Google launches $250,000 'Root-in-Cloud' bounty for full Google Cloud project and organization takeover
Google announced on October 30 a $250,000 reward tier, called Root-in-Cloud, in its Google Cloud Vulnerability Reward Program. It pays researchers who demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations with no prior access. The program targets architectural flaws such as tenant isolation bypasses and complex cross-service logic issues. It was described by CISO Chris Betz and VRP lead Michael Cote. This is a bounty program announcement, not an active threat.
Detalhes técnicos
- A qualifying report must show control equivalent to the
roles/ownerrole, or full IAM control, over arbitrary projects or organizations. It must work without any special configuration of the victim environment. - Exploits cannot rely on existing access, prior footholds, leaked or stolen credentials, phishing, social engineering or any user interaction.
- Researchers must use a designated service account to produce cryptographic proof of unauthorized access, rather than testing against real customer projects.
- Remote code execution in Google's Borg production infrastructure (root-in-prod) is automatically evaluated for eligibility. Researchers must stop probing immediately after achieving any code execution. Further escalation, production credential extraction and lateral movement are prohibited and can disqualify the report.
- The article cites the patched ImageRunner (Cloud Run) and ConfusedComposer (Cloud Composer / Cloud Build) issues as examples that fell short of the bar, because both required existing permissions.
- Cote said valid VRP reports have stayed stable over 18 months while total submissions rose sharply, which he attributes to automation raising triage noise.
Remediação
- Cote advises enterprise teams to prepare triage pipelines for agent-generated vulnerability reports and to separate plausible hallucinations from reproducible bugs.
- Teams should speed up remediation after public disclosure and demand coordinated disclosure from security partners.
Linha do tempo
-
Google launches $250,000 'Root-in-Cloud' bounty for full Google Cloud project and organization takeover
ler a análise desta fonte ocultar
Google announced on October 30 a $250,000 reward tier, called Root-in-Cloud, in its Google Cloud Vulnerability Reward Program. It pays researchers who demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations with no prior access. The program targets architectural flaws such as tenant isolation bypasses and complex cross-service logic issues. It was described by CISO Chris Betz and VRP lead Michael Cote. This is a bounty program announcement, not an active threat.
Technical Details
- A qualifying report must show control equivalent to the
roles/ownerrole, or full IAM control, over arbitrary projects or organizations. It must work without any special configuration of the victim environment. - Exploits cannot rely on existing access, prior footholds, leaked or stolen credentials, phishing, social engineering or any user interaction.
- Researchers must use a designated service account to produce cryptographic proof of unauthorized access, rather than testing against real customer projects.
- Remote code execution in Google's Borg production infrastructure (root-in-prod) is automatically evaluated for eligibility. Researchers must stop probing immediately after achieving any code execution. Further escalation, production credential extraction and lateral movement are prohibited and can disqualify the report.
- The article cites the patched ImageRunner (Cloud Run) and ConfusedComposer (Cloud Composer / Cloud Build) issues as examples that fell short of the bar, because both required existing permissions.
- Cote said valid VRP reports have stayed stable over 18 months while total submissions rose sharply, which he attributes to automation raising triage noise.
Remediation
- Cote advises enterprise teams to prepare triage pipelines for agent-generated vulnerability reports and to separate plausible hallucinations from reproducible bugs.
- Teams should speed up remediation after public disclosure and demand coordinated disclosure from security partners.
- A qualifying report must show control equivalent to the