Google "Root-in-Cloud" deb nomlangan 250 000 dollarlik mukofotni e'lon qildi. Bu mukofot tadqiqotchilarga ixtiyoriy Google Cloud loyihalari yoki tashkilotlarini oldindan ruxsatsiz to'liq ma'muriy egallashni namoyish etganlari uchun beriladi.
Google 30-oktabrda bu tashabbusni e'lon qildi. Uning maqsadi — ijarachilar izolyatsiyasini buzishi yoki bulut xizmatlari o'rtasida zararli o'zaro ta'sirga olib kelishi mumkin bo'lgan arxitektura zaifliklarini bartaraf etish.
Dastur inson tajribasi va ilg'or vositalarni birlashtirgan tadqiqotlarga urg'u beradi. Google Cloudning axborot xavfsizligi bo'yicha bosh direktori Kris Betz va Cloud zaifliklarga javob berish dasturi rahbari Maykl Kote bu tashabbusni avtomatlashtirilgan skanerlashdan tashqari kashfiyotlar uchun rag'bat sifatida ta'rifladilar. Asosiy e'tibor ijarachilar izolyatsiyasini chetlab o'tish va xizmatlararo murakkab mantiqdagi zaifliklarga qaratilgan.
Mukofotni olish uchun tadqiqotchilar Google Cloudning "roles/owner" roliga teng ma'muriy nazoratni yoki ixtiyoriy loyihalar yoki tashkilotlar ustidan to'liq Identity and Access Management nazoratini namoyish etishlari kerak. Hujum jabrlanuvchi muhitining hech qanday maxsus sozlamasisiz muvaffaqiyatli bo'lishi lozim.
Ruxsat etilgan ekspluatatsiya usullari mavjud ruxsatga, maqsad loyihasidagi oldindan o'rnatilgan kirish nuqtasiga, o'g'irlangan yoki o'g'irlangan ma'lumotlarga, fishingga, ijtimoiy muhandislikka yoki foydalanuvchi bilan har qanday o'zaro ta'sirga tayanmasligi kerak. Bu cheklovlar ushbu mukofotni odatiy imtiyoz oshirishdan farqlaydi, chunki odatiy imtiyoz oshirish odatda autentifikatsiya qilingan shaxs bilan boshlanadi.
Taqqoslash uchun, tuzatilgan ImageRunner Cloud Run zaifligi xizmat qayta ko'rib chiqishlarini o'zgartirish va xizmat hisoblarini taqlid qilish uchun mavjud ruxsatlarni talab qilgan. Yangi daraja esa ushbu shartlarsiz dastlabki kirish chegarasini kesib o'tadigan hujum yo'lini talab qiladi.
Google Cloud zaiflik mukofot dasturi qoidalari texnik tasdiqlash talablarini taqdim etadi. Tadqiqotchilar ruxsatsiz kirishni kriptografik isbotlash uchun maxsus xizmat hisobidan foydalanishlari kerak, haqiqiy mijoz loyihalariga qarshi sinov ekspluatatsiyalarini amalga oshirmasliklari lozim.
Google'ning asosiy Borg ishlab chiqarish infratuzilmasida masofadan kod bajarilishini namoyish etgan yoki root-in-prodga erishgan hisobotlar avtomatik ravishda Root-in-Cloud muvofiqligi uchun baholanadi. Biroq tadqiqotchilar Borgda har qanday kod bajarilishiga erishgan zahoti tekshiruvni darhol to'xtatishlari kerak.
Keyingi eskalatsiya, ishlab chiqarish ma'lumotlarini olish va yonma-yon harakat taqiqlanadi va tadqiqotchilarni diskvalifikatsiya qilishi mumkin. Google'ning baholash paneli dastlabki kirish nuqtasi, bajarilish konteksti va ochilgan hujum yuzasini baholab, ixtiyoriy ijarachi yoki loyihani egallash mumkinligini aniqlaydi.
Bu baholash jarayoni tadqiqotchilarga ishlab chiqarish tizimlarining potentsial buzuvchi egallanishini sinab ko'rmasdan ta'sirni aniqlash imkonini beradi.
Xizmatlararo ishonch muhim tadqiqot sohasi bo'lib qolmoqda. Tuzatilgan ConfusedComposer zaifligi paket o'rnatish ish oqimlari qanday qilib imtiyozli Cloud Build identifikatorlarini ochib qo'yishi mumkinligini ko'rsatdi. Biroq ekspluatatsiya uchun mavjud Composer yangilash ruxsatlari talab qilingan.
