Google bug bounty for security exploit that influences search results

Not really.

Not really what? Not really a logic flaw? Not really bypassing significant security controls? Or not really a serious security issue? What are you not really-ing to?

it doesn't affect Google security at all.

It does affect Google security: the guy demonstrated that he can modified the site map of a legitimate domain even though he did not own that domain. That's a Google logic flaw -- Google followed open redirects to other domains. Google could have prevented that, and eventually did. That is a Google logic flaw.

It doesn't affect Google cash flow that much ... If hackers abuse it it would be detected pretty fast either by Google itself or by victim.com reporting it. And when they detect it, root-causing it is trivial.

Security is part of Google's brand. You trust Google when you search from their website -- you trust that the sites that Google brings up are not malicious under normal circumstances (i.e. unless you are searching for something malicious). If Google were to turn up malicious sites, it would cause serious brand damage. Imagine, your bank tell you "Please bookmark us rather than searching with Google. Google searches cannot be relied upon as they may bring you to malicious sites." In fact, Google makes substantial effort to make sure malicious sites do not show up among the top search results, and allows site masters to request a review in the event that their website is flagged.

Saying Google could have stopped this, but leaving the vulnerability open to happen again and again is short sighted. Yes Google can stop each and every case as it occurs, but that's not smart security, and that hurts the company's brand. It is entirely surprising that it took Google that long to fix this -- it is not that difficult to fix.

/r/netsec Thread Parent Link - tomanthony.co.uk