[HN Gopher] I have gained admin access to numerous GCloud Organi...
___________________________________________________________________
I have gained admin access to numerous GCloud Organizations by
accident
in Google Cloud, you can assign admin, billing, etc to a google
group. Years ago I made a google group for google cloud
administration A company in Spain, a bunch of startups, etc have
added that google group (by accident) as an IAM user with varying
level of roles attached I now have billing access to one account,
admin access to another, can just hop into the database of at least
two of the accounts I try to reach out to google support but
because I don't have "business" or "enterprise" level support I
can't even submit a ticket I'm trying to let them know but can't,
they do t do chat, no phone number, even billing contact is an
automated chatbot only GCloud should have like "emergency reach
out to a person" link or something
Author : anon223345
Score : 214 points
Date : 2023-05-30 13:06 UTC (9 hours ago)
| elzbardico wrote:
| Even if you manage to reach out to Google, I doubt they will do
| anything like remove your group from those roles. From their POV
| you could be just trying to social engineer them into removing
| someone who has legitimate access.
|
| I think you have better chances contacting people in the org who
| added your group to those roles.
| nocommandline wrote:
| Google shouldn't automatically remove you but
|
| 1. They should contact the firms involved, make them aware of
| the situation and then the firms will take a decision on
| whether to remove or not.
|
| 2. They should then look over GCP design and see if there's
| something that they can do to prevent a reoccurrence of this
| type of error/mistake
| ethbr0 wrote:
| I have a similar-but-different problem: a commonly used Gmail
| address that apparently someone(s) not me was using out in
| the wild for serious business.
|
| Among other things, I received: Interview
| requests for jobs to which I never applied A background
| screening for a FL sheriff's job Legal communications
| for buying a home Business relationship emails
| Account and subscriptions for a variety of services
|
| Relevant point being -- every single one of these
| counterparties had no idea what to do with me responding "I
| am not the person who you've been talking with about this.
| They appear to be using my email. Please ask them to update
| their email."
|
| It made me realize how shitty most people are at dealing with
| anything other than business-as-usual.
| nightpool wrote:
| Agreed. I know Google is famously hard to get in touch with,
| but I don't understand how this fall on Google's plate or is
| really Google's fault at all. Maybe if they shared some more
| info about what IAM group they created that managed to trick
| people into adding it Google could create rules to ban group
| names like that from being created?
| kadoban wrote:
| It's Google's fault because there's no "remove me from having
| access to this" button.
| hackernewds wrote:
| if one is conscientious enough to report themselves be
| removed, they could also simply ignore the access
| kadoban wrote:
| There's liability in having access to some random crap,
| even if you don't intentionally use it.
|
| If something goes wrong, someone accesses or modifies
| something that they shouldn't have, you having access is
| going to be at _best_ confusing to everyone. At worst the
| cops or lawyers will come calling. Sure you'll _probably_
| be able to talk them down, but does that sound like fun?
|
| Or what if someone breaks in to _your_ account and
| accesses that way? Untangling that mess will not be a
| good time.
| yolo3000 wrote:
| I think you can reach them on their forum as well, for example
| https://www.googlecloudcommunity.com/gc/Security/Welcome-to-....
| tedivm wrote:
| Most of those "community" forums are not monitored by actual
| staff. Google uses "communities" as a way to get free tier one
| support out of the community, and to save even more money they
| just never bothered with any tiers beyond that.
| throwawayadvsec wrote:
| if you have access to the DB, create a collection/table with a
| warning/contact info
| gooob wrote:
| that is hilarious
| crazygringo wrote:
| As other commenters here have noted, a company can't just do this
| accidentally. If they add an _external_ group, there 's a warning
| message. Because many times it may be a mistake, but there are
| _also_ many times a company will have a legitimate reason to do
| so.
|
| This isn't a bug, it's a feature. If you want to do the right
| thing, the correct course of action isn't to notify Google, it's
| to send an e-mail to the companies so they can revoke access to
| the group. It's not Google's problem.
