Assigned
Status Update
Comments
rr...@google.com <rr...@google.com>
rr...@google.com <rr...@google.com> #2
Information redacted by Android Beta Feedback.
ka...@gmail.com <ka...@gmail.com> #3
deleted
va...@underdefense.com <va...@underdefense.com> #4
Thank you for reporting this issue. We have shared this with our product and engineering team and will update this issue with more information as it becomes available.
as...@bt.com <as...@bt.com> #5
- Build Number: google/raven/raven:13/T3B3.230413.003/9957835:user/release-keys
(Note: It is the build when sending this report. For exact build reference, please see the attached bugreport.)
Locked up 3 times already today 5/3/2023.
Won't come out of it. I have to do a soft reset EACH time to get it to work.
Debugging information
Google Play services
com.google.android.gms
Version 231516044 (23.15.16 (190400-527344967))
System App (Updated)
Android System WebView
com.google.android.webview
Version 561513534 (112.0.5615.135)
System App (Updated)
Network operator: AT&T
SIM operator: AT&T
Filed by Android Beta Feedback. Version (Updated): 2.33-betterbug.external_20230301_RC01 (DOGFOOD)
To learn more about our feedback process, please visithttps://developer.android.com/preview/feedback#feedback-app .
(Note: It is the build when sending this report. For exact build reference, please see the attached bugreport.)
Locked up 3 times already today 5/3/2023.
Won't come out of it. I have to do a soft reset EACH time to get it to work.
Debugging information
Google Play services
com.google.android.gms
Version 231516044 (23.15.16 (190400-527344967))
System App (Updated)
Android System WebView
com.google.android.webview
Version 561513534 (112.0.5615.135)
System App (Updated)
Network operator: AT&T
SIM operator: AT&T
Filed by Android Beta Feedback. Version (Updated): 2.33-betterbug.external_20230301_RC01 (DOGFOOD)
To learn more about our feedback process, please visit
ma...@google.com <ma...@google.com>
ma...@google.com <ma...@google.com>
ma...@google.com <ma...@google.com> #6
The issue has been fixed and it will become available in a future Android release. Please keep an eye on the release notes(
Description
What you would like to accomplish:
Confused deputy attacks can happen in GCP when service account impersonation is used.
To establish unique trust that can’t be exploited by a confused deputy attack, client-vendor trust should include a non-public (and at the very least hard-to-guess) component.
The attack would go as follows: Before the attack, ExampleCompany registers with ExampleVendor. To enable ExampleVendor to act in your production environment, you create the service accountexample_vendor@client_prod.iam.gserviceaccount.com , allowing example_vendor_prod@example_vendor_prod.iam.gserviceaccount.com to impersonate it.
An attacker sets up a new profile with the ExampleVendor and inputs example_vendor@client_prod.iam.gserviceaccount.com as the service account that ExampleVendor can impersonate.
The attacker can now log into their profile with the ExampleVendor.
How this might work:
We would suggest a similar solution to the AWS ExternalId solution.(https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html )
The customer registers with ExampleVendor. ExampleVendor asks the customer to grant permissions to impersonate a service account with an external ID condition provided by the vendor. When ExampleVendor uses any of the service account impersonation methods (https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts ), GCP checks that the external ID of the connection request is identical to that set by the customer in its service account.
If applicable, reasons why alternative solutions are not sufficient:
Currently, most third-party vendors use permanent service account keys to access customer environments, creating credential leakage risk. Workarounds are possible. A vendor can do one of the following:
All of these solutions: Are insecure by default (insecure unless the vendor takes active steps) Create workflow inconvenience Rely on vendor and customer behavior to be effective
Other information:
We have consulted withamiteinav@google.com and guyfeldman@google.com on the issue.
They have suggested that we request this feature.