6 ms·

The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of

by meritt 11y ago

The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill. And I say this from personal experience. Two years ago I submitted a bug to a $10B+ public company which revealed the personal information (email, name, home address, phone) of ~145M users and they offered $10k. Another recent example to a $50B+ public company via HackerOne that exposed the same sort of data for ~77M users. They paid out $1k. I assumed they had left off a 0, but nope, they actually told me $1k was higher than their normal bounty due to the severity. Submitted a bug to a publicly traded food delivery company in the UK, which revealed detail order history (customer name, address, email, phone, partial CC #) for their entire platform. They offered me £500 in food delivery credit. All of my submissions have been purely in good faith and nothing at all resembling extortion, but I assure you there are thousands of bad actors out there far more skilled than I. And there's plenty of legal outlets for this information (depending on how it is accessed of course). Local governments and Lyft would love to know ridership usage details about Uber.

yeukhon 11y ago
I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and if I am lucky I can make extra dollars. I earned one big one, but in the second one the company did not honor the payment at all, but I was cool enough to let that shit go despite what I found was critical enough to destroy their product launch that night (basically elementary web vulnerability). Your statements are going to be attacked by the usual "you don't know shit, we have argued about this ten million times here on HN." Companies are not going to reward you with $1M (think about Instagram's 1M bug [0]). While you can't really sell this to the blackmarket and expect to overload people's credit card, this is still a P1 incident and requires a major bounty reward. I am not going to discuss about what happened in this case, but even if he did get paid he wouldn't be getting 1M. The reason is simple: there are a lot more people willing to play this game and many believe being on some Hall of Frame is a great addition to their security professional resume. [0]: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194
- meritt 11y ago
  Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free. And most of us do it purely for the challenge and fun, so the reward (if any) is oftentimes irrelevant. It's just there's such a large market for this sort of information (and I'm not talking about stolen credit cards, spam, fraud. Competitive intelligence is a huge industry) and there are many full-time security engineers whose only job is to find the holes some company is trying to outsource to bored programmers.
  - yeukhon 11y ago
    I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.
forrestthewoods 11y ago
The issue here is asymmetric knowledge. Someone needs to organize a website with prices and contact information for less savory types. If it becomes known that RussianHackers1337 will be pay $100,000 to Facebook's $15,000 this problem will solve itself real damn fast.
- yeukhon 11y ago
  But then wouldn't be a crime if you make a hint to FB to get leverage for more reward? Actually, before it turns into an authority call, FB would disqualify you right away.
bracewel 11y ago
> paltry $15k The tech/security community is crazy.
- malka 11y ago
  No. YOu have to compare that number to how much you could get for that exploit on the black market. 15K seems cheap for a critical bug on a major platform.
  - aianus 11y ago
    For many qualified technical people, $15k + recognition is worth more than $500k + guilt + possible prison / looking over your shoulder for years.
    - nostrebored 11y ago
      Well the parent seemed to miss the point -- the real calculus is cost to the company if the exploit were to be used effectively, monetary benefit to the person who finds the bug, and the recognition you'd get in the blackhat community.
      - Dwolb 11y ago
        Yes the payout calc by company is cost to the company of an exploit, but with a repeated game scenario. i.e. you can't look at the bug and payment in a vacuum, you have to factor in future bugs. So the cost is the value to the company for the exploited bug if used properly plus the expected value of future bugs. Which is weird, right? This shows companies can be internally incentivized to reduce bug bounty payments to show 'they are improving' when in fact, developers are leaving their bug bounty program.
  - tptacek 11y ago
    In virtually every case for these bug bounty programs, that number is zero dollars.
- acomjean 11y ago
dsacco 11y ago
>> It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill. Regardless of what you think about bug bounty valuation, it's not unfair. This has been rehashed so, so many times and rebuked by people like tptacek, thegrugq and myself that I'm just going to start pasting this comment whenever this sentiment comes up on HN: https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173 ... This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting. Let's examine the facts: 1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking. 2. A Facebook vulnerability will be patched once it is widely used. Facebook's security team is one of the strongest and most sophisticated of any company, and their processes would quickly catch this once it was used. The total impact of the bug would be negligible. You'd lose the ability to compromise accounts as soon as you tried to do it in any meaningful or lucrative way. 3. A vulnerability in Facebook might last a week before being patched, but a vulnerability in PHP will persist on the internet for years. No matter how many individual sites patch their servers, you'll still be able to pop a lonely server with social security numbers chugging along in a closet somewhere. There really isn't much more to say about this. People claim bounties awarded by Facebook/Google/et al are undervalued every single time a bug bounty hits the front page of HN. Every single time, someone who is in the security industry patiently explains why it's not that valuable. If someone tried to go to a blackhat group or go to the "black-market" (a shadowy, lucrative place that never seems to be very well-defined in these conversations), he would not even be able to find a seller, let alone one who would pay a lot. What do you imagine someone would pay for this on the black-market? They'd need to profit from it. How much profit is worth their time? Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook? The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software. For further reading: https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=8563884 https://news.ycombinator.com/item?id=8563884
venning 11y ago
I assume that Uber is not competing with black market interest in bugs, rather they are competing against interest in other bug bounty programs. The number of people who earnestly compare rates between bounty programs and black market buyers before deciding who to inform must be vanishingly small. However, the number of people who compare bounty rewards before deciding who to test against is likely much higher.