|
| Or if you don't want to deal with that and the group isn't used
| for anything anymore and you still want to be a good citizen,
| just delete everybody else from the group.
| anon223345 wrote:
| I'm just going to delete the group
| anonymouskimmer wrote:
| Bad idea. You're a good person, the next person to create the
| group name (which you've helpfully published here) may not
| be.
| breakingrules wrote:
| [dead]
| IYasha wrote:
| for g in * do wget g; done;
| IYasha wrote:
| Ok, ok, I see people downvoting this, so I'm correcting myself:
|
| for g in * do wget --recursive "g"; done;
| andrewstuart wrote:
| Maybe you could get thousands of dollars big bounty!
| pirsquare wrote:
| As usual, the expected Google Clown Platform support.
|
| FWIW, 3 months ago they shutdown my servers for some minor issue
| and I'm only able to get them to reactivate after a week.
|
| Source: https://news.ycombinator.com/item?id=35133917
| nopoint wrote:
| At my previous job i brought credentials leakage to higher ups
| attention but it went unfixed for a year. Nothing to gain Other
| than wasting our time.
| AtNightWeCode wrote:
| Surely there should be a way for an owner of a group to revoke
| these permissions. I am not familiar with the tech though.
|
| If it is not too much hassle I would create a new group, switch
| to it and delete the old one. This is just one of many reasons
| corps add prefixes to their naming conventions in the cloud.
|
| I would not go down the path of contacting the companies. You
| have to see it from their point of view when it comes to security
| and legal processes. Just because you know that you have not done
| anything wrong does not mean anything for how they will proceed.
| They will start from the objectives. Somebody has access to our
| stuff.
| tazjin wrote:
| Ex-Googler here. Try reporting it through the security disclosure
| program: https://www.google.com/appserve/security-bugs/m2/new
|
| You can also assume that by virtue of you having posted this here
| and being on the frontpage, it's probably made it to the internal
| Google SRE IRC chat by now and someone is trying to find a
| contact. This almost always works :)
|
| Maybe edit your OP with a way to contact _you_ , so that someone
| can reach out.
| OJFord wrote:
| This isn't a _Google_ security incident though, they could fix
| it, but it 's not obvious they should/would care to me?
|
| It's the third-party's security team (if there is one,
| otherwise engineering, contractor hirer, whoever) that should
| care isn't it?
| tazjin wrote:
| Yes, but the way that would work is that somehow this should
| bubble through the security org to someone in Cloud Sales,
| who can then look in Salesforce who the relevant internal
| sales contacts (i.e. the people from Google that the affected
| company is in touch with) are and reach out to them.
| koolba wrote:
| > You can also assume that by virtue of you having posted this
| here and being on the frontpage, it's probably made it to the
| internal Google SRE IRC chat by now and someone is trying to
| find a contact.
|
| In that case no point in following up at all right? Just post
| on HN and hope someone in the right spot sees it?
|
| > This almost always works :)
|
| That's the type of SLA one can rely on!
|
| > Maybe edit your OP with a way to contact you, so that someone
| can reach out.
|
| Having to break online anonymity so that a company can impose
| the Hollywood rule, "don't call us, we'll call you!", is a
| truly lousy support structure.
| anon223345 wrote:
| It seems they actually responded to the bug bounty request, I
| put the response up above
| geraldwhen wrote:
| Apples anonymous emails may work for this purpose.
| kwhitefoot wrote:
| Or Firefox Relay.
| fnimick wrote:
| > Just post on HN and hope someone in the right spot sees it?
|
| That's how a lot of Google tech support happens. If you get
| banned by mistake, you have far better luck making noise here
| or on Twitter vs actually going through support.
|
| We had an app mistakenly banned that we only got human eyes
| on by calling in favors from old friends who work at Google.
| It's asinine.
| 8organicbits wrote:
| > by virtue of you having posted this here
|
| But it's not even the first time this issue was posted here.
| I'm not sure that approach works with Google.
