7 ms·

During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this: > Bug bounties are supposed to represent a high probability

by mabbo 11y ago

During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this: > Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys to the kingdom to a major social network. (https://news.ycombinator.com/item?id=10756159 https://news.ycombinator.com/item?id=10756159) Expected payout = (Probability of reward * size of reward) +/- any additional value I put into who I'm selling it to. If I have an exploit that gives me a lot of access to Facebook (or any other large company) I have to run that formula for each entity that might pay me for it- Facebook, the NSA, the Chinese Military, and so on down the list. Facebook is offering high probability for a lower payout. The NSA might step up their game and start offering ten times as much, or make it more clear that they will indeed pay you for it (not that I have any proof they'd do such a thing). Make no mistake, Facebook has probably done this math very carefully when choosing a bounty.

baddox 11y ago
From this article I get the impression that the bounty wasn't even known before hand. It doesn't seem like a very careful consideration from Facebook, and I would expect it to be "too low" if they're choosing the amount after someone has already disclosed the bug.
ktRolster 11y ago
In other words, if you wanted to game the odds, you'd start by offering it on the black market, then if there were no takers after X number of days, offer it to Facebook?
- tptacek 11y ago
  It is unlikely that there is any black market for this bug, or for the RCE that compromised Facebook's crypto secrets. https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173
  - ktRolster 11y ago
    Yeap, you're right. These guys at least aren't paying a bounty for Facebook/Google bugs: https://www.zerodium.com/program.html https://www.zerodium.com/program.html
    - tptacek 11y ago
      Like Dylan says, people will pay for web server software bugs, if the software is widely installed, because you can make money by building and grooming a fleet of compromised servers. There is a way to do it, and that way works. There is not a good, reliable way to make money from Facebook account takeover. You can conceive of them speculatively, but that is not the same thing as knowing you can execute, or, better, already having a business process in place that is already executing, just waiting for a new bug.
      - CiPHPerCoder 11y ago
        Your comments make sense in the real world, where the big threat is "criminal enterprise looking to make an illicit buck". I worry that people are too obsessed about the hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun, rather than for a pay-off, e.g. ZF0.
        nemothekid 11y ago
        >* hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun* I'd assume having $15k to spend is a lot more fun than any enjoyment one could have by hacking someone's facebook account. You'd have to have a real vendetta against someone to value ruining their life at $15k.
        brbsix 11y ago
        For a political hit, $15k might be a very reasonable valuation.
        11y ago
cookiemonsta 11y ago
where do people even go to start to sell an exploit? how does that kind of stuff work?
- DigitalJack 11y ago
  same place as silk road.
  - amelius 11y ago
    Not sure if this is a good idea. Probably lots of undercover three-letter government agents lurking there.
    - logfromblammo 11y ago
      Why is that a bad idea? If you sell to one of them, you will most certainly get paid in full and on time. Or were you thinking that they would try to bust you for illegal hacking instead?
- brbsix 11y ago
  I assume you're wondering about the black market? Traditionally, Russian and Eastern European carder forums. In the golden age of Western Union and Moneygram... More recently, dark web markets over TOR with multi-sig cryptocurrency escrow.
- benmmurphy 11y ago
  for exploits that don't target a single deployed instance there is a 'grey/white' market. off the top of my head: ZDI (more defence oriented. i think they distribute just signatures for intrusion detection), Zerodium (more offence oriented), Exodus Intel EIP (not really sure.. they distribute a feed)
vbezhenar 11y ago
Another factor is that when you are buying on black market, you can't be sure whether you are buying real exploit or fake one. Exploit owner probably will request (irreversible) bitcoin payment, will communicate via anonymous channels and is unlikely to give out details about that exploit until he's got his money. So both sides have difficulty trusting each other. Probably solution is some trusted 3-rd party, but is there one in black market? It's hard to imagine, actually.
- rwmj 11y ago
  Not really - a Facebook attack can be proven without revealing the details. eg. The buyer could ask "give me a list of the friends of <non-public account>" or "make a fake posting with <this content> authored by <this user>".
  - myhandy 11y ago
    Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
  - myhandy 11y ago
    Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
  - myhandy 11y ago
    Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
- brbsix 11y ago
  Even if you aren't able to receive some sort of sample proof of work (which is probably not the case with this exploit), you can still mitigate the risk by ensuring the seller has high status in the marketplace and/or is willing to use escrow (or preferably multi-sig) to ensure funds are only released upon receipt.
kzhahou 11y ago
> Make no mistake, Facebook has probably done this math very carefully when choosing a bounty. Having worked at several similar companies, I'm guessing it went like this: "How much should bounty be? Is $5K good?" "Wow, that's nothing. At least make it something meaningful like 25 grand." "Yeah....that's gonna be tough. How about split the difference? $15K" "Sure."
Ntrails 11y ago
You forget to normalise by the uncertainty of payment in the blackhat case and the probability of repercussions. Not to mention the possibility of selling the same thing to multiple black hat buyers.

