp/googlr mingled accounts. Here is the old report:"The issue has been replicated by the editorial teams of both itp.net and Windows Arabic magazine. In testing, the user profiles that were visible were for users that had logged into YouTube only a few hours previously, suggesting that the pages have been cached by either Google or Etisalat’s own servers, and were somehow being accessed in error through the cache.

Neither Google nor Etisalat have responded to request for comment at the time of writing.

The issue appears to be very similar to a problem which was reported by users of Kuwaiti ISP FASTtelco , who said that they were able to see other users Gmail accounts and other personal details, although this was later denied by the ISP'

AutistiCoder• 1 year ago

what if the target has their e-mail set to private?

ProllyInfamous• 1 year ago

I discovered my favorite PI via a geographic subreddit, over a decade ago. The amount of information this retired peace officer procures is always incredibly useful (e.g. litigation, applicant screening).

$100.00 is enough to cause most to blush.

augbog• 1 year ago

Excellent find and breakdown of the process

einpoklum• 1 year ago

It helps not to have a YouTube account. Less tracking - by Google, by its partners, and by its exploiters.

(Of course, they can still apply more computational work and possibly identify you without you logging in.)

rkagerer2• 1 year ago

I found this title confusing. For those who didn't make it toward the end of the article: the leaked emails didn't cost them anything (except their time and ingenuity), and they received 10k as the bug bounty.

sedatk• 1 year ago

I thought they meant providing the services to leak the email of any user for $10K, perhaps per user. :)

adrianmonk• 1 year ago

I thought they meant it cost $10K of compute time to brute force some process that would reveal one email address.

raffraffraff2• 1 year ago

That's what I thought too because that's exactly how it's phrased! Terrible wording.

cassepipe• 1 year ago

I think this was the clickbaity intention behind the title

DecentShoes• 1 year ago

Yeah, I thought it was going to be about compute cost for brute forcing some hash or something

tomsmeding• 1 year ago

The domain name kind of suggests this interpretation, too.

stevage• 1 year ago

Me too.

I thought it meant they were offering this as a service for $10k.

willtemperley• 1 year ago

I think this was the joke.

mahmoud111• 1 year ago

Me too.

I thought it meant they were offering this as a service for $10k.

nickvec• 1 year ago

Could be a clickbait sort of title.

SZJX2• 1 year ago

From the D/M/Y date format at the end of the article, they may not be native English speakers (at least they aren’t American).

turbonaut• 1 year ago

England is just one example of a country of native English speakers who use dd/mm/yyyy.

defrost• 1 year ago

The USofA is the bizarre exception here:

  The United States has a rather unique way of writing the date that is imitated in very few other countries (although Canada and Belize do also use the form). In America, the date is formally written in month/day/year form.

They don't use metric, still use First Past the Post voting, elect a mini monarch with effectively unchecked powers, ... it's an odd place.

nixass• 1 year ago

And?

mikeyinternews• 1 year ago

The title should have been something like, "Revealing the email address"...

cubeflake2• 1 year ago

Thank you, I think the title is misleading and your comment clears up the confusion.

swyx2• 1 year ago

i'd really like a way to email a youtube channel owner though. even if sits in a youtube inbox for a year. most of them don't have email contacts and its hard to reach out for sponsorship or any other deals.

williamscales• 1 year ago

A long long time ago...in an internet far away...

YouTube used to have DMs so you could do this. I don't remember exactly when it was removed. Probably late aughts.

nashashmi• 1 year ago

Does google still do those security vulnerability reveal if the thing has not been fixed in 90 days? This was dixed in 147 days.

jwpapi• 1 year ago

One commenter already clarified how bounty amount is related to black market value. Now a lot of others might seem how Google doesn’t value security enough. (Or other companies).

But one has to understand that for security purposes they SHOULD pay as little as possible. If they pay out more there is more incentive in finding bugs and then there unfortunately you’ll also raise more black market.

So GTO strat is to just cut off black market with as little money as possible.

ouraf• 1 year ago

Nice catch! And finding a vulnerability on such a high profile service will look very nice on the resume.

Congrats!

zombiwoof• 1 year ago

Click bait title to an otherwise interesting story

vednig• 1 year ago

A little Update on the video, seems to be disabled by YouTube ToS

opello• 1 year ago

Looks like the Internet Archive has saved us once again:

https://web.archive.org/web/0id_/http://wayback-fakeurl.arch...

hnburnsy2• 1 year ago

From the article...

  15/09/24 - Report sent to vendor
  ...
  29/01/25 - Vendor requests extension for disclosure to 12/02/2025
  09/02/25 - Confirm to vendor that both parts of the exploit have been fixed (T+147 days since disclosure)
  12/02/25 - Report disclosed

So that is 136 days not fixed(?) and Google asks for extension. Then 147 days to fix and 150 days to public disclosure.

Compare this to Google Project Zero which gives other companies the following time to fix before disclosure...

"This bug is subject to a 90 day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline."
If the patch is expected to arrive within 14 days of the deadline expiring, then Project Zero may offer an extension...Note however, that the 14-day grace period overlaps with the 30-day patch uptake window, such that any vulnerability fixed within the grace period will still be publicly disclosed on day 120 at the latest (30 days after the original 90-day deadline).
If we don't think a fix will be ready within 14 days, then we will use the original 90-day deadline as the time of disclosure. That means we grant a 14-day grace extension only when there's a commitment by the developer to ship a fix within the 14-day grace period.

https://googleprojectzero.blogspot.com/p/vulnerability-discl...

whymarrh• 1 year ago

I don't think this is a useful comparison. This is Google's bug with Google's software vs. Project Zero's discoveries are (as I understand them) typically in software used by multiple people and thus there's a higher urgency to fix them.

hnburnsy2• 1 year ago

Its not apples to apples but i think it shows Google's hypocrisy.

deviation• 1 year ago

Cool attack chain.

Regarding the payout-- I'm curious if targeting (in the disclosure video) a CEO/C-Suite exec @ Google would have encouraged a higher amount from the panel.

nativeit• 1 year ago

Here's a POC of the exploit in action: This video has been removed for violating YouTube's Terms of Service

That's hilarious.

SZJX2• 1 year ago

Weird that it shows that to me at first as well, but now when I opened the article again, the video seems to be available? Not sure if it was restored just now.

voytec3• 1 year ago

Maybe just not yet wiped from all CDN caches.

aydgn• 1 year ago

OP actually shared an actual existing user’s email address to prove the concept. In the reuploaded video, the email address is blurred.

alfredosa• 1 year ago

That's impressive

tomjen3• 1 year ago

It took 157 days to resolve per the timeline in the article.

That seems extremely long for an organisation as technically competent as google.

XCSme• 1 year ago

It's quite clever how the email notification was disabled (setting the email subject length to 2.5million characters, so the email delivery itself would fail).

vachina• 1 year ago

Right? You’d think at Google’s scale they’d sanitize every single user inputs, like truncate the string and suffix it with “…” instead of the mail delivery throwing an exception.

DidYaWipe• 1 year ago

Repeatedly refers to "Gaia ID" but never says what that is.

thomasvn• 1 year ago

Misleading title - the $10k is the bug bounty reward.

Still, impressive writeup. Shows how chaining a few reverse engineered endpoints can generate created a significant exploit.

Leaking the email of any YouTube user for $10k

Related Stories