4 ms·
Thanks for the writeup. Based on what you've written, it sounds like you would have been surprised if Facebook had paid $1 million for the original report (and
by defen 11y ago
Thanks for the writeup. Based on what you've written, it sounds like you would have been surprised if Facebook had paid $1 million for the original report (and no further nefarious behavior by OP) since it was probably due to a simple oversight, even though it was a RCE that obviously could have been turned into total ownage of instagram. Is that accurate? If so, what class of vulnerability would make you say "Yep that's totally worth $1 million".
Or do you think he should have just stopped and Facebook should have realized how bad it was and paid him a lot more than $2500?
- tptacek 11y agoThere isn't a parallel universe in which this finding is worth $1,000,000. It it was, every pentester in the country is getting way underpaid, because this is not an uncommon pentest finding.
- defen 11y agoMakes sense, I'm just trying to get a sense of what sort of thing would be worth that much. Obviously only Facebook can answer that for sure. Heartbleed?
- Mandatum 11y agoIt's really dependent on the company. Ruby RCE would have the same affect heartbleed would to an entirely Ruby stack company. I don't believe any company would pay $1M for a bounty on their own systems. Only people who intend to use the vuln, or to fix it as they are the vendor. Fr a vuln to go for $1M requires "discovering SQL injection"-levels of vuln. MS paid $100K for an entire vuln class for ASLR/DEP bypass discovery, and promptly patched the shit out of it. For a remote vuln class, I could see them paying $1M quite happily to not have all of their products re-owned.
- jldugger 11y agoWhat about the parallel universe in which bug bounty hunters are blackhats who directly profit from the exploit? It seems like someone with that level of access could run up, among other things, a decent AWS bill.
- argonaut 11y agoI don't know about you, but I value the certainty of not losing a few years of my life to court proceedings/jail time at significantly above $50M.
- jldugger 11y agoWell, obviously we're talking about the mirror universe where nerds get away with things instead of scapegoated. Also goatees everywhere.
- sangnoir 11y ago> It it was, every pentester in the country is getting way underpaid, because this is not an uncommon pentest finding. No wonder there's a flourishing (and well paying) blackmarket for vulnerabilities. I wonder how much this keys-to-the-kingdom vuln would be worth (Mitm Instagram, bootstrap a botnet, steal celebrity pics, ... the possibilities are endless)
- tptacek 11y agoThis is no market for these kinds of vulnerabilities at all.