It may be the world’s leading tool for finding things online, but even Google is probably unhappy with this search result: There are reportedly more than 30 vulnerabilities in its Google App Engine service.
Security Explorations, a research firm based in Poland, disclosed its findings in a public message board post that discussed the ways that cybercriminals could theoretically bypass settings in Google App Engine and gain access to the Java Runtime Environment. This means they could take files or compromise them by executing native code, among other techniques. This would be considered a form of a Java virtual machine “sandbox escape” — a way for a software vulnerability to get through one of the various ways software is designed to contain them.
Even if the risks have never resulted in an actual incident, the discovery is important because Google App Engine represents an important piece of the company’s mission to win over business customers as a part of its platform-as-a-service offering. In other words, organizations can build and run a custom Web app but have it run on the search engine firm’s massive cloud computing infrastructure. If those creating Web apps worry about the infrastructure being secure, however, it would obviously become less attractive.
According to The Inquirer, sandbox escapes have sometimes led to zero-day exploits that affected major Microsoft products such as Internet Explorer and PowerPoint. Besides having Google address the various vulnerabilities directly, the best recourse for developers is to ensure apps are monitored regularly and to pay special attention to the way they program them.
The Hacker News reported that Security Explorations was able to break into selected pieces of information from binary files through Google App Engine, but the search engine has since frozen its test account. However, this will likely be sorted out in due course since Google, like PayPal, regularly encourages researchers to identify possible holes in software before cybercriminals find them.
In fact, the researchers are more than prepared to share their test results with Google and the security community as a whole once their work resumes, Help Net Security said. Otherwise, any incidents involving a sandbox escape would suggest the company wasn’t serious about protecting Google App Engine users.
ZDNet said it had asked Google to comment on the potential vulnerabilities and is still waiting on a response. Until then, expect its cloud offering to be under much greater scrutiny from the security industry.
Image source: Flickr