Remove any Site From Google (even if you don't control it) | Hacker News Reader

Remove any Site From Google (even if you don't control it)

jamesbreckenridge.co.uk

447 pointsfeydr93 comments

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it.

In the past, when I've had problems, I couldn't contact them either. They've done a great job at making sure there's no human contacts available. You have to post something in a public forum and hope they'll contact you. (They won't.)

Sending an email to security@google.com will result in a quick response. As part of their bug bounty program Google would have paid $1,000 for this bug if not more.

The biggest problem when the 911 (and equivalent emergency services) was getting the word out there that it existed. It required a huge, years-long marketing campaign. Perhaps they should have inhouse ads targeted at keywords like "report vulnerability".

I wonder if large companies are willing to advertise to the general public the possibility that they could have vulnerabilities.

Hmm, which is more valuable, $1000 or #1 on HN?

$1000

Sometimes (not necessarily in this case) #1 on HN. Being noticed in the right place at a right time may proove to be much better for one's life than a quick money boost.

You can get both.

That was my immediate thought when I read the article. "Wow, this guy just chucked away hundreds of dollars".

Always check for a bounty program before you go and release information like this.

Google should probably still give this guy the bounty

One of the main reasons they have a bounty program is to prevent people releasing information about bugs before they have been fixed. I don't see why they should give him a bounty.

I emailed security@google.com when I found a security issue with Google +1 (http://news.ycombinator.com/item?id=2630355) but didn't get any response. I guess it's not really an issue for them.

No, it won't. Trying to contact Google when I was working for a major corporation and TRYING TO GIVE GOOGLE MONEY resulted in the exact same issue as the OP, and this was in 2006, not 2011. The only way to get their attention was create a blog post about how I couldn't contact them.

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)

Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;)

Try searching for "google report security" or "security vulnerability google" and you'll find the right information.

Which is sad, because in this case we have a security vulnerability and a bug at the same time, so how one expresses that in a web search depends only on one's current mindframe and set of associations. Eg. when I hear "Google security" I imagine guys with guns, not a place for bug reports.

Any company worth its weight that stands to lose big time from a security vulnerability will have a page with info on how to report it to them, and searching "[company name] security" will usually get you right to it. Disclosure is what you do after you've contacted them and not heard back.

http://www.apple.com/support/security/

http://www.microsoft.com/security/msrc/report.aspx

https://www.dropbox.com/terms/#security

http://www.amazon.com/gp/help/customer/display.html/ref=hp_l...

The list of Google email addresses, including security@google.com is TWO clicks away from the google.com homepage.

Footer -> About Google -> Contact Us

I don't think it's reasonable to expect most people not immersed in the proper culture to see this as a "security" issue. They'd agree with "vulnerability" if you suggested it to them, but "bug" is really the first word that comes to mind.

It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets.

I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating.

edit: There's also no category for "generic login problems" or "Other". So I'm stuck posting it in Gmail.

My favorite has always been the google apps problems that tell you to contact support to get a resolution but you can only contact support if you are a paying customer.

support is not google's strong suit.

I am a google apps paying customer and it took them 4 weeks to get my domain issue corrected ! In that time i wasnt able to get mail so i had to change my mail to use godaddy until they got back to me. When they finally did they said it was because my dns records were pointing to godaddy ! After 1 week of not getting mails i would say an alternative is required. I actually had a feeling that this would happen :)

I really love google as a company, their products, api's, their talks and all the events they hold are so great, i have learnt alot, BUT man, when i couldn't access my mail as a paying customer and got the runaround for support for 4 weeks even though they said it was high on the priority list ... GRRR thinking about it just makes me mad.

Anyway on a good note, after this issue everything is working fine and i guess aslong as you dont need support then everything is good :)

thanks, always avoided paying them because i thought the experience would be like that...

Sadly, from what I have read over the years, your experience is not a solitary one. I hope Google, at some point, will address their customer service issues.

Setting up your DNS is not really something Google should do for you. You should have had an IT pro who's done this sort of transition before, manage the move. You could have had this resolved in hours not weeks. I agree though Google support sucks, the key is to not depend on it.

I think you misread what the problem was.

What problems have you run into? I recently switched over to 2-factor auth and while it's working fabulously I'd be interested to learn about any problems I could run into.

http://goo.gl/vulnz

wow - where did you find that?

obfuscated link is https://www.google.com/appserve/security-bugs/new

This bug could have been exploited for millions of dollars. Imagine giving a mafia boss control over the heartbeat of every rival. One blackhat SEO could have dominated any number of lucrative keywords.

