Google Bug Hunters Blog

7. Throwaway Google account gets locked for ToS (adding people without their permission) 8. Associated real Google accounts get locked for being associated with throwaway (unless you have really good OpSec) Might be worth a post on their bug bounty program though, assuming GCP is in scope https://bughunters.google.com/

This blog, and the corresponding paper, is mostly a bunch of hand-wavy biased statements, which google (job) security team seems to be very pervasive about for the past few years. Secure by Design™ - right. OTOH https://bughunters.google.com/blog/6368559657254912/llvm-s-rfc-c-buffe… is a very good read - while I don't agree with the premise of the article, it's a very good example showing how security concerns are addressed in real life with real life impact with real life problems to solve - by real engineers doing the meat work without cheap talk.

Isn't that what the bug bounty program is? https://bughunters.google.com/ Also, it doesn't shock me that somebody got a common group name early on in an internet-scale service's lifecycle. I've had a couple such experiences. Simple example: in the early days of Google Hangouts, you could choose your own meeting name in the URL. I chose "compass" for a meeting and accidentally landed in a meeting of Google engineers who were very surprised by my appearance. Fortunately my meeting was a meeting I had arranged so I beat feet and changed my URL to the default auto-generated URL before the rest of my participants arrived.

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys. (I ran into a similar issue with the Oculus/Meta Quest 2 and Facebook login tokens. I reported it as a vulnerability in the Facebook account system and it was fixed eventually.)

It's here: https://bughunters.google.com/. Not sure which is the better top-level URL.

> I wasn't getting paid to fix their code, I have no interest in helping Google for free, and don't want to help Google. Extraordinary claims need extraordinary evidence. Software can be buggy, for sure, but as you yourself acknowledge, gRPC is widely deployed at many companies that do offer bug bounties. I won't be surprised if folks can occasionally find exploits in it, but if as you suggest it is so easily exploitable to get remote code execution, you in fact should be able to collect many $$$ from not just Google, but Apple, Microsoft, and many more companies who deploy gRPC services at scale. Hard to find a nicer attack target than a network facing library that you have a zero-day RCE for. (Protobuf is an even more popular target and used by virtually all Google services.) https://bughunters.google.com > No. This [0] repo I used to reproduce a stack smash issue before `main()`. I reported the issue here [1]. I don't get paid to fix Google's things and found a workaround for the purposes I needed. As you have figured out yourself in the repo referred, the bug (not sure if exploitable or not) is from protobuf, a distinct library from gRPC, and appeared under certain compiler configurations. gRPC library does not even have a dependency on `libprotobuf`. It just happens to be the most popular format used jointly with gRPC. (It could be argued to be a bug in compiler conditions where abseil substitution of absl::string_view to std::string_view happens and is not fully…

There are a lot of these sorts of bug reports running around, to the point that Google's bug bounty program has classified them as invalid: https://bughunters.google.com/learn/invalid-reports/google-products/49… I agree with the characterization ("security theater") of these bug reports. The problem is that the intentions of these reports don't make the potential risk less real, depending on the setting, and I worry that the "You're just looking for attention" reaction (a very fair one!) leads to a concerning downplaying of this issue across the web. As a library author, I agree this very well may not be something that needs to be addressed. But as someone working in a company responsible for customers, employees, and their sensitive information, disregarding this issue disregards the reality of the tools these people will invariably use, downstream of software we _are_ responsible for. Aiming to make this downstream activity as safe as possible seems like a worthy goal.

> Alright, let's take a step back. First, I am not a mobile developer. I think you're whichever kind of developer your current position requires. You've been talking about Android non-stop throughout this conversation, and conversations you've had with others on this website [1]. When you were lambasting me about my perceived knowledge of mobile development you were touting your Android knowledge, and taunting me about whether or not I've done anything outside the web. Now that I've proven Android is actually one of the primary tools Google uses to promote Chrome (and you admitted you don't know much about iOS) you want to distance yourself from mobile development altogether. > Other examples include whatever iOS does (which I don't know), containers (docker and the likes), VMs, and everything in-between (like what snap or flatpak use). We're not discussing theoretical means with which you could sandbox an application, we're talking about how apps are actually used in reality. If you need to fire up a virtual machine every time you use your favorite desktop apps, then you're only proving my point that they're not inherently very secure. Not to mention, the average user probably has no idea what Docker or a virtual machine even is. Like I said in my original response, lots of things are possible in theory, but in practice web browsers are much better at sandboxing apps than desktop operating systems (and even better than mobile operating systems). And by the way, you can…

Location: Slovakia (CET) Remote: Yes. Can occasionally travel. Willing to relocate: No. Technologies: K8S, Terraform, Google Cloud, AWS, OpenStack, Jenkins, PKI, HSM (Thales, Luna), Vault, SAST/DAST, IAM, authentication protocols (WebAuthn/FIDO2, OAuth, RADIUS), Python, Bash, Nim lang, Chrome Extension development, AI coding assistants & agents Résumé/CV: https://www.linkedin.com/in/gasperpeter/ (or via email) Email: [email protected] Security engineer with 10+ years building production security infrastructure including PKI, secrets management, HSM-backed crypto, DevSecOps platforms. Served as the technical lead and primary engineer for company-wide identity and secrets infrastructure. Google Bug Hunter Hall of Fame profile: https://bughunters.google.com/profile/27c422b2-b262-4f50-bb7d-3de451f9… Blog: https://www.malgregator.com/

This is what I complain about: https://nvd.nist.gov/vuln/detail/CVE-2020-26870 https://sirre.al/2025/08/06/safe-json-in-script-tags-how-not-to-break-… https://bughunters.google.com/blog/5038742869770240/escaping-and-in-at… None of those problems exist in XHTML.

