# Auth Bypass in https://nearbydevices-pa.googleapis.com

Google Fast Pair nearbydevices API lacked access control, letting any authenticated user read/modify/delete any device and steal Anti-Spoofing Private Keys.

- Payout: $5,000
- Severity: high
- Program: Google
- Credited: David Schütz
- Disclosed: 2021-05-16
- Write-up quality: 8/10
- Original: https://feed.bugs.xdavidhu.me/bugs/0004
- Library page: https://bugbountylibrary.com/r/blog%3Afeed-bugs-xdavidhu-me-bugs-0004
- Tags: domain:api domain:web3 impact:data-leak impact:integrity kind:bounty platform:blog sev:high tech:grpc tech:rest technique:source-review vuln:access-control vuln:idor vuln:info-disclosure

**Target:** nearbydevices-pa.googleapis.com REST/gRPC API
**Root cause:** The nearbydevices-pa.googleapis.com API performed no ownership/access-control check on the project number in the request path, so any authenticated user could operate on arbitrary projects' devices.
**Steps:**
1. Create attacker and victim users, each with a GCP project via developers.google.com/nearby/devices
2. Note both project numbers from console.cloud.google.com
3. Victim creates a Fast Pair device (Headphones, 512x512 image)
4. Attacker proxies traffic with Burp and sets Match/Replace on request body: attacker project number -> victim project number
5. Attacker opens Devices list and sees victim's devices
6. Attacker opens the device to read Anti-Spoofing Private Key, add firmware, edit, view analytics, delete
7. For real-world: proxy phone while pairing Pixel Buds, capture gRPC GetObservedDevice response, extract Model ID and Project Number from protobuf
8. Send `GET /v1/projects/[project_number]/devices/[model_id_decimal]?key=AIzaSyBbXGPRxbh6-U8pujg5-lABDGuThIjtn38` with attacker Bearer token to retrieve the Anti-Spoofing Private Key
**How found:** Noticed the API accepted a project number in the path with no ownership check; confirmed by swapping project numbers via Burp Match/Replace. To prove the gRPC response leaked the project number, hand-decoded the protobuf after tools failed, using `$outputDefaults=1` and `application/json+protobuf` Content-Type to correlate field IDs 1 and 2.
**Exploitation:** Attacker pairs a purchased Pixel Buds, proxies the pairing traffic, and extracts the Model ID (9616317) and Project Number (88849360756) from the GetObservedDevice gRPC response protobuf. Using their own nearby dashboard access token, they call the REST endpoint with the victim device's project number and model ID to retrieve the Anti-Spoofing Private Key, enabling MITM of new Fast Pair Bluetooth connections or destructive deletion/renaming of the device.
**Escalation:** Chained the missing access control with the gRPC GetObservedDevice response leaking Project Number and Model ID, turning a requires-knowing-project-ID bug into an unauthenticated-target-agnostic key theft affecting all second-gen Pixel Buds.
**Insight:** When an API takes an object identifier (project number, tenant ID) in the path, test swapping it for another account's value; also check whether adjacent gRPC/REST endpoints leak the identifiers needed to target other tenants, and use `$outputDefaults=1` plus `application/json+protobuf` to map protobuf field IDs when decoders fail.