|
| https://news.ycombinator.com/item?id=34193047
| tazjin wrote:
| It's a dice roll, if someone in a timezone where people are
| working while this post is trending sees it, finds it
| interesting, _and_ can be bothered to post about it somewhere
| internally - it can help!
|
| Of course, it would be better if there was an actually
| supported channel for sending this kind of information, but
| that's really not the fault of the people that end up finding
| this stuff and posting it internally (who are often not even
| related to the problem, posting more of a "hey, anyone know
| anyone who can help this guy?" message).
|
| FWIW, the security disclosure form I posted will end up
| reaching a human, which is why I suggested doing that
| anyways.
| anon223345 wrote:
| I'll try that I suppose, it sounds like I'm going to have
| to delete that google group which is going to be a pain
| because I actually use it...
|
| I did file a bug bounty hopefully that goes somewhere
| intelVISA wrote:
| Internal SRE IRC? Too good for the laggy Slack/Teams/etc.
| CVEware??
|
| I'd be jealous, but then I realized it prob has good uptime
| whereas using Slack is like a free day off every month with its
| SLA.
| omoikane wrote:
| https://xkcd.com/1782/
| rollcat wrote:
| Long time ago, many jobs ago, the whole company was on Skype.
| We (the ops team) just set up an IRC server on one of the
| boxes.
|
| (The box was also useful for a lot of other things, like an
| Openarena server. We tend to play StarCraft 2 these days
| though.)
| tazjin wrote:
| Yes, SRE doesn't wanna deal with all that crapware. Though as
| I was leaving, a lot of people were moving over to an IRC
| bridge to the (absolutely horrible, in my opinion) Google
| Chat.
| anon223345 wrote:
| Thank you will try that...
| SillyUsername wrote:
| Google already know about this one, fat lot of good it's done
| for the last 12 years:
| https://issuetracker.google.com/issues/35889152
|
| Person abandons old account attached to a group/project,
| account then hacked, et voila!
|
| It's also probably in breach of GDPR regs that say you should
| be able to update your own information if it's incorrect.
| anon223345 wrote:
| I filed a bug bounty! If this is working as expected then so be
| it...
|
| I didn't even know this hit front page till you said something
|
| I'm just gonna leave the other orgs alone and not doing
| anything in there until I can figure out a strategy to delete
| this google group (which I am actually using to manage my own
| accounts) my accounts are just hobby accounts more than
| anything, it's crazy I logged in and found these full-blown
| business accounts lol
|
| Just insane to me that I don't have to confirm on my end that I
| should be the admin, or billing role lol, they can just one way
| add you...
|
| I think they meant to add their service account and instead
| added my google group, the URLs are kind of similar
| mnadkvlb wrote:
| I recently helped someone with google cloud web applications.
| They got a weird bug where the deployment with new code would
| just give old deployment logs. Turned out the account was
| somehow shadowbanned for a day or so to deploy anymore. The
| next day the logs pointed to a code checkin from previous day.
|
| Eventually i got super fristrated and made a fresh azure trial
| account for them and boom everything works.
|
| I cannot understand how gcp is so bad at ux and support. Most
| of the engineers i know at google are the absolute smartest
| people i know, how in the heck can it be the product experience
| at gcp is so lousy.
| wheaties wrote:
| You are prompted to confirm an external group being added as
| admin. Someone purposefully ignored it.
|
| Good luck. You're trying to do the right thing but if they lawyer
| you, remind them they added you not you added them.
| Hamuko wrote:
| Ask them to increase "your" GPU quota by 100x. That should surely
| be enough of a red flag.
| [deleted]
| anon223345 wrote:
| Update #2 - they actually responded to my bug bounty request.
| Seems they think it may be worth fixing but not a big enough deal
| to pay out a bounty to me. Obviously I'd like the bounty but if I
| got any recognition that would be awesome
|
| --- Hi,
|
| Thanks again for your report.
|
| I've filed a bug with the responsible product team based on your
| report. The product team will evaluate your report and decide if
| a fix is required. We'll let you know if the issue was fixed.
|
| Regarding our Vulnerability Reward Program: At first glance, it
| seems this issue is not severe enough to qualify for a reward.