by mabbo 11y ago

baddox 11y ago

From this article I get the impression that the bounty wasn't even known before hand. It doesn't seem like a very careful consideration from Facebook, and I would expect it to be "too low" if they're choosing the amount after someone has already disclosed the bug.

ktRolster 11y ago

In other words, if you wanted to game the odds, you'd start by offering it on the black market, then if there were no takers after X number of days, offer it to Facebook?

tptacek 11y ago
It is unlikely that there is any black market for this bug, or for the RCE that compromised Facebook's crypto secrets. https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173
- ktRolster 11y ago
  Yeap, you're right. These guys at least aren't paying a bounty for Facebook/Google bugs: https://www.zerodium.com/program.html https://www.zerodium.com/program.html
  - tptacek 11y ago
    Like Dylan says, people will pay for web server software bugs, if the software is widely installed, because you can make money by building and grooming a fleet of compromised servers. There is a way to do it, and that way works. There is not a good, reliable way to make money from Facebook account takeover. You can conceive of them speculatively, but that is not the same thing as knowing you can execute, or, better, already having a business process in place that is already executing, just waiting for a new bug.
    - CiPHPerCoder 11y ago
      Your comments make sense in the real world, where the big threat is "criminal enterprise looking to make an illicit buck". I worry that people are too obsessed about the hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun, rather than for a pay-off, e.g. ZF0.
      - nemothekid 11y ago
        >* hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun* I'd assume having $15k to spend is a lot more fun than any enjoyment one could have by hacking someone's facebook account. You'd have to have a real vendetta against someone to value ruining their life at $15k.
        brbsix 11y ago
        For a political hit, $15k might be a very reasonable valuation.
        11y ago

cookiemonsta 11y ago

where do people even go to start to sell an exploit? how does that kind of stuff work?

DigitalJack 11y ago
same place as silk road.
- amelius 11y ago
  Not sure if this is a good idea. Probably lots of undercover three-letter government agents lurking there.
  - logfromblammo 11y ago
    Why is that a bad idea? If you sell to one of them, you will most certainly get paid in full and on time. Or were you thinking that they would try to bust you for illegal hacking instead?
brbsix 11y ago
I assume you're wondering about the black market? Traditionally, Russian and Eastern European carder forums. In the golden age of Western Union and Moneygram... More recently, dark web markets over TOR with multi-sig cryptocurrency escrow.
benmmurphy 11y ago
for exploits that don't target a single deployed instance there is a 'grey/white' market. off the top of my head: ZDI (more defence oriented. i think they distribute just signatures for intrusion detection), Zerodium (more offence oriented), Exodus Intel EIP (not really sure.. they distribute a feed)

vbezhenar 11y ago

Another factor is that when you are buying on black market, you can't be sure whether you are buying real exploit or fake one. Exploit owner probably will request (irreversible) bitcoin payment, will communicate via anonymous channels and is unlikely to give out details about that exploit until he's got his money. So both sides have difficulty trusting each other. Probably solution is some trusted 3-rd party, but is there one in black market? It's hard to imagine, actually.

rwmj 11y ago
Not really - a Facebook attack can be proven without revealing the details. eg. The buyer could ask "give me a list of the friends of <non-public account>" or "make a fake posting with <this content> authored by <this user>".
- myhandy 11y ago
  Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
- myhandy 11y ago
  Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
- myhandy 11y ago
  Problem with that us the buyer could be FB Sec. Now they have a targeted account to watch and find the vuln. themselves. Better option is to find a random famous person and do the sane thing.
brbsix 11y ago
Even if you aren't able to receive some sort of sample proof of work (which is probably not the case with this exploit), you can still mitigate the risk by ensuring the seller has high status in the marketplace and/or is willing to use escrow (or preferably multi-sig) to ensure funds are only released upon receipt.

kzhahou 11y ago

> Make no mistake, Facebook has probably done this math very carefully when choosing a bounty. Having worked at several similar companies, I'm guessing it went like this: "How much should bounty be? Is $5K good?" "Wow, that's nothing. At least make it something meaningful like 25 grand." "Yeah....that's gonna be tough. How about split the difference? $15K" "Sure."

Ntrails 11y ago

You forget to normalise by the uncertainty of payment in the blackhat case and the probability of repercussions. Not to mention the possibility of selling the same thing to multiple black hat buyers.