Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.
The premier payout is “specifically designed to recognize high-impact architectural research” and will be handed out to researchers who can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.
According to the internet giant, to qualify for the reward, the exploit path should not depend on pre-existing access to a project, previously compromised credentials, or user interaction/social engineering.
Reports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward.
“Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