If this bug has existed for a long time it's quite possible some guy is sailing around on a yacht that this bug paid for.

It's such a blindingly obvious bug that I really do wonder whether this might have been a backdoor/inside job by an employee. Google should very closely inspect the code change history.

Hopefully they also maintain a history of all page removal requests to see who might have been exploiting this.

It's not a back door, it's an abuse of an existing approach.

Google could weight the process in one of two ways:

    1. in favour of the complaint-maker.
    2. in favour of the website-owner.

If they favour the complainant, then website deletion is presumed to go ahead. If the webmaster, then it is presumed to be held up.

Google chose a compromise: the complaint is acted on, after a delay. The webmaster gets notified through webmaster tools; after some period of time the removal goes ahead.

If Google flip the compromise around, they will make it nigh impossible to remove any websites from the index.

I think you're misunderstanding the article. Google webmaster tools allows the website owner to request links to their own sites be removed. The poster has discovered that this form can be used to request any url be removed, and Google will think it's being submitted by the owner of that URL.

This has nothing to do with users complaining about a URL.

In which case, I think I have too.

> This bug could have been exploited for millions of dollars.

Quite possibly exploited for non-savvy website owners. Savvy owners would be checking their ranking regularly and noticing it disappear one day.

Anyone who ranks highly for lucrative keywords and does not check their ranking is asking to lose it, whether ethically or otherwise.

So I don't think it would have been exploited for the millions you think, but possibly a good bit of money.

> Anyone who ranks highly for lucrative keywords and does not check their ranking is asking to lose it, whether ethically or otherwise.

Your ranking is not your responsibility as a webmaster. It's Google's responsibility to its users to rank good answers highly.

It is your responsibility as someone doing business to check up on it, and proactively take action if/when rankings go down. To not do so makes no business sense. Of course, if you're just a casual blogger who doesn't care about SEO, it doesn't matter. But if you do care, not checking is foolish

By that logic, your comment being understood isn't your responsibility, it's the responsibility of your reader.

Then just run your attack on the day of a big algorithm or index update when it will be drowned by the usual "google made my children starve" noise.

Brillant!

It's not like savvy website owners have portals into the elusive world of WTF Is Happening To My SERP Rank? Nor do savvy website owners have magical avenues to rectify such events.

In other words, I'm not confident in the speed you can get Google to remedy an event where your website disappears from the results.

Despite it being "fixed" not long after the blog post went live, I wonder how long/how many people knew about this bug. Seems like it would be a great trick for SEO (build page to certain PR/remove opponents ranking above you)

Does this _actually_ work though? You get the message "URL pending for removal" but does that mean it's really going to be removed? Perhaps this is just a default response.

Were any non-owned sites/urls actually removed?

I don't know how is possible that a so obvious bug passed their quality department, and I wonder if someone didnt discovered it before and was doing this to take out competitors indexes..

Bugs happen. Even big ones like this. Any engineer worth his money knows that no amount of Q&A will discover 100% of the bugs. But, as Joel Spolsky said somewhere, bugs are just bugs, you fix them and then they're fixed.

I know, I am an engineer and I obviously let bugs pass too. But this is a little too obvious to me, to check if the user is allowed to remove this url. Maybe I am neurotic? :)

most bugs are obvious after someone has pointed them out to you.

I think the point is that it's a basic dev and QA fail not to check for this, especially with people of the caliber that Google is supposed to recruit.

Process always falls down at some point, it's why we have bugs in the first place. The point of view that "obvious bugs should never happen" is pretty obviously broken, you just try to make them as rare as humanly possible. Besides, simple looking things from the outside can be maddeningly complex from the inside - for all we know this could be related to an obscure bug in their test framework marking it as passed when it isn't.

Most of the time when people say "what a stupid mistake" they mean "that's a mistake I haven't made yet"

I can see having this pass by a reviewer or two. They look and see all of this:

- There are permission checks

- The user has to be logged in to GWT

- The user has to have access to this page

- The user has to be the owner of the siteUrl

After all those permission checks, it might appear that everything was covered. It's just one little omission, verifying that the urlt parameter corresponds to a page within the siteUrl website, that was missed.

eh? I don't see that as one little omission. It's kind of straightforward that you would need to be the owner of the actual URL to be deleted, so checking the siteUrl is not sufficient. I can understand if they only intended to allow relative paths from the siteUrl, and if there was some kind of bug in special characters or parameter parsing. But no, this is as bad as that bug in Citibank's site where you could just change the account number in the address bar [1]. Color me disillusioned with Google's security practices.

