Google Vertex AI SDK: 'Pickle in the Middle' Bucket Squatting

Just saw the Unit 42 report regarding the Google Vertex AI SDK for Python. The 'Pickle in the Middle' technique is a nasty spin on classic bucket squatting.

Essentially, if the SDK allows for predictable bucket naming or doesn't strictly verify ownership during the model upload staging phase, an attacker can claim that bucket. Since ML models are frequently serialized using pickle—which is inherently unsafe—the attacker intercepts the upload, injects malicious code into the pickle file, and lets Vertex AI deserialize it upon deployment. This results in RCE inside Google's serving infrastructure.

This highlights the risks of implicit trust in the ML supply chain. If you're deploying to Vertex AI, ensure your staging buckets are pre-provisioned with explicit IAM constraints rather than relying on SDK auto-generation.

Here is a quick snippet to audit if your staging buckets might be vulnerable to squatting by checking for overly permissive ACLs:

from google.cloud.storage import Client

def audit_bucket_access(bucket_name):
    client = Client()
    bucket = client.bucket(bucket_name)
    
    if bucket.exists():
        acl = bucket.acl
        # Check for public access
        for entry in list(acl):
            if entry['entity'] in ['allUsers', 'allAuthenticatedUsers']:
                print(f"[!] CRITICAL: {bucket_name} is publicly accessible via {entry['role']}")
        print("[*] Audit finished.")
    else:
        print(f"[-] Bucket {bucket_name} does not exist. Safe from squatting (unless created dynamically).")

Are you teams signing your model artifacts to verify integrity, or just relying on private network isolation?