5 ms·

Experience with PornHub's bug bounty: Scornhub

162 points by dlgeek 10y ago

eprime 10y ago
Do hackers seek to make a living off bounties? It seems as if they just want a good, rewarding, motivating experience. To be treated with respect and to get the recognition they want. $50 for a vulnerability appears very low for this. Looking in the hackerone site, some companies publish how much they give to the hackers and most have a much more generous minimum reward.
- fratlas 10y ago
  Anecdotal, but I've heard friends of friends who earn 6 figure salaries worth of bounties for corporations, although some sound more like consultation type gigs.
- mathgeek 10y ago
  Part of the equation is that companies offering bounties need to compete with entities who also offer rewards for said knowledge.
  - mordechai9000 10y ago
    I'd hope that some people, at least, actually want to fix problems and gain respect in their field. As opposed to engaging in criminal activity and selling out to the highest bidder.
    - santoshalper 10y ago
      People who want to gain professional respect are probably going to stay away from a pornhub bounty - I am not anti-porn, but I wouldn't put it on my resume either. Also, regardless of good intentions at the start, once the company has screwed you over. I am sure it is tempting to return the favor with the next vulnerability you find.
    - mabbo 10y ago
      It's easy to say "I do it for the respect, not the money" when you have enough money to get by. There's plenty of guys out there who are searching for hacks like this because they need to feed their kids. I won't criticize them for selling bugs to nefarious entities. Bug bounties aren't for guys like us who don't need the money.
    - mathgeek 10y ago
      > I'd hope that some people, at least, actually want to fix problems and gain respect in their field. Naturally. Of course you must assume that some people don't.
- cyphar 10y ago
  I have friends that made their living off bug bounties for a few years. Eventually they get jobs at security firms, but sometimes you can't get a job without having some proof of experience.
amjo324 10y ago
This is one of those cases where it's the responsibility of the bug bounty platform operator (HackerOne) to ensure that its customer (PornHub) deals appropriately with bug bounty participants. If PornHub doesn't offer a clear scope and fair reward for effort, penetration testers may be disillusioned with the HackerOne brand also and choose not to partake in other bug bounty programs it oversees. And of course the platform cannot thrive without a large number of skilled and active testers.
- dTal 10y ago
  "PornHub penetration tester" would look... interesting on a resume.
  - deleted 10y ago
    [deleted]
  - stuxnet79 10y ago
    Once you have worked as a dev for at least one porno company you are pretty much pigeonholed in the industry.
    - kyllo 10y ago
      And that means you have to use PHP forever.
      - therein 10y ago
        This is so true. I work for a large social network and we recently got an email from an employee of a particular porn streaming company. They wanted to implement this new web compression protocol/algorithm into their systems and they had heard that we were doing the same. Our solution involved writing Apache Traffic Server plugins and achieving high throughput. Their solution involved using PHP to execute the demo cli tool that came with the library and pass it the content they wanted to encode.
  - ryanbertrand 10y ago
Arcane_NH 10y ago
Hope they have patched everything reported and not paid for, because I'm sure there are other parties who would find that information valuable.
droopybuns 10y ago
Another grumbly hacker complaining about a bug bounty undervaluing their work. It wasnt long ago that notifying a company that they had a vuln was an act that risked prosecution. Bug bounties are a release valve. They are not a substitute for a job. They will never pay the same as crime. Writeups like this are not going to facilitate relationships with leaders in the security industry. This post and others like them are embarrassingly naive.
- tomjen3 10y ago
  Who cares about "facilitating relationships"? Thats a load of bullshit words. They offered an amount of money in exchange for some information, then neglected their responsibility. Yeah you used to risk prosecution for doing stuff like that, then the site owners realized how brain dead that was and now they are trying to have a normal relationship because it is a huge bonus for them, not because they give a shit about the people who helped them out.
- corndoge 10y ago
  Money is money. Offer $25k and a researcher gets RCE on the vast majority of your scoped boxes, you better pay a substantial portion of that $25k. Shame on PornHub, I'll be using xvideos from now on.
- tshadwell 10y ago
  That's an amazingly regressive point of view. Sure, in the past such things risked prosecution but why exactly does it mean we have to figuratively knock stones together on vulnerability ethics? When cars were invented, a man had to run in front of the car with a red flag to warn others of it. In 2016, everyone deserves privacy and security on the internet. We know and understand the dangers of vulnerabilities better, and I think we should be capable of having some respect and suitably compensating those who do the right thing. If you can make the internet a more secure place for us to live our lives and make enough to live out of it, more power to you.
- ryanlol 10y ago
  This would make sense if selling such bugs was explicitly illegal, but it isn't.