| However, the VRP panel will take a closer look at the issue at
| their next meeting. We'll update you once we've come to a
| decision.
|
| If you don't hear back from us in 2-3 weeks or have additional
| information, let us know!
|
| Regards, Google Security Team
| kevingmccall wrote:
| You have my respect!
| LinuxBender wrote:
| As an admin of their group can you see their group admin contact
| email address? If so maybe they have an enterprise account and
| can reach a human in Google. I am not a lawyer but there is
| probably risk in accessing any of their data, audit trails and
| all.
| anon223345 wrote:
| Ya I'm not doing anything, I saw these random orgs on my
| console and just clicked and it took me to those pages
|
| Didn't poke around, was more like what the heck is this?
|
| I only noticed because I logged in and the page defaulted to
| Spanish (it picked the first org, which happens to be a Spanish
| car company)
|
| Then I noticed in the drop downs. I actually thought I was
| hacked, then realized what was going on.
|
| Still trying to find a way to get ahold of Google lol
| LinuxBender wrote:
| I have no idea if this [1] is still valid but it has a number
| that might work. Perhaps tell them you may have experienced a
| security incident related to a Google UI/UX bug. Another
| approach could be reaching out to their Project Zero team.
| [2] or try some of the contacts here [3] and tell them you
| may have a security incident that has enabled access to other
| organizations.
|
| [1] - https://www.businessinsider.com/guides/tech/how-to-
| contact-g...
|
| [2] - https://googleprojectzero.blogspot.com/
|
| [3] - https://about.google/contact-google/
| anon223345 wrote:
| UPDATE: I have just submitted a bug bounty request
|
| That would really help my career and life if I get that!
|
| I won't do anything with the accounts I accidentally have access
| to
| mikyd1954 wrote:
| Not sure what support could do for you that you could not do
| yourself, ie: undertake to degrade the 'years ago group' and
| alert responders as needed.
| anon223345 wrote:
| Good call, the problem is I use the group for my own
| projects...
|
| I will painstakingly change that to not use groups and then
| delete the group if it lets me
|
| It's just kinda stupid people are allowed to just add my group
| with my group not even confirming
| 0xbadcafebee wrote:
| GCloud security is horrible. It's like they designed the whole
| thing to be insecure by default. Coming from AWS, the amount of
| permissions they give by default in the most commonly-used roles
| is insane. They also seem to lack some functionality necessary to
| make fine-grained access permissions to access some of their
| advertised features. It's really crazy.
| secondcoming wrote:
| Be very careful. Even though you're trying to do The Right Thing
| don't alert these companies to the fact you've been accessing
| their accounts without permission.
| ghusto wrote:
| I'm seeing a lot of these kinds of comments, and think this
| might just be an American worry (because it's such a litigious
| place)?
|
| People in the Netherlands and England where I also lived for a
| short while, are pretty chill with these kinds of things. I
| can't imagine them doing anything other than thanking you
| profusely.
|
| I mention this because I'd rather this kind of attitude wasn't
| imported to Europe.
| yesco wrote:
| I was under the impression that the key concern here is being
| criminally prosecuted, not sued. Even if they obviously
| didn't do this on purpose, depending on how they communicate
| it to the companies involved, the worse case scenario is that
| it could be perceived as some kind of phishing attack /
| fakeout done with malicious intent. Even if they could prove
| their innocence, no one wants to deal with something scary
| like that in court.
|
| While I'm not familiar with the nuances of each European
| nation's computer fraud laws regarding this, I can't imagine
| this would be any different there. Especially as
| Cybersecurity becomes an increasingly international concern.
| laweijfmvo wrote:
| For me it's a Google worry. I'd be terrified they'd delete my
| Google (Gmail) account with no way to recover.
| michaelt wrote:
| _> People in the Netherlands and England where I also lived
| for a short while, are pretty chill with these kinds of
| things._
|
| Imagine that, at 5pm on Friday, you discover your IT system
| has been the target of a huge hack, possibly by russians or
| north koreans, that they got access to everything, it's been
| going on for months, and it's certainly a notifiable breach
| under GDPR.
