Could I Hack into Google Cloud?

[@thelegalsystem]

As someone who mostly works with networks, I got unreasonably excited for the DHCP exploit. Rogue DHCP servers are fun!

[@Jagnathbaba]

yes.Additionally this bug is inherent to a core protocol that everyone uses.

[@charlc]

Using openssl to generate a shared library blew my mind ... wow

[@ChillerDragon]

Ironic that the tool used for encryption (basically security) has such a wide range of features which could all be used as a attack vector

[@seanvinsick]

I'm an c dev (kernel dev), and I watch your videos for the exact reason you hope for. I've used some knowledge from your video to report potential exploits in our code.

[@pajeetsingh]

C code base? Miss them. Must be network right?

[@es2397]

The video editing you did was great. I liked the split screen with camera on the left and screen recording on the right. Also how you animated the chat bubble to move left at 07:46, so that one does not have to rewind the video if one wants to read the whole text.

[@shantanusharma5624]

Glad to see you talking about web apps after so long

[@GlassFamFishing]

I really enjoy these videos! As a software engineer who just migrated my company from linode to GCP though, sometimes I feel less secure letting google handle certain things for me. But I also know they have a lot more people working on that product so I would assume that they would resolve things much quicker than at a smaller shop. I also wanted to say I really appreciate you put links to the write ups in the description!

[@dave.gallant]

Thanks!

[@Wyvernnnn]

The #1 winning submission writeup is linked in the description, I just read it and it's unbelievable how clear it is. You guys should check it out

[@bettercallmepol3493]

Best channel availiable in youtube by far, keep this up bro!

[@MemoryOfLife]

Next video: Discovering a 0-Day RCE on Google servers to play Minecraft on it

[@ahmedifhaam7266]

this was such fun to watch, and really motivating, thanks a lot for sharing!

[@ari_archer]

Yay, normal videos are back :) Missed it!

[@DoubleOhSilver]

This was fascinating, it’s making me think of getting into security

[@Ma_X64]

Not too many people can talk so emotionally and, at the same time, informatively about such things.

[@danikrimm99]

Love how many of the prices are a variation of 1337. There are too many that this could be a coincidence :D

[@Kabup2]

I'm felling this rewards are too low. One single intruder can cause a havoc inside a company, and even more, if you are dealing with Google Cloud, you will allowed to invade a lot of companies. The cost will be around millions, for sure. And Google rewards with 1,2,5 thousands? Too low. It will be more profitable to go the other side.

[@infiniti2011]

More profitable, yes. Better, no. The whole reason white hat hackers exist, is due to the inherent risk in black hat hacking. Yes, it's more profitable, but chances are there will be repercussions.

[@Kabup2]

@@infiniti2011 Until now, the repercussions are minimal. Cybercrime already is the 2nd most profitable crime in the world, behing drugs only. I bet black hats are paying way better to learn about a security issue with Google cloud. Google needs to step up, and prioritize security.

[@infiniti2011]

@@Kabup2 Yes, but chances are maybe you won't get caught. But guess what, if you do, you're screwed. Look at Ross Ulbricht. He sentenced extremely harshly, because they were making an example. If you're dealing with a massive billion dollar tech company, they'll probably have the resources, time, and money to absolutely make your life hell, and it helps set a precedent for people who try to hack Google like that. Those are just my thoughts.

[@LiveOverflow]

I don’t think it’s more profitable. I’m not sure if the bugs shown here in particular are that interesting for a blackhat campaign. They might be too noisy or impact just a bit too low.

[@infiniti2011]

@@LiveOverflow Good point. I was thinking more in terms of zero days, but the real exploits here are not as useful.

[@jpierce2l33t]

Great stuff as always! You always looked like someone famous to me, but I couldn't quite put my finger on it...until last night when I watched a movie with Michael Cera in it. You're literally the German Michael Cera 🤣

[@arantes6]

I didn't know the name of that actor, but I literally guessed which actor you were talking about just because you said he looked like him 🤣

[@felix-dk9tr]

Ed Sheeran

[@body_building_edits]

fr stay on the grind

[@ronanru]

This isn't Minecraft

[@IrrationalDelusion]

15:34 doesn't it write "3133.70 as a reward" in this post? You said previous exploiter was rewarded 3313.70

[@uaBArt]

Where is my Minecraft video? 😢

[@uaBArt]

btw, great video, thanks

[@Veso266]

Yea, I miss minecraft

[@davbj7707]

You forgot to mention “I use Arch btw”.

[@meqativ]

Me when

[@JuanBotes]

thank you for sharing your knowledge \o/ appreciated

[@P-G-77]

Honest video.

[@ytg6663]

Your face is slowly upgrading into Mr Robot Look alike 😂😂

[@ytg6663]

@@bezosphere turning* 🙄

[@wrench2474]

now i will learn Kubernetes and do some exploits this videos was very cool now i am all fired up 😁

[@terrabys]

When you'll organize a CTF?

[@chihuhahuana4863]

this stuff is so cool, i cant wait for my 12th grade exams to get over so I can start learning

[@lPlanetarizado]

i m learning about crypto stuff (aes, certificates, etc) and putting the malware in the serial number is just... usually that number must be unique inside the CA, so when you request to a CA for signing it is them who create the serial number... of couse, if you have a signed certificate (for your website, app, etc), you can use that to sign things like: documents, sofware, or you own certificate. im actually surprised openssl dont limit the length of the serial number, unless for no-root-CA-signed certificates,

[@thename2144]

How can u use this to access cashapps mobile payments network?

[@coffee-is-power]

talk about follina pls!

[@AviPars]

Why that specific limit on price

[@berndeckenfels]

Why not filter DHCP packets - at least cross tenants.. why would the GCP allow it?

