5 ms·

Do only I think that the rewards of 2000, 0 and 500 are incredibly low? The motivation is much higher to keep the bug for yourself and create several 10 000 e

Do only I think that the rewards of 2000, 0 and 500 are incredibly low? The motivation is much higher to keep the bug for yourself and create several 10 000 easily before anyone ever would notice.

lisivka 10y ago
If price per bug will be increased, then there will be motivation among developers to create bugs and sell them to bug hunters.
- kowdermeister 10y ago
  Are you referring to highly paid Google, FB engineers? A few thousand extra bucks totally worth risking your job and possible jail time.
a_imho 10y ago
Abusing a bug is not really worth it imo, otoh reporting it through a bug bounty seems like borderline scam. $500 for bugs supposedly top engineers missed and you worked on for days (e.g. communicating with the respective teams can take up considerable time) is a measly return. I get that money might not be the main concern here, but people could really negotiate a fee before disclosing the details. Lowballing this hard is mildly insulting imo.
- paulpauper 10y ago
  'Negotation' can be interpreted as exortion or blackmail. Bug bounties do not seem worth it unless there is no obvious way to make money or you have more to lose by exploting it than disclosing
  - deleted 10y ago
    [deleted]
  - Cpoll 10y ago
    Not quite. Blackmail is defined as demanding money in order to not reveal something. As long as there's no threat of selling the exploit to another party, there's nothing illegal about it.
- wineisfine 10y ago
  On the other hand, it gives the author credibility and it's probably good for finding a good job.
  - nommm-nommm 10y ago
    And the write-ups drives lots of traffic to their blog which could be monetized. Additionally they can get speaking engagements from it. Saw a talk on bug bounties a while ago. The people getting the most bounties are on India.
paulpauper 10y ago
the risk I suppose would be getting caught. I'm sure quarterly fin. auditing would detect something abnormal after awhile
eli 10y ago
Only if you're motivated solely by money. In which case you'd frankly be better doing neither and getting a more conventional job.
tedunangst 10y ago
As they explained, the bug doesn't affect other users. There's no data compromise.
morgante 10y ago
I'm surprised they got anything at all. A few hundred dollars a year is nothing for these companies, not to mention that if you actually tried to abuse this to a substantial level I am 100% confident that it would be detected and blocked. It's like filing a bug bounty that you can sign up for multiple AWS accounts and mine bitcoins in the free tier. Up to a certain level, they just don't care. Past that level, you'll be detected and mitigated against.
- MichaelBurge 10y ago
  I agree: the main problem with security vulnerabilities is that your users' data gets leaked and it blows up in the media. If you just lose some money, you can budget for that right next to the risk somebody throws rocks in your window or the risk that somebody steals the company car.
- freyr 10y ago
  > if you actually tried to abuse this to a substantial level I am 100% confident that it would be detected and blocked. Yes, Facebook sounded quite confident that such attempts would be detected and blocked. It seemed like they gave him bounty just to get him out of their hair.
- imaginenore 10y ago
  Doesn't AWS require a working credit card to start using the free tier?
  - neurostimulant 10y ago
    They also accept prepaid debit card. I use one in my account.
MichaelGG 10y ago
I used to think this. I have exploits that I can make a ton of money off of (exploiting phone systems). The only issue is that in order to generate money, I need to do illegal things. To sell these exploits, I need to find a criminal buyer. It's like noticing that you can rob people by hacking their smart-lock. It's hard to out-pay criminal activity. In this case, the attacker would be committing fraud by repeatedly causing calls. But they can probably get away with it. They'll just get cut off. Especially with premium ($0.50+) numbers from more exotic locales - it's too hard to chase people down and prove it. Heck, a US company I advised for lost $90K to a guy in Quebec and it was too hard to go bother going after him. We thought about it for about 30 minutes than just gave up.
Buge 10y ago
They mention that they have monitoring that would quickly notify people if any significant amounts of money started to be stolen.

Do only I think that the rewards of 2000, 0 and 500 are incredibly low? The motivation is much higher to keep the bug for yourself and create several 10 000 easily before anyone ever would notice.

lisivka 10y ago

If price per bug will be increased, then there will be motivation among developers to create bugs and sell them to bug hunters.

kowdermeister 10y ago
Are you referring to highly paid Google, FB engineers? A few thousand extra bucks totally worth risking your job and possible jail time.

a_imho 10y ago

Abusing a bug is not really worth it imo, otoh reporting it through a bug bounty seems like borderline scam. $500 for bugs supposedly top engineers missed and you worked on for days (e.g. communicating with the respective teams can take up considerable time) is a measly return. I get that money might not be the main concern here, but people could really negotiate a fee before disclosing the details. Lowballing this hard is mildly insulting imo.

paulpauper 10y ago
'Negotation' can be interpreted as exortion or blackmail. Bug bounties do not seem worth it unless there is no obvious way to make money or you have more to lose by exploting it than disclosing
- deleted 10y ago
  [deleted]
- Cpoll 10y ago
  Not quite. Blackmail is defined as demanding money in order to not reveal something. As long as there's no threat of selling the exploit to another party, there's nothing illegal about it.
wineisfine 10y ago
On the other hand, it gives the author credibility and it's probably good for finding a good job.
- nommm-nommm 10y ago
  And the write-ups drives lots of traffic to their blog which could be monetized. Additionally they can get speaking engagements from it. Saw a talk on bug bounties a while ago. The people getting the most bounties are on India.

paulpauper 10y ago

the risk I suppose would be getting caught. I'm sure quarterly fin. auditing would detect something abnormal after awhile

eli 10y ago

Only if you're motivated solely by money. In which case you'd frankly be better doing neither and getting a more conventional job.

tedunangst 10y ago

As they explained, the bug doesn't affect other users. There's no data compromise.

morgante 10y ago

I'm surprised they got anything at all. A few hundred dollars a year is nothing for these companies, not to mention that if you actually tried to abuse this to a substantial level I am 100% confident that it would be detected and blocked. It's like filing a bug bounty that you can sign up for multiple AWS accounts and mine bitcoins in the free tier. Up to a certain level, they just don't care. Past that level, you'll be detected and mitigated against.

MichaelBurge 10y ago
I agree: the main problem with security vulnerabilities is that your users' data gets leaked and it blows up in the media. If you just lose some money, you can budget for that right next to the risk somebody throws rocks in your window or the risk that somebody steals the company car.
freyr 10y ago
> if you actually tried to abuse this to a substantial level I am 100% confident that it would be detected and blocked. Yes, Facebook sounded quite confident that such attempts would be detected and blocked. It seemed like they gave him bounty just to get him out of their hair.
imaginenore 10y ago
Doesn't AWS require a working credit card to start using the free tier?
- neurostimulant 10y ago
  They also accept prepaid debit card. I use one in my account.

MichaelGG 10y ago

I used to think this. I have exploits that I can make a ton of money off of (exploiting phone systems). The only issue is that in order to generate money, I need to do illegal things. To sell these exploits, I need to find a criminal buyer. It's like noticing that you can rob people by hacking their smart-lock. It's hard to out-pay criminal activity. In this case, the attacker would be committing fraud by repeatedly causing calls. But they can probably get away with it. They'll just get cut off. Especially with premium ($0.50+) numbers from more exotic locales - it's too hard to chase people down and prove it. Heck, a US company I advised for lost $90K to a guy in Quebec and it was too hard to go bother going after him. We thought about it for about 30 minutes than just gave up.

Buge 10y ago

They mention that they have monitoring that would quickly notify people if any significant amounts of money started to be stolen.