|
| Would you be chill?
|
| I can say from experience, many people call the cops and
| lawyers first, and only find the support ticket that first-
| level support fobbed off with a canned response much later.
| secondcoming wrote:
| I'm not American and live in the UK.
|
| Lawyers aren't chill about anything, and it could be
| financially ruinous to try find out.
| darkwater wrote:
| Just to better understand, was it a "generic enough" Google Group
| name that people used its name in the policy thinking they were
| granting access to their own "google cloud administrators"? Or
| were people/companies actively part of that Google Group you
| created?
| anon223345 wrote:
| Yes exactly, it's a group with just a generic name I made many
| years ago...
| [deleted]
| thecarokann wrote:
| This is a known 'issue':
| https://news.ycombinator.com/item?id=34193047
| anon223345 wrote:
| Ha! This is exactly what I'm seeing...
|
| I'm looking through these comments to see how I can reach out
| to google cloud from these links
|
| I do not even want this access...!!!
| [deleted]
| SillyUsername wrote:
| Perhaps related to this bug which Google has known about for 12
| years, and is potentially in breach of GDPR?
| https://issuetracker.google.com/issues/35889152
| cookieperson wrote:
| Just be careful y'all. Even though something is a bug or a
| mistake you could get in bigtime shit over it, or a bill.
| invalidname wrote:
| As a person who paid for Google's "Gold" support. They are less
| than useless.
|
| Don't go into these accounts at all. Not even to try and
| help/contact them. Laws about this are very vague and no one
| within the ORG would want to admit that they made a mistake by
| adding you.
| leesalminen wrote:
| I've had access to both Google's and Amazon's paid support
| options (up to and including enterprise support).
|
| Amazon's support has gone above and beyond for me over the
| years in ways I didn't even expect or ask them to.
|
| In comparison, I agree with you that Google's support is
| useless.
|
| My experiences with AWS support have actually left me with a
| positive impression of the platform, while my experiences with
| Google reinforced that they don't know how to do support. At
| all.
|
| Want to guess where our 8-digit cloud spend goes?
| [deleted]
| AugurCognito wrote:
| Will choose AWS just for support anyday over alternatives.
| I'm not even a paying customer and I had a slight issue
| regarding multiple emails registered under the same account
| and such. I was just starting with AWS. The support was
| really helpful and provided me with information I didn't even
| know I needed.
| ajb wrote:
| Agree. AWS charge a minimum of 3% of your bill towards
| support. Which is fine, it makes support scaleable and even
| a profit centre.
|
| What's weird is that GCP charge the same but apparently
| don't deliver
| elzbardico wrote:
| Out of curiosity, I tried to search for the specific function
| of Support Engineer both for AWS and Google on several job
| boards. It is a mostly un-scientific approach of course, but
| the results are as expected. It doesn't even look like google
| hires Support Engineers. LOL
| tapoxi wrote:
| They outsource it. I'm on the U.S. East Coast. My last GCP
| support ticket ended up in Romania.
| lowbloodsugar wrote:
| Google is a global company. How do you know they aren't
| google employees in Romania?
| ehPReth wrote:
| I mean, you can't be 100% sure in any one case but they
| do have a lot of third-party companies listed for
| support: https://cloud.google.com/terms/subprocessors
| ethbr0 wrote:
| And nothing against Romanians! I work with a ton of
| brilliant folks there.
|
| Outsourcing inevitably creates a firewall between
| engineering and support that shouldn't exist though.
|
| In a properly functioning org, support has a way to
| escalate quickly to engineering if it's confirmed "This
| is broken." Engineering in turn uses those incoming
| requests to recognize flaws in their own products.
|
| Outsourcing creates "Hide behind the SLAs and remain
| ignorant of any issues you've created" barriers that will
| ultimately sink a company.
| macintux wrote:
| At Basho engineers would often spend time working support
| to get a better view into customer pain points.
| Outsourcing support sounds like a giant middle finger to
| customers.
