cyber.hendryadrian.com
Security News · securityweek.com

Google Adds $250,000 Cloud Bug Bounty for Full Tenant Takeover Flaws

· Original article ↗

Summary

Google’s Cloud VRP now offers up to $250,000 for flaws enabling full control of arbitrary Cloud organizations or projects, with restrictions on exploit paths and testing against production systems.

Key points

  • Google added a $250,000 top-tier reward for demonstrating full administrative or IAM control over arbitrary Google Cloud organizations or projects.
  • Eligible exploit paths must not rely on existing project access, compromised credentials, or user interaction or social engineering.
  • Reports demonstrating RCE in Borg or root-in-production may also qualify for the reward.
  • Researchers must stop probing immediately after achieving Borg code execution; escalation, extracting production credentials, and lateral movement are prohibited.
  • Google says researchers can prove unauthorized access using a deterministic mechanism tied to a designated service account, rather than testing against real customer projects.

Article Details

Event Type
Expansion of Google’s Cloud Vulnerability Reward Program with a new $250,000 top-tier bug bounty reward.
Impact
The reward applies to qualifying research demonstrating potential full administrative or IAM control over arbitrary Google Cloud organizations or projects, or remote code execution in Borg or root-in-production. Google says researchers must stop probing upon achieving execution in Borg; escalation, production credential extraction, and lateral movement are prohibited. Researchers can use a designated service account to prove unauthorized access without testing against real customer projects. The article reports no actual exploitation or customer impact.

People

Chris BetzGoogle Cloud CISO who described the new reward and the program’s safety rules for research involving Borg.Michael CoteGoogle Cloud’s vulnerability reward program lead who described the designated service-account proof mechanism and the research required for the new reward tier.

Vendors

GoogleGoogle has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.

Products

BorgReports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward.Google Cloudwho can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.

Related Articles