[@AviPars]

Ballpoint or regular

[@DoubleOhSilver]

This is better than Minecraft videos

[@spencerblackburn7670]

Something about hacking Google. U got my view, very interesting

[@spencerblackburn7670]

Okay this could literally be a video resume?

[@Fahodinho]

15:35 you should use a "," not a "."

[@zooi.]

this differs per country

[@haponnahilawvlogs]

done dikit&tamsak boss diskarte moto

[@floredebosscher8574]

But is it pronounced Kubernetes or Kubernetes 🤔

[@MemoryOfLife]

I think it's Kubernetes, Kubernetes doesn't sound very well

[@SF-eg3fq]

🤔

[@Dontcaredidntask-q9m]

Do a vid on azure.. you'll be in their machines with root within 5mins 😂

[@shinycompi]

You're german right? I think I hear it from your voice

[@danielhemmati]

Really cool

[@IndustryOfMagic]

This video looks like it's stretched sideways.

[@LiveOverflow]

I just gained weight :(

[@HumbleHuman-k7g]

I can’t get it, you consider yourself a security expert, but why you closed yourself in closed source ecosystem?

[@LiveOverflow]

I make mistakes too, so why would I want the responsibility for everything? From a security point of view, it can make a lot of sense to give away that responsibility. And I trust Google engineers a lot :P

[@BertVerhelst]

4:45 this is WHAT it looks like. when you say: this is how it looks like. It is translated too literally from German. We have the same problem in Dutch.

[@georgehammond867]

is Google paying you for looking up these same CVE's in their business?

[@villasoma9869]

i did not understand anything but i felt it was awesome xD

[@ChillerDragon]

this channel in a nutshell

[@accdiabolus]

Hi, ich mag deine Videos, vielen Dank für deine Mühe. Was ich nicht verstehe, wieso deine Videos scheinbar bei KZbin unproblematisch sind und die anderer CyberSec KZbinr, die nichts zeigen was Hacking wäre, geblockt werden, wie zuletzt bei Florian Dalwigk. Ich verstehe es einfach nicht.

[@diegomastro5681]

He's sponsored by google

[@LiveOverflow]

Das bei Florian war ein Fehler und der wurde auch wieder behoben. Fehler passieren, leider bei dem Thema häufiger, aber wir bekommen es immer korrigiert ;)

[@accdiabolus]

@@LiveOverflow Danke dir.

[@SaganE7]

when did he do a face reveal?

[@unskeptable]

I don't understand any of this gibberish . How can I understand this new found knowledge ?

[@Doninhas]

It's not pronounced "ist i o" but "istio" which basically means "sail" in Greek.

[@plushplush7635]

shodan dataflow :/

[@billymonday8388]

need to make that mic louder

[@lorenzcyber]

here we go again

[@joaofreitas3504]

where minecraft

[@medul8039]

cool

[@garfieldkart]

def

[@hypercrack7440]

Short answer: Yes, you can

[@James-is6tg]

Wow. Google does not pay a lot out. I'd just sell it on a zero day market.

[@pajeetsingh]

>accessing Google cloud using browser

[@Nihillius]

💘💘💘💘💘💘💘💘💘 more videos like this

[@pajeetsingh]

Offcourse ask your Chinese friends. They have access to all Google cloud machines.

[@barreiros5077]

some API abuse & Bad Seo +Hosting Reseller like Dina host

[@bladestormX]

I thought this was a Minecraft channel now

[@mkdir699]

This used to be a cool Minecraft channel.

[@Gobillion160]

where the hell are my minecraft videos

[@kavithatastycreations]

hi iam danny i want edius x crack keygen pl

[@alarmingly_good]

This is comment number 70

[@31redorange08]

Got KZbin hacked? My comment is gone. 🤔

[@monKeman495]

wtf that RCE compensate about 100k$ from a trillion dollar company. kudos to all hunters for their effort.

[@Zizo8182]

21:31

[@zedfalcon6972]

w i d e

[@DarkMetaOFFICIAL]

Either say "What the attack would look like." or "How the attack would look. There is NO "how something looks like." how it looks. or what it looks like.

[@stewiegriffin6503]

the 5K guy... it cost him more time/money to write just a documentation, then the price itself. kids, this is called intellectual prostitution plz don't do this.

[@md.shazidalhasan6726]

We need more from Minecraft series

[@peppigue]

-mine-*craft*

[@peppybocan]

It's pronounced "IS-TIO" man, not IST-I-O.

[@SadKris]

No

[@ramnikTDM]

U r getting old 🥺

[@tr909love]

He's just talking shit about what other hackers did. But the truth is he can't hack shit.

[@HiToni]

Then try to hack Google by yourself. You must certainly be a very skilled Hacker if you comment like this.

[@DontDoubtOurServers]

Lol you must be new here he’s actually really big in the pentesting space now if this was network Chuck sure talk shit all day. Also going over cve’s and preforming the exploit is a good way too learn nobody knows everything and if you’re trying to learn everything you’ll end up not really knowing anything

[@davbj7707]

@@DontDoubtOurServers Network Chuck is a script kiddie

[@DontDoubtOurServers]

@@davbj7707 thank you I’m glad I’m not the only one that noticed that like his newest video with John he had no input he would just cut to John then repeat what he said lol

[@LiEnby]

Well being able to understand anyrhing that's going on here is a pretty telling

[@vadym-beep1241]

Fun fact: $31.337 translates to "eleet" in leetspeak.

[@PartikleVT]

I watch this while doing overthewire wargames

[@jasondoubleoseven]

1337 000 is an interesting number, it spells leet