Kote so'nggi 18 oy davomida haqiqiy Google Cloud VRP hisobotlari barqaror qolganini, umumiy yuborishlar esa sezilarli darajada oshganini aytdi. Avtomatlashtirish kirish to'siqlarini pasaytirdi, lekin triage shovqinini ham oshirdi.
Tasdiqlangan topilmalarga urg'u Google'ning PageBreak AI agentiga parallel bo'lib, u shubhali zaifliklarni haqiqiy xavfsizlik muammolari sifatida hisobot qilishdan oldin tasdiqlash uchun deterministik sinovdan foydalanadi.
Google shuningdek, tuzatilmagan zaifliklarni e'lon qilish uchun raqobat bosimi mijozlar himoyalanmasdan oldin hujumchilarga ekspluatatsiya qilinadigan ma'lumot berishi mumkinligi haqida ogohlantirdi.
Korxona xavfsizlik jamoalari uchun Kote agentlar tomonidan yaratilgan hisobotlar uchun triage quvurlarini tayyorlashni, qayta ishlab chiqariladigan zaifliklardan ishonchli gallyutsinatsiyalarni ajratishni va ommaviy oshkor qilishdan keyin tuzatishni tezlashtirishni tavsiya qildi.
U shuningdek, tashkilotlardan xavfsizlik hamkorlaridan muvofiqlashtirilgan oshkor qilishni talab qilishni, avtonom zaifliklarni aniqlash va ekspluatatsiya qilish qobiliyatlari sanoat bo'ylab yetilib borar ekan, mijoz xavfsizligini markazda saqlashni so'radi.
SOC'ga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering.16K SOC'dan tahdid razvedkasini integratsiya qiling.
Google has announced a $250,000 reward, called the “Root-in-Cloud” program, for researchers who can demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations without prior access.
Google announced the initiative on October 30 to address architectural vulnerabilities that could compromise tenant isolation or cause harmful interactions between cloud services.
The program emphasizes research that combines human expertise with advanced tools. Google Cloud’s Chief Information Security Officer, Chris Betz, and Cloud Vulnerability Response Program lead, Michael Cote, described the initiative as an incentive for discoveries beyond automated scanning, with a focus on tenant isolation bypasses and complex flaws in cross-service logic.
To qualify for the reward, researchers must demonstrate administrative control equivalent to Google Cloud’s “roles/owner” role or complete Identity and Access Management control over arbitrary projects or organizations. The attack must succeed without any special configuration of the victim’s environment.
Eligible exploitation methods cannot rely on existing access, prior footholds within the target project, or leaked or stolen credentials, phishing, social engineering, or any form of user interaction. These restrictions differentiate this reward from conventional privilege escalation, which typically begins with an authenticated identity.
For comparison, the patched ImageRunner Cloud Run vulnerability required existing permissions to modify service revisions and impersonate service accounts. The new tier instead demands an attack path that crosses the initial access boundary without those prerequisites.
Google’s Cloud Vulnerability Reward Program rulesprovide the technical validation requirements. Researchers must use a designated service account to produce cryptographic proof of unauthorized access, rather than test exploits against real customer projects.
Reports demonstrating remote code execution in Google’s underlying Borg production infrastructure, or achieving root-in-prod, will automatically receive evaluation for Root-in-Cloud eligibility. However, researchers must immediately stop probing once they achieve any code execution in Borg.
Further escalation, production credential extraction, and lateral movement are prohibited and can disqualify researchers. Google’s review panel will assess the initial entry point, execution context, and exposed attack surface to determine whether arbitrary tenant or project takeover is achievable.
This evaluation process allows researchers to establish impact without attempting a potentially disruptive compromise of production systems.
Cross-service trust remains an important research area. The patched ConfusedComposer vulnerability illustrated how package installation workflows could expose privileged Cloud Build identities. However, exploitation required existing Composer update permissions.
Cote said valid Google Cloud VRP reports have remained stable over the past 18 months, while overall submissions have increased substantially. Automation has lowered entry barriers but also increased triage noise.
The emphasis on validated findings parallels Google’s PageBreak AI agent, which uses deterministic testing to confirm suspected vulnerabilities before reporting them as genuine security issues.
Google also warned that competitive pressure to publish unmitigated flaws can give attackers exploitable information before customers are protected.
For enterprise security teams, Cote recommended preparing triage pipelines for agent-generated reports, separating plausible hallucinations from reproducible vulnerabilities, and accelerating remediation after public disclosure.
He also urged organizations to demand coordinated disclosure from security partners, keeping customer safety central as autonomous vulnerability discovery and exploitation capabilities continue to mature across the industry.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.