December 9, 2014 By Shane Schick 2 min read

It may be the world’s leading tool for finding things online, but even Google is probably unhappy with this search result: There are reportedly more than 30 vulnerabilities in its Google App Engine service.

Security Explorations, a research firm based in Poland, disclosed its findings in a public message board post that discussed the ways that cybercriminals could theoretically bypass settings in Google App Engine and gain access to the Java Runtime Environment. This means they could take files or compromise them by executing native code, among other techniques. This would be considered a form of a Java virtual machine “sandbox escape” — a way for a software vulnerability to get through one of the various ways software is designed to contain them.

Even if the risks have never resulted in an actual incident, the discovery is important because Google App Engine represents an important piece of the company’s mission to win over business customers as a part of its platform-as-a-service offering. In other words, organizations can build and run a custom Web app but have it run on the search engine firm’s massive cloud computing infrastructure. If those creating Web apps worry about the infrastructure being secure, however, it would obviously become less attractive.

According to The Inquirer, sandbox escapes have sometimes led to zero-day exploits that affected major Microsoft products such as Internet Explorer and PowerPoint. Besides having Google address the various vulnerabilities directly, the best recourse for developers is to ensure apps are monitored regularly and to pay special attention to the way they program them.

The Hacker News reported that Security Explorations was able to break into selected pieces of information from binary files through Google App Engine, but the search engine has since frozen its test account. However, this will likely be sorted out in due course since Google, like PayPal, regularly encourages researchers to identify possible holes in software before cybercriminals find them.

In fact, the researchers are more than prepared to share their test results with Google and the security community as a whole once their work resumes, Help Net Security said. Otherwise, any incidents involving a sandbox escape would suggest the company wasn’t serious about protecting Google App Engine users.

ZDNet said it had asked Google to comment on the potential vulnerabilities and is still waiting on a response. Until then, expect its cloud offering to be under much greater scrutiny from the security industry.

Image source: Flickr

More from

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government.The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of 2022…

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today