[1] http://consumerist.com/2011/06/how-hackers-stole-200000-citi...

This is a pretty amateurish mistake, actually, and I'm shocked that it was in production at Google. Proper authorization checks are web programming 101.

If you make a checklist of security practices the QA testers should look for, they'd see and check off "proper authorization checks", as they were done on other fields of the same page. If you can't imagine a professional making this mistake, your mental image of an engineer is not realistic. Humans are not that perfect, and this mistake does not make everyone that reviewed this code an amateur.

Well, people are down voting me, but everyone ripped the developers of Diaspora apart for basically the same exact flaw in an early alpha release of their system. The Google fanboyism seems to be running strong here.

Those flaws were all over their entire codebase in very basic parts of the site's functionality. They had literally zero authorization checks.

...but Intel released the Pentium and it couldn't divide by 10.

Sometimes testers use the shotgun approach, and things get missed. It can help to write exhaustive tests (you have a computer, right?) and try everything. But the problem space has to be orderly, orthogonal, something that can be spanned. This bug is in a pretty small problem space - an API with many dimensions (arguments), external dependencies. I'm not at all surprised something got thru.

Quoting Spolky regarding bugs and bug fixes? He has a horse in the game, I wouldn't quote him for anything bug-related.

Regarding bugs: a fast thinker always thinks about the consequences of checking in any code. Checking in code, not to mention releasing it, changes the word (in a very minor way but it still does). Not exploring the possible consequences and the alternative options is just negligence and/or lack of experience. You don't have to be a perfectionist to see this, you just have to be fast: finding a wise, balanced solution quickly every time you change the world.

My guess would be that someone took an internal tool with few security requirements and rolled it straight to production. If that is the case, this is probably an excellent candidate for a security audit, there are almost certainly more issues if something this basic was not in place.

His first blog post...talk about setting high expectations.

Somewhat related: I wish GWT had a "pattern" removal.

With one of my sites, by the time I noticed that certain pages were missing the "noindex" tag Google happily indexed over 4000 pages. Considering the rate Google is crawling those pages it may take years to be removed from the index. Obviously, submitting each link one by one is rather tedious.

Hopefully the author is going to release that extension after Google fixes this bug. I may actually bother clicking 4K times just to see that site "fixed"...

Grrr, google and it's acronym's, I thought GWT stood for Google Web Toolkit and I was really confused for a second. Instead this GWT stands for Google Webmaster Tools...

otherwise although it is a loophole I am pretty sure it is illegal.

It would seem that this is illegal, but I've never heard of a law protecting one's right to be listed in a search engine.

Perhaps, if this process requires you to be the owner, it qualifies as fraud?

If you want italics, use asterisks instead of 's.

For example,

    *italic*

produces italic.

http://news.ycombinator.com/formatdoc

thanks!

"but I've never heard of a law protecting one's right to be listed in a search engine."

I believe that in most countries where computer crime law exists, removing or modifying data that is not yours(1) is covered by the law.

(1) What's "yours" and what's not is of course a very tricky question when it comes to immaterial things. Whether a listing for your webpage generated by a third party is yours, I wouldn't bet (on either side.)

In germany, you might have a stab at sueing for lost income, for example if you are a shop with a large number coming from google search, or if you get large amounts of ad revenue from visitors from google.

I am always amazed how experienced programmers can make such obvious errors when processing user input. Why would I ask for a URL of the WMT account in the query string?

I just hope that there is no "for the lulz" guy running a batch script to see how many million URLs he'll be able to remove before this gets fixed.

Imagine if LulzSec found this first

Personally, I would be more concerned if someone with malicious intent and the ability to keep silent about what they have done had found & exploited this. [0]

Advertise: remove your competitor from Google's search results for a day! If I didn't think it was illegal, I'd probably pay for that, were I in such a situation.

[0] If, of course, it even existed in the first place. It seems plausible enough to me, even if I think it unlikely.

Eh, ok it would be more concerning. But Lulzsec would have made quite a spectacle out of it.

Now that, I must agree with.

How do you know they haven't?

I think they would have said about it already ;).

I think Google would be the last place they look for vulnerabilities.

The link is broken. I'm not able to load the page.

that's really funny but very serious

I suspect some googlers are going to have a long night :-).

4 months ago one of my sites totally disappeared from Google. I wonder if this is because of this??? It's not a shady site, and there's no reason Google would remove ALL the pages.. if anything they'd penalize it.

Reply on news.ycombinator.com