| ethbr0 wrote:
| I'm biased, because I came up through support before I
| went into engineering.
|
| But to me, the question has always been "Do I think I'm
| omniscient as an engineer? Do I think I can imagine every
| way the customer is going to try and use this product?
| Every way it can interact with other systems? Every quirk
| of a specific customer environment/dataset/etc.?"
|
| Well, if not, then good news! The support org should be
| capturing, categorizing, documenting, and forwarding all
| those cases to me.
|
| And each case is an opportunity to make the product
| better!
| mikyd1954 wrote:
| Seems like nothing support could do that you could not do
| yourself, ie: degrade the 'years ago group' and assist responders
| as needed.
| leesalminen wrote:
| A few months ago I stumbled upon a bug in a state machine that
| allowed me to obtain stuff without having to pay for it. It was a
| weird combination of steps and was kind of hard to explain.
|
| I submitted a ticket to the support team advising them in
| painstaking detail the steps needed to reproduce this
| vulnerability. They could also look at my account and see that I
| got stuff without paying.
|
| A couple days later I got a reply from a support manager that my
| concern wasn't valid and there was no bug.
|
| The next week I happened to be at a conference where the company
| in question was a sponsor. So, I visited their booth and spoke
| with the VP of Eng. He asked me to forward the ticket to
| security@. Within 8 hours I got a reply from them saying that
| they had fixed the bug.
|
| I guess I'm saying that even if Google let you submit a support
| ticket it might get ignored because they aren't trained to deal
| with security reports.
| debarshri wrote:
| People are just optimizing for the job they have assigned to in
| large organisation as compared to smaller orgs where ownership
| is with everyone. In this particular case, support manager
| optimized for their own KPI which could be number f tickets
| resolved or closed. Whereas, VP Eng. who is probably the owner
| of the problem statement care more about the issue.
| quietbritishjim wrote:
| There are quite a few post on Raymond Chen's "The Old New
| Thing" blog about bogus security reports e.g. this one [1] from
| 2022 or this one [2] from 2006. They're often described as
| requiring you to already be "on the other side of this airtight
| hatchway" (a Hitchhiker's Guide to the Galaxy reference)
| because you already need admin rights in order to get admin
| rights.
|
| That seems to suggest that Microsoft takes all security reports
| seriously even if most turn out to be bogus.
|
| [1]
| https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=10...
|
| [2]
| https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
| [deleted]
| sillystuff wrote:
| If MS really investigates all bug reports that is good. But,
| it seems like this should be expected?
|
| From misc. articles I've seen (mainly posted here on HN; I
| don't buy MS products) MS dismisses bug reports as
| unimportant and sometimes takes an extremely long time to
| address known security vulnerabilities.
|
| This VM escape was initially reported as an RDP bug that MS
| dismissed as unimportant, until it was used as a VM escape
| against their hypervisor.
|
| https://www.bleepingcomputer.com/news/security/microsoft-
| ign...
|
| The (in)famous pass-the-hash bug in windows is an example of
| MS not addressing serious security issues in a timely manner.
| Windows treats a password hash as equivalent to the password,
| so you don't even need to crack hashed passwords you've
| collected from e.g., the registry to authenticate to windows
| services (MS "protected" against this attack purely client-
| side). Microsoft acknowledged the issue was real more than a
| decade before even attempting to fix it.
|
| Apparently it was a difficult bug that included design
| failures, but over 10 years and multiple versions of windows
| for an exploit this severe?
|
| A couple days ago a Google Cloud container escape made HN
| front page. Comments on that article indicated Microsoft
| Azure had recently suffered the same, but while Google only
| allowed access to other containers owned by the same tenant,
| Microsoft's escape allowed access to all tenants on the same
| host. Google added a second layer of safety in case the first
| failed (a dedicated VM per host per customer to run each
| costumer's containers). Microsoft YOLO'd. I don't care enough
| to research these claims beyond noting that at the time I
| read them, no one had disputed them.
