Google Cloud adds $250,000 Root-in-Cloud tier to vulnerability rewards program

[Google Cloud] Google Cloud has added a $250,000 Root-in-Cloud reward tier to its Vulnerability Reward Program (VRP) to recognize high-impact architectural security research, according to Chris Betz, CISO of Google Cloud. According to Google Cloud, the tier requires researchers to demonstrate full administrative control, equivalent to roles/owner or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup. The exploit path cannot depend on pre-existing access or footholds, leaked, phished or stolen credentials, or user interaction or social engineering, Google Cloud said. Valid reports showing remote code execution in Google's underlying production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility, according to the company. Researchers must halt all probing immediately upon achieving any execution in Borg; escalation, extracting production credentials and lateral movement are not allowed and will result in disqualification, Google Cloud said.