4 ms·

I posted below (and got hardly and irrationally downvoted) that $5,000 is a joke. And your comment and others don't change my mind. A CSRF vulnerability, lookin

by daraosn 10y ago

I posted below (and got hardly and irrationally downvoted) that $5,000 is a joke. And your comment and others don't change my mind. A CSRF vulnerability, looking forward to reading a post on a SQL Injection next time.. I worked doing bots on my school days when I was a kid, and I saw the gray/black market can be unfortunately extremely profitable. $5,000 is nothing, we're not talking about a little startup here, it's Facebook, and they do have resources. Have you ever seen nasty content on Facebook on your wall, been spammed or even hacked? It's because of these kind of vulnerabilities get breached. Of course they can happen, but $5,000 is nothing considering the economic impact that can have if someone exploits it badly. A PR campaign to fix a mess wouldn't cost a few thousands, rather a few millions. Again: kudos to the OP for posting this and doing things the right way (reporting to facebook), but again, sadly good developers are getting underpriced... PS: and by the way, I'm in no way circle jerking, this is not reddit, I'm here for a serious discussion on the topic.

raverbashing 10y ago
The price is not only what you can get on the black market, but it's also considering: - How likely it is for someone else to find it (even internally) - How long does it take for it to be identified and exploited, the impact of that, and time for mitigation/fixing
- daraosn 10y ago
  True, but it's also: - How much would it cost to repair the trust of the users if the breach occurs. PR, marketing, organizational costs Do you think a big company would pay $5k for a PR campaign to fix a mess due to a breach of private data? Not remotely.
  - raverbashing 10y ago
    It's always a question of probability: expected cost x expected probability gives you the end cost You don't lock a $1000 bike with an $1000 lock, maybe with a $100 lock though
    - deleted 10y ago
      [deleted]
tptacek 10y ago
As I said downthread, Facebook was the highest bidder for this interaction-required CSRF bug; the next-highest bidder would probably be $50. There is virtually no market at all for serverside bugs, because they have no half-life: as soon as they're detected, they stop working against all targets instantaneously. Contrast that with browser clientsides, which have long half-lives. A SQL injection bug in a Facebook service would not fetch much more than $50 from anyone but Facebook itself.

by daraosn 10y ago

raverbashing 10y ago

The price is not only what you can get on the black market, but it's also considering: - How likely it is for someone else to find it (even internally) - How long does it take for it to be identified and exploited, the impact of that, and time for mitigation/fixing

daraosn 10y ago
True, but it's also: - How much would it cost to repair the trust of the users if the breach occurs. PR, marketing, organizational costs Do you think a big company would pay $5k for a PR campaign to fix a mess due to a breach of private data? Not remotely.
- raverbashing 10y ago
  It's always a question of probability: expected cost x expected probability gives you the end cost You don't lock a $1000 bike with an $1000 lock, maybe with a $100 lock though
  - deleted 10y ago
    [deleted]

tptacek 10y ago

As I said downthread, Facebook was the highest bidder for this interaction-required CSRF bug; the next-highest bidder would probably be $50. There is virtually no market at all for serverside bugs, because they have no half-life: as soon as they're detected, they stop working against all targets instantaneously. Contrast that with browser clientsides, which have long half-lives. A SQL injection bug in a Facebook service would not fetch much more than $50 from anyone but Facebook itself.