|
| I don't know if Microsoft is overall still worse than its
| competitors WRT to security (I suspect it is true). But,
| Microsoft is certainly not an exemplar for how security
| should be done.
|
| More on-topic with main thread, nonexistent support is kinda
| what Google is known for?
|
| At least Google now uses abuse@gmail.com for reporting abuse
| from their infrastructure instead of forcing the reporting
| party to go through a god-awful web form (when I handled mail
| at past orgs, I didn't even bother reporting gmail abuse due
| to the hoops they made you jump through back then; I also
| used the RFC-Ignorant RBL to punish them and other sites that
| did not use the RFC mandated email addresses for reporting
| abuse with a higher bias toward triggering a SPAM tag on
| their mail).
|
| Perhaps time for an RFC that mandates security contacts?
| toomuchtodo wrote:
| To your point, there should be some easy way to get a security
| incident report to the security team through an easily
| discoverable form or similar. This is as easy as "security
| incident" option in a support ticket drop down, and triage is
| required whether this is an ingest point or security@ email.
| killjoywashere wrote:
| Isn't that what the bug bounty program is?
|
| https://bughunters.google.com/
|
| Also, it doesn't shock me that somebody got a common group
| name early on in an internet-scale service's lifecycle. I've
| had a couple such experiences. Simple example: in the early
| days of Google Hangouts, you could choose your own meeting
| name in the URL. I chose "compass" for a meeting and
| accidentally landed in a meeting of Google engineers who were
| _very_ surprised by my appearance. Fortunately my meeting was
| a meeting I had arranged so I beat feet and changed my URL to
| the default auto-generated URL before the rest of my
| participants arrived.
| lazide wrote:
| Fun times when it becomes common knowledge that to get
| attention if support isn't working is to claim a security
| incident - and everyone starts doing it, hah.
| kadoban wrote:
| That's pretty easy to deal with: respond with only "not a
| security issue" if it's not.
|
| Or, actually have support, but that's not Google's style.
| jonas-w wrote:
| Like security.txt?
|
| https://securitytxt.org
|
| For example: https://www.google.com/.well-known/security.txt
| toomuchtodo wrote:
| You and I know this, but if you're not a security
| practitioner, you might not know. It might as well then be
| behind a door for a room with a sign that says "Beware of
| the Leopard."
|
| I understand some scrappy startups like Google don't have
| the resources to have someone review security incident
| reports that come through a web form, but maybe they should
| if they want to be a legit cloud provider?
|
| Googling "report google cloud security issue" does not turn
| up productive results. Compare to what you get when you
| google "report aws security issue."
| NavinF wrote:
| The 3rd result for "report google cloud vulnerability" is
| productive
| [deleted]
| Trencin wrote:
| At least twice I have left a review about a Business on Google
| Maps and ended up as an admin of their business profile. I don't
| know what's going on with Google.
| anon223345 wrote:
| That's awesome lol
| tpoacher wrote:
| Did you reply to your review at least, to complete the circle?
| /s
| slowmotiony wrote:
| If there's no way to contact them then I'd probably just delete
| their stuff altogether. What are they gonna do, contact google
| support? :-)
| lopkeny12ko wrote:
| Just ignore it move on. There's no winning there. In the worst
| case, the company may try to file charges against you for
| computer abuse/fraud. In the best case, an otherwise harmless
| association is removed from your account. It is impossible to get
| ahold of anyone at Google if you are not an enterprise customer.
| Just forget about it and do nothing.
| renewiltord wrote:
| Perhaps if you have IAM you can see their users and then email
| them.
| [deleted]
| we_never_see_it wrote:
| I have hard times feeling any sympathy for these companies. When
| you trust an ad company like Google what did you expect? Maybe
| Google will shutdown this product and fix the secuity hole in the
| process.
| elzbardico wrote:
| Knowing the byzantine ways of Google support, I wouldn't be
| surprised if Google's reaction to this would be to ban the
| account of everyone involved in this episode.
