Google Offers $250,000 Root-in-Cloud Bug Bounty for Cloud Takeover
Original title: Google Offers $250,000 Bug Bounty for Full Google Cloud Project Takeover Vulnerabilities
Google offers $250,000 for researchers to demonstrate complete administrative takeover of arbitrary projects or organizations without prior access.
Google announced the Root-in-Cloud program with a $250,000 bounty for full admin control over arbitrary Cloud projects or organizations. The program targets architectural vulnerabilities in tenant isolation and cross-service interactions. Researchers must achieve roles/owner equivalent access without using existing credentials, leaked keys, phishing or user interaction. Validation requires cryptographic proof via a designated service account. Reports of code execution in Borg production infrastructure may qualify for evaluation. No probing of live systems beyond initial entry is allowed.
- Must achieve admin control without prior access or interaction
- Validation uses service account for cryptographic proof
- Reports of Borg code execution may qualify for Root-in-Cloud
- Focus on cross-service trust issues like ConfusedComposer
- Vendors
- Products
- Google Cloud
From the original article
2 min read at gbhackers.com
Google has announced a $250,000 reward, called the “Root-in-Cloud” program, for researchers who can demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations without prior access. Google announced the initiative on October 30 to address architectural vulnerabilities that could compromise tenant isolation or cause harmful interactions between cloud services.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.