Google o'zining Cloud Vulnerability Reward Program (VRP) dasturini yuqori ta'sirli arxitektura xavfsizlik kamchiliklari uchun yangi yuqori darajadagi mukofot bilan kengaytirdi.
Bu oydan boshlab, tadqiqotchilar Root-in-Cloud xatoliklari, jumladan, ijarachi-izolyatsiya chetlab o'tishlari va hujumchilarga ixtiyoriy Google Cloud tashkilotlari ustidan to'liq ma'muriy nazoratni qo'lga kiritish imkonini beradigan murakkab xizmatlararo mantiqiy kamchiliklar uchun $250,000 olishi mumkin.
"Ushbu yuqori mukofotni olish uchun siz ixtiyoriy Google Cloud tashkilotlari yoki loyihalari ustidan to'liq ma'muriy nazoratni, 'roles/owner' ga teng yoki to'liq IAM nazoratini, oldindan kirish huquqisiz yoki maxsus loyiha sozlamasisiz namoyish etishingiz kerak," dedi Chris Betz, Google Cloudning Bosh Axborot Xavfsizligi Direktori (CISO).
"Bundan tashqari, Google ishlab chiqarish infratuzilmasi (Borg) da masofaviy kod bajarilishini (RCE) yoki root-in-prod ga erishishni namoyish etadigan haqiqiy zaiflik hisobotlari avtomatik ravishda Google Cloud VRP paneli tomonidan root-in-cloud muvofiqligi uchun baholanadi."
Biroq, ushbu mukofotga mos kelish uchun ekspluatatsiyalar jabrlanuvchi loyihaga oldindan kirish, buzilgan hisob ma'lumotlari, ijtimoiy muhandislik yoki foydalanuvchi o'zaro ta'siriga bog'liq bo'lishi mumkin emas.
Bundan tashqari, Google ishlab chiqarish infratuzilmasida bajarilishga erishgan xavfsizlik tadqiqotchilari tekshiruvni to'xtatishi kerak, chunki kuchaytirish, ishlab chiqarish hisob ma'lumotlarini olish yoki yonma-yon harakatlanish ruxsat etilmaydi va diskvalifikatsiyaga olib keladi.
"Yuqori rag'batlantirishlar aniq, xavfsiz o'zaro ta'sir qoidalarini talab qiladi. Biz tadqiqotchilarning haqiqiy mijoz loyihalariga qarshi ekspluatatsiyalarni sinab ko'rishini hech qachon xohlamaymiz," deb qo'shdi Cloud VRP rahbari Michael Cote.
"Buning o'rniga, biz belgilangan xizmat hisobi yordamida deterministik root isboti mexanizmini yaratdik. Tadqiqotchilar ushbu identifikatorga qarshi ruxsatsiz kirishni kriptografik tarzda isbotlashi mumkin."
Google Cloud VRP haqida ko'proq ma'lumot, jumladan, oxirgi nuqta spetsifikatsiyalari, JSON yuklamalari va CLI misollari qoidalar sahifasida mavjud.
Bu Google'ning oktyabr oyida AI tomonidan yaratilgan hisobotlar to'fonidan so'ng o'zining Ochiq Manba Dasturiy Ta'minot Zaiflik Mukofotlari Dasturi (OSS VRP) ga arizalarni qabul qilishni to'xtatganidan keyin sodir bo'ldi.
Google 2010-yilda o'zining birinchi Zaiflik Mukofotlari Dasturini ishga tushirganidan beri dunyo bo'ylab minglab xavfsizlik tadqiqotchilarini $81,6 milliondan ortiq mukofot bilan taqdirladi.
2025-yilda Google 700 dan ortiq xavfsizlik tadqiqotchilariga rekord darajadagi $17,1 million mukofot berdi, bu 2024-yilga nisbatan 40% o'sish bo'lib, o'sha yili jami $12 million mukofot berilgan edi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarisiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws.
Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.
"To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup," said Chris Betz, Google Cloud's Chief Information Security Officer (CISO).
"Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."
However, to qualify for this reward, the exploits cannot depend on prior access to the victim project, compromised credentials, social engineering, or user interaction.
Additionally, security researchers who achieve execution on Google's production infrastructure must stop probing since escalating, obtaining production credentials, or lateral movement are not allowed and will result in disqualification.
"High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects," added Cloud VRP Lead Michael Cote.
"Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity."
More details on the Google Cloud VRP, including endpoint specifications, JSON payloads, and CLI examples, are available on the rules page.
This follows Google's suspension of submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) in October after a flood of AI-generated reports.
Google has rewarded thousands of security researchers worldwide with more than $81.6 million since launching its first Vulnerability Reward Program in 2010.
In 2025, Google awarded a record-breaking $17.1 million to over 700 security researchers, a 40% increase from 2024, when it awarded $12 million in total.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.