| anon223345 wrote:
| What it's doing is actually useful, using a group to easily add
| people to roles is great
|
| Not making the group do confirmation, or even acknowledging the
| addition is super stupid
| peddling-brink wrote:
| Google should shut down Cloud because they allow groups to be
| added to IAM?
|
| That's an interesting take.
| elzbardico wrote:
| I think you misinterpreted OP. He is making a pun with the
| widespread beliefs that
|
| a) Google doesn't care about giving user support for their
| products even if you pay
|
| b) Over a not-so-long time the survival rate of every Google
| product seems to drop to zero unless it is related to search
| and ads.
|
| So, the joke is that the problem would solve itself when
| google predictably kills this product.
| ghusto wrote:
| Fair enough, but it's also worth noting that this mistake is
| difficult to make in AWS. You can do it, but you have to be
| so explicit about what you're doing that I can't imagine
| anyone managing it accidentally.
|
| The system is broken if this has happened _multiple_ times to
| this guy.
| dboreham wrote:
| Almost as funny as naming your kid "delete from users".
| kevingmccall wrote:
| I'm the SRE oncall for Cloud IAM. Can you send me a message on
| linkedin (link in my profile)? I'll give you my Google corp
| account email address.
| crazygringo wrote:
| FYI there's no such thing as direct messages on HN.
|
| You need to put a means of contact in your profile, or edit
| your comment to add it. It can be a disposable e-mail (like
| https://temp-mail.org/en/) if you want to enable a short-term
| communication like in this case.
|
| (Side note, I've seen this crop up so much that it kind of
| seems like it _would_ be good to have a DM functionality in HN,
| even if messages were auto-deleted after 7 days or something,
| or if it just forwarded to a non-public e-mail address.)
| kevingmccall wrote:
| Thanks, I added my linkedin to my profile because I already
| treat that as spam :)
| boilerupnc wrote:
| I would have thought that being "added" to anything is a two-way
| confirmation:
|
| 1. One from the party wanting to add the group to their account.
| Based on a prior comment, sounds like you are prompted to confirm
| an external group being added as admin.
|
| 2. One from the party administering/owning an external google
| group being requested to be added. Is there any confirmation
| here?
|
| Without the 2nd confirm, I start imagining security exposures in
| the family of Ransomware - let's call it "RansomAdd". You
| randomly add external google groups until you get someone to poke
| around "too much" and then threaten them with legal action unless
| they pay up. Ugh.
| [deleted]
| lazide wrote:
| Hah, probably wouldn't work well though. The types of folks who
| have money AND would be fooled by something like that would
| almost never have the time or curiosity to go poking around.
| oaksoul wrote:
| I was successful in the past reaching out through this:
|
| https://issuetracker.google.com/issues/new?component=187161&...
|
| I was told "issuetracker" generates messages directly to
| support/engineering teams and they do look into it.
|
| Submit a "defect" and they will answer.
| jacobsenscott wrote:
| Isn't this a little like reaching out to Linus because someone
| changed their home directory permission to rwxrwxrwx? It sucks
| for them, but what could google do?
| NegativeK wrote:
| Maybe if Linus maintained a paid product that included that
| home directory.
| mulmen wrote:
| Contact the customer.
| scarmig wrote:
| They could make the default such that you couldn't grant anyone
| outside your organization any particular role, unless
| principals associated with that domain are explicitly
| whitelisted (by domain).
|
| (And, in the other direction, there should be a
| request/response flow when you're added to some random
| project/org you have no interest in, which can make you
| vulnerable both to legal attacks by the org mistakenly adding
| you and to phishing.)
| lazide wrote:
| Many folks have contract admins, it would add a lot of
| friction for the normal case just to try to prevent something
| that should be transparently dumb anyway.
| yamtaddle wrote:
| If it were happening a bunch, there might be a good case to be
| made for changing permission-granting UI. Maybe not kernel-
| level, but OS-level, at least.
|
| In fact, lots of distros now warn when a user attempts certain
| sudo actions, for similar reasons--mistakes were being made,
| and adding a little or the right kind of friction could prevent
| them.
___________________________________________________________________
(page generated 2023-05-30 23:02 UTC)