What do you think of https://bughunters.google.com/open-source-security/patch-rewards?

I don't think invalid spam reports mean something is overrated. Spam reports are spam reports. That'd be like saying buffer overflows are overrated because there are a bunch of AI-generated invalid spam reports with them. A valid report needs to demonstrate a realistic attack scenario, and I think that's the approach bug bounties should take. I think a good example is Google with its stance on open redirects[0]. They won't accept a report just pointing one out, but they will accept one that "can demonstrate that its impact goes beyond phishing". [0] https://bughunters.google.com/learn/invalid-reports/web-platform/navig…

That's a misinterpretation of what they mean by "known issue". Here's the full context from https://bughunters.google.com/learn/invalid-reports/google-products/46… > For full transparency and to keep external security researchers hunting bugs in Google products informed, this article outlines some vulnerabilities in the new Antigravity product that we are currently aware of and are working to fix. Note the "are working to fix". It's classified as a "known issue" because you can't earn any bug bounty money for reporting it to them.

Blog post: https://bughunters.google.com/blog/6116887259840512/announcing-google-…

When you can modify the microcode of a CPU, you can modify the behaviour of the RDRAND/RDSEED instructions. For example, using EntrySign [1] on AMD, you can make RDRAND to always return 4 (chosen by a fair dice roll, guaranteed to be random) [1] https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of…

Google has a program where you can submit patches to OSS projects (including libxslt) https://bughunters.google.com/about/rules/open-source/4928084514701312… The patches need to fix a systemtic design flaw (which seems like you are trying to do). You are eligible even if you are a contributor: > Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify? > A: They most certainly do. Additionally, github has: https://resources.github.com/github-secure-open-source-fund/ Companies have changed after seeing the log4j incident and are open to funding open source security (but we still need more)

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/5745167867576… [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

> I wonder how long before someone cracks SEV-SNP https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of…

They accidentally used the example key from AES-CMAC RFC, the full details are in the accompanying blog post: https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of…

The blog post that explains the exploit and how this whole thing works is at https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of…

yeah, google likes to have fun with the Bug Bounty program. See: https://bughunters.google.com/about/rules/google-friends/6625378258649…

Sure, and if you find one of those, you can trade it in for $25k or more [1] [1] https://bughunters.google.com/about/rules/chrome-friends/5745167867576…

They still have the bug bounty for the Pixel devices. I don't know they ever had one for the open source Android OS (AOSP), but a bug in AOSP would be likely to effect a Pixel device. The bug bounty that is getting removed is one that google offered for certain very popular apps in the play store. I also see that have bug bounty's for some of the main Google android apps. https://bughunters.google.com/about/rules/android-friends/617183327420… https://bughunters.google.com/report/targets/290590452

It was only a week ago that Google disclosed an exploit to get a root shell via eBPF. https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-c… I wouldn't want random applications (or web pages) to be able to load eBPF modules in the same way they can send shaders to a GPU through a graphics driver.

> “Uno no es ninguno” (One is none) I believe that translates to "One is not none" https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-c…

Oh google has many pages: - https://arvr.google.com/ - https://bughunters.google.com/ - https://design.google.com/ - https://opensource.google.com/ - https://code.google.com/ - https://ai.google.com/ - https://mapsplatform.google.com/ - https://programmablesearchengine.google.com/ - https://privacy.google.com/ - https://lens.google.com/ - http://labs.google.com/ - https://jigsaw.google.com/ - https://datastudio.google.com/ - https://tagmanager.google.com/ - https://script.google.com/ There are some more scraped by me https://github.com/rumca-js/Internet-Places-Database

Our team went with a similar approach when refactoring Protobuf debug APIs (https://bughunters.google.com/blog/6405366705946624/fixing-debug-log-l… People were relying on debug output and trying to parse it, so in the new implementation we threw up big warning flags and made the output unstable so that you couldn't make the mistake. The key lesson to take away is: if you want something to be an implementation detail, make sure to have multiple differing implementations :)

They're open source and written by volunteers so there almost certainly isn't. Unless it's covered by this: https://bughunters.google.com/about/rules/6521337925468160/google-open…

In Travis' blog post he explains it: > In general, if the cores are SMT (Symmetric Multithreading) siblings, then you may observe random branches, and, if they're SMP (Symmetric Multiprocessing) siblings from the same package, then you may observe machine checks. [...] > However, we simply don't know if we can control the corruption precisely enough to achieve privilege escalation. I suspect that it is possible, but we don't have any way to debug μop execution! The exploit they published crashes the machine, but it may be possible to write one that does other things, they just don't know how. Actually useful blog post: https://bughunters.google.com/blog/5997221712101376/the-reptar-cpu-vul…

You have to report all of them individually as evidence. You can also try here but it's not the proper channel (although it might connect the right people internally if it's high profile enough): https://bughunters.google.com/report