162 points by dlgeek 10y ago

Do hackers seek to make a living off bounties? It seems as if they just want a good, rewarding, motivating experience. To be treated with respect and to get the recognition they want. $50 for a vulnerability appears very low for this. Looking in the hackerone site, some companies publish how much they give to the hackers and most have a much more generous minimum reward.

fratlas 10y ago
Anecdotal, but I've heard friends of friends who earn 6 figure salaries worth of bounties for corporations, although some sound more like consultation type gigs.
mathgeek 10y ago
Part of the equation is that companies offering bounties need to compete with entities who also offer rewards for said knowledge.
- mordechai9000 10y ago
  I'd hope that some people, at least, actually want to fix problems and gain respect in their field. As opposed to engaging in criminal activity and selling out to the highest bidder.
  - santoshalper 10y ago
    People who want to gain professional respect are probably going to stay away from a pornhub bounty - I am not anti-porn, but I wouldn't put it on my resume either. Also, regardless of good intentions at the start, once the company has screwed you over. I am sure it is tempting to return the favor with the next vulnerability you find.
  - mabbo 10y ago
    It's easy to say "I do it for the respect, not the money" when you have enough money to get by. There's plenty of guys out there who are searching for hacks like this because they need to feed their kids. I won't criticize them for selling bugs to nefarious entities. Bug bounties aren't for guys like us who don't need the money.
  - mathgeek 10y ago
    > I'd hope that some people, at least, actually want to fix problems and gain respect in their field. Naturally. Of course you must assume that some people don't.
cyphar 10y ago
I have friends that made their living off bug bounties for a few years. Eventually they get jobs at security firms, but sometimes you can't get a job without having some proof of experience.

amjo324 10y ago

This is one of those cases where it's the responsibility of the bug bounty platform operator (HackerOne) to ensure that its customer (PornHub) deals appropriately with bug bounty participants. If PornHub doesn't offer a clear scope and fair reward for effort, penetration testers may be disillusioned with the HackerOne brand also and choose not to partake in other bug bounty programs it oversees. And of course the platform cannot thrive without a large number of skilled and active testers.

dTal 10y ago
"PornHub penetration tester" would look... interesting on a resume.
- deleted 10y ago
  [deleted]
- stuxnet79 10y ago
  Once you have worked as a dev for at least one porno company you are pretty much pigeonholed in the industry.
  - kyllo 10y ago
    And that means you have to use PHP forever.
    - therein 10y ago
      This is so true. I work for a large social network and we recently got an email from an employee of a particular porn streaming company. They wanted to implement this new web compression protocol/algorithm into their systems and they had heard that we were doing the same. Our solution involved writing Apache Traffic Server plugins and achieving high throughput. Their solution involved using PHP to execute the demo cli tool that came with the library and pass it the content they wanted to encode.
- ryanbertrand 10y ago

Arcane_NH 10y ago

Hope they have patched everything reported and not paid for, because I'm sure there are other parties who would find that information valuable.

droopybuns 10y ago

Another grumbly hacker complaining about a bug bounty undervaluing their work. It wasnt long ago that notifying a company that they had a vuln was an act that risked prosecution. Bug bounties are a release valve. They are not a substitute for a job. They will never pay the same as crime. Writeups like this are not going to facilitate relationships with leaders in the security industry. This post and others like them are embarrassingly naive.

tomjen3 10y ago
Who cares about "facilitating relationships"? Thats a load of bullshit words. They offered an amount of money in exchange for some information, then neglected their responsibility. Yeah you used to risk prosecution for doing stuff like that, then the site owners realized how brain dead that was and now they are trying to have a normal relationship because it is a huge bonus for them, not because they give a shit about the people who helped them out.
corndoge 10y ago
Money is money. Offer $25k and a researcher gets RCE on the vast majority of your scoped boxes, you better pay a substantial portion of that $25k. Shame on PornHub, I'll be using xvideos from now on.
tshadwell 10y ago
That's an amazingly regressive point of view. Sure, in the past such things risked prosecution but why exactly does it mean we have to figuratively knock stones together on vulnerability ethics? When cars were invented, a man had to run in front of the car with a red flag to warn others of it. In 2016, everyone deserves privacy and security on the internet. We know and understand the dangers of vulnerabilities better, and I think we should be capable of having some respect and suitably compensating those who do the right thing. If you can make the internet a more secure place for us to live our lives and make enough to live out of it, more power to you.
ryanlol 10y ago
This would make sense if selling such bugs was explicitly illegal, but it isn't.