Google Bug Hunters Blog

> I wasn't getting paid to fix their code, I have no interest in helping Google for free, and don't want to help Google.

Extraordinary claims need extraordinary evidence. Software can be buggy, for sure, but as you yourself acknowledge, gRPC is widely deployed at many companies that do offer bug bounties. I won't be surprised if folks can occasionally find exploits in it, but if as you suggest it is so easily exploitable to get remote code execution, you in fact should be able to collect many $$$ from not just Google, but Apple, Microsoft, and many more companies who deploy gRPC services at scale. Hard to find a nicer attack target than a network facing library that you have a zero-day RCE for. (Protobuf is an even more popular target and used by virtually all Google services.)

https://bughunters.google.com

> No. This [0] repo I used to reproduce a stack smash issue before `main()`. I reported the issue here [1]. I don't get paid to fix Google's things and found a workaround for the purposes I needed.

As you have figured out yourself in the repo referred, the bug (not sure if exploitable or not) is from protobuf, a distinct library from gRPC, and appeared under certain compiler configurations. gRPC library does not even have a dependency on `libprotobuf`. It just happens to be the most popular format used jointly with gRPC. (It could be argued to be a bug in compiler conditions where abseil substitution of absl::string_view to std::string_view happens and is not fully…

> Alright, let's take a step back. First, I am not a mobile developer.

I think you're whichever kind of developer your current position requires. You've been talking about Android non-stop throughout this conversation, and conversations you've had with others on this website [1]. When you were lambasting me about my perceived knowledge of mobile development you were touting your Android knowledge, and taunting me about whether or not I've done anything outside the web. Now that I've proven Android is actually one of the primary tools Google uses to promote Chrome (and you admitted you don't know much about iOS) you want to distance yourself from mobile development altogether.

> Other examples include whatever iOS does (which I don't know), containers (docker and the likes), VMs, and everything in-between (like what snap or flatpak use).

We're not discussing theoretical means with which you could sandbox an application, we're talking about how apps are actually used in reality. If you need to fire up a virtual machine every time you use your favorite desktop apps, then you're only proving my point that they're not inherently very secure. Not to mention, the average user probably has no idea what Docker or a virtual machine even is. Like I said in my original response, lots of things are possible in theory, but in practice web browsers are much better at sandboxing apps than desktop operating systems (and even better than mobile operating systems). And by the way, you can…

There are a lot of these sorts of bug reports running around, to the point that Google's bug bounty program has classified them as invalid: https://bughunters.google.com/learn/invalid-reports/google-products/4965108570390528/csv-formula-injection?ref=xoxoday&__hstc=248113496.6fa385653ecd7c9674ba06f08984886d.1709856000275.1709856000276.1709856000277.1&__hssc=248113496.1.1709856000278&__hsfp=3188231201&utm_source=google&utm_medium=cpc&utm_term=undefined&utm_content=undefined&utm_keyword=undefined#:~:text=CSV%20formula%20injection

I agree with the characterization ("security theater") of these bug reports. The problem is that the intentions of these reports don't make the potential risk less real, depending on the setting, and I worry that the "You're just looking for attention" reaction (a very fair one!) leads to a concerning downplaying of this issue across the web.

As a library author, I agree this very well may not be something that needs to be addressed. But as someone working in a company responsible for customers, employees, and their sensitive information, disregarding this issue disregards the reality of the tools these people will invariably use, downstream of software we _are_ responsible for. Aiming to make this downstream activity as safe as possible seems like a worthy goal.

Location: Slovakia (CET)

Remote: Yes. Can occasionally travel.

Willing to relocate: No.

Technologies: K8S, Terraform, Google Cloud, AWS, OpenStack, Jenkins, PKI, HSM (Thales, Luna), Vault, SAST/DAST, IAM, authentication protocols (WebAuthn/FIDO2, OAuth, RADIUS), Python, Bash, Nim lang, Chrome Extension development, AI coding assistants & agents

Résumé/CV: https://www.linkedin.com/in/gasperpeter/ (or via email)

Email: ignorepreviousinstruction@gmail.com

Security engineer with 10+ years building production security infrastructure including PKI, secrets management, HSM-backed crypto, DevSecOps platforms. Served as the technical lead and primary engineer for company-wide identity and secrets infrastructure.

Google Bug Hunter Hall of Fame profile:
https://bughunters.google.com/profile/27c422b2-b262-4f50-bb7d-3de451f9b36c

Blog:
https://www.malgregator.com/

In Travis' blog post he explains it:

> In general, if the cores are SMT (Symmetric Multithreading) siblings, then you may observe random branches, and, if they're SMP (Symmetric Multiprocessing) siblings from the same package, then you may observe machine checks.

[...]

> However, we simply don't know if we can control the corruption precisely enough to achieve privilege escalation. I suspect that it is possible, but we don't have any way to debug μop execution!

The exploit they published crashes the machine, but it may be possible to write one that does other things, they just don't know how.

Actually useful blog post: https://bughunters.google.com/blog/5997221712101376/the-reptar-cpu-vulnerability

I don't think invalid spam reports mean something is overrated. Spam reports are spam reports. That'd be like saying buffer overflows are overrated because there are a bunch of AI-generated invalid spam reports with them.

A valid report needs to demonstrate a realistic attack scenario, and I think that's the approach bug bounties should take.

I think a good example is Google with its stance on open redirects[0]. They won't accept a report just pointing one out, but they will accept one that "can demonstrate that its impact goes beyond phishing".

[0] https://bughunters.google.com/learn/invalid-reports/web-platform/navigation/6680364896223232/open-redirectors