by meritt 11y ago

yeukhon 11y ago

I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and if I am lucky I can make extra dollars. I earned one big one, but in the second one the company did not honor the payment at all, but I was cool enough to let that shit go despite what I found was critical enough to destroy their product launch that night (basically elementary web vulnerability). Your statements are going to be attacked by the usual "you don't know shit, we have argued about this ten million times here on HN." Companies are not going to reward you with $1M (think about Instagram's 1M bug [0]). While you can't really sell this to the blackmarket and expect to overload people's credit card, this is still a P1 incident and requires a major bounty reward. I am not going to discuss about what happened in this case, but even if he did get paid he wouldn't be getting 1M. The reason is simple: there are a lot more people willing to play this game and many believe being on some Hall of Frame is a great addition to their security professional resume. [0]: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194

meritt 11y ago
Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free. And most of us do it purely for the challenge and fun, so the reward (if any) is oftentimes irrelevant. It's just there's such a large market for this sort of information (and I'm not talking about stolen credit cards, spam, fraud. Competitive intelligence is a huge industry) and there are many full-time security engineers whose only job is to find the holes some company is trying to outsource to bored programmers.
- yeukhon 11y ago
  I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.

forrestthewoods 11y ago

The issue here is asymmetric knowledge. Someone needs to organize a website with prices and contact information for less savory types. If it becomes known that RussianHackers1337 will be pay $100,000 to Facebook's $15,000 this problem will solve itself real damn fast.

yeukhon 11y ago
But then wouldn't be a crime if you make a hint to FB to get leverage for more reward? Actually, before it turns into an authority call, FB would disqualify you right away.

bracewel 11y ago

> paltry $15k The tech/security community is crazy.

malka 11y ago
No. YOu have to compare that number to how much you could get for that exploit on the black market. 15K seems cheap for a critical bug on a major platform.
- aianus 11y ago
  For many qualified technical people, $15k + recognition is worth more than $500k + guilt + possible prison / looking over your shoulder for years.
  - nostrebored 11y ago
    Well the parent seemed to miss the point -- the real calculus is cost to the company if the exploit were to be used effectively, monetary benefit to the person who finds the bug, and the recognition you'd get in the blackhat community.
    - Dwolb 11y ago
      Yes the payout calc by company is cost to the company of an exploit, but with a repeated game scenario. i.e. you can't look at the bug and payment in a vacuum, you have to factor in future bugs. So the cost is the value to the company for the exploited bug if used properly plus the expected value of future bugs. Which is weird, right? This shows companies can be internally incentivized to reduce bug bounty payments to show 'they are improving' when in fact, developers are leaving their bug bounty program.
- tptacek 11y ago
  In virtually every case for these bug bounty programs, that number is zero dollars.
acomjean 11y ago

dsacco 11y ago

>> It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill. Regardless of what you think about bug bounty valuation, it's not unfair. This has been rehashed so, so many times and rebuked by people like tptacek, thegrugq and myself that I'm just going to start pasting this comment whenever this sentiment comes up on HN: https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173 ... This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting. Let's examine the facts: 1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking. 2. A Facebook vulnerability will be patched once it is widely used. Facebook's security team is one of the strongest and most sophisticated of any company, and their processes would quickly catch this once it was used. The total impact of the bug would be negligible. You'd lose the ability to compromise accounts as soon as you tried to do it in any meaningful or lucrative way. 3. A vulnerability in Facebook might last a week before being patched, but a vulnerability in PHP will persist on the internet for years. No matter how many individual sites patch their servers, you'll still be able to pop a lonely server with social security numbers chugging along in a closet somewhere. There really isn't much more to say about this. People claim bounties awarded by Facebook/Google/et al are undervalued every single time a bug bounty hits the front page of HN. Every single time, someone who is in the security industry patiently explains why it's not that valuable. If someone tried to go to a blackhat group or go to the "black-market" (a shadowy, lucrative place that never seems to be very well-defined in these conversations), he would not even be able to find a seller, let alone one who would pay a lot. What do you imagine someone would pay for this on the black-market? They'd need to profit from it. How much profit is worth their time? Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook? The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software. For further reading: https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=8563884 https://news.ycombinator.com/item?id=8563884

venning 11y ago

I assume that Uber is not competing with black market interest in bugs, rather they are competing against interest in other bug bounty programs. The number of people who earnestly compare rates between bounty programs and black market buyers before deciding who to inform must be vanishingly small. However, the number of people who compare bounty rewards before deciding who to test against is likely much higher.