4 ms·

> In late 2016 and early 2017 I became burned-out from hunting bugs as it became a race between some very talented researchers and I. For example Derrek and I s

> In late 2016 and early 2017 I became burned-out from hunting bugs as it became a race between some very talented researchers and I. For example Derrek and I spent 2 months auditing and coding up PoCs for some bugs in a wifi driver where nearly 95% of our reports were duplicates with the Chinese teams. It was becoming hard to compete with teams who do this 40 hours a week while I do it as a hobby over coffee on Saturday mornings. This isn't really the main focus of the article, but I find this really interesting. There are teams of full-time Chinese researchers looking for and reporting vulnerabilities in Android? Are they doing this to win the bug bounties? If so, it sounds like Google's bug bounty program is really paying off.

nobodyorother 9y ago
I hope it's Google's bug bounty program that's paying off.
- Ajedi32 9y ago
  If they were black-hat researchers, they wouldn't have reported the vulnerabilities to Google, and thus the researcher's reports wouldn't be considered duplicates. My guess is they're either working for the bug bounties, or they're employed by a company that uses Android extensively and wants to make sure its secure.
  - ac29 9y ago
    Exploring the acknowledgements [0] shows many of these Chinese researchers are working for the big internet firms there (Alibaba, Tencent, Baidu), so my guess is they are more motivated in securing Android for internal use than collecting bounties (its entirely possible they run their own AOSP-based Android builds for employee-provided hardware). Being China, its also possible that the Chinese government indirectly or directly sponsors this research, since Android is by far the most common smartphone OS there. edit: C0RE Team [1], who also has many contributions seems to be an independent research company, who may be doing it just for the bounties. [0] https://source.android.com/security/overview/acknowledgements https://source.android.com/security/overview/acknowledgement... [1] http://c0reteam.org/about.html http://c0reteam.org/about.html
    - wahern 9y ago
      An interesting exercise would be to compile notification dates with code commit dates, and then compare the average difference (notification date - commit date) among groups. If there's a discrepancy, then that's possible evidence one group might be hoarding bugs, or at least waiting for notification approval from, e.g., a domestic intelligence agency.
      - Cyphase 9y ago
        cue commit scrubbers
- gcb0 9y ago
  The article mention hundreds of thousands of lines of code, where they couldn't even find the entry point to begin debugging. In a single wifi driver (that's not even considering the firmware) sometimes infosec seems the most dreadful field.
jxramos 9y ago
that caught my eye too, anyone have a rough estimate for what sort of profitability one could expect from full time work in this field?
- ryanlol 9y ago
  If you're good at exploit dev? You can take however much money you want. https://www.reuters.com/article/us-bitfinex-hacked-hongkong/bitcoin-worth-72-million-stolen-from-bitfinex-exchange-in-hong-kong-idUSKCN10E0KP https://www.reuters.com/article/us-bitfinex-hacked-hongkong/... If you're a world class exploit developer working full time, expect earn a few hundred million $ per year. Of course there exists a whole industry full of people that'll offer you silly 6 digit salaries.
  - make3 9y ago
    source plz. for white hats, I mean
    - sirk1882 9y ago
      Probably depends on how willing you are to live and work in China.
    - ryanlol 9y ago
      Oh, I mean I guess you can probably find some country that'll be able to work out a profit-sharing agreement with you and allow you to legally steal money. https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogach... This guy is a good example of someone with a decent career in infosec operating on the right side of the law (Within his own jurisdiction, anyway). If you want to do charity reporting bugs, then you obviously will get paid like charity workers do.
      - tyingq 9y ago
        The question probably wasn't about whether an exploit specialist could net a lot of money, but rather, your claim of "a few hundred million $ per year". That's pretty extraordinary.
_pmf_ 9y ago
> There are teams of full-time Chinese researchers looking for and reporting vulnerabilities in Android? Are they doing this to win the bug bounties? I hope you are being sarcastic; guess again!

nobodyorother 9y ago

I hope it's Google's bug bounty program that's paying off.

Ajedi32 9y ago
If they were black-hat researchers, they wouldn't have reported the vulnerabilities to Google, and thus the researcher's reports wouldn't be considered duplicates. My guess is they're either working for the bug bounties, or they're employed by a company that uses Android extensively and wants to make sure its secure.
- ac29 9y ago
  Exploring the acknowledgements [0] shows many of these Chinese researchers are working for the big internet firms there (Alibaba, Tencent, Baidu), so my guess is they are more motivated in securing Android for internal use than collecting bounties (its entirely possible they run their own AOSP-based Android builds for employee-provided hardware). Being China, its also possible that the Chinese government indirectly or directly sponsors this research, since Android is by far the most common smartphone OS there. edit: C0RE Team [1], who also has many contributions seems to be an independent research company, who may be doing it just for the bounties. [0] https://source.android.com/security/overview/acknowledgements https://source.android.com/security/overview/acknowledgement... [1] http://c0reteam.org/about.html http://c0reteam.org/about.html
  - wahern 9y ago
    An interesting exercise would be to compile notification dates with code commit dates, and then compare the average difference (notification date - commit date) among groups. If there's a discrepancy, then that's possible evidence one group might be hoarding bugs, or at least waiting for notification approval from, e.g., a domestic intelligence agency.
    - Cyphase 9y ago
      cue commit scrubbers
gcb0 9y ago
The article mention hundreds of thousands of lines of code, where they couldn't even find the entry point to begin debugging. In a single wifi driver (that's not even considering the firmware) sometimes infosec seems the most dreadful field.

jxramos 9y ago

that caught my eye too, anyone have a rough estimate for what sort of profitability one could expect from full time work in this field?

ryanlol 9y ago
If you're good at exploit dev? You can take however much money you want. https://www.reuters.com/article/us-bitfinex-hacked-hongkong/bitcoin-worth-72-million-stolen-from-bitfinex-exchange-in-hong-kong-idUSKCN10E0KP https://www.reuters.com/article/us-bitfinex-hacked-hongkong/... If you're a world class exploit developer working full time, expect earn a few hundred million $ per year. Of course there exists a whole industry full of people that'll offer you silly 6 digit salaries.
- make3 9y ago
  source plz. for white hats, I mean
  - sirk1882 9y ago
    Probably depends on how willing you are to live and work in China.
  - ryanlol 9y ago
    Oh, I mean I guess you can probably find some country that'll be able to work out a profit-sharing agreement with you and allow you to legally steal money. https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogach... This guy is a good example of someone with a decent career in infosec operating on the right side of the law (Within his own jurisdiction, anyway). If you want to do charity reporting bugs, then you obviously will get paid like charity workers do.
    - tyingq 9y ago
      The question probably wasn't about whether an exploit specialist could net a lot of money, but rather, your claim of "a few hundred million $ per year". That's pretty extraordinary.

_pmf_ 9y ago

> There are teams of full-time Chinese researchers looking for and reporting vulnerabilities in Android? Are they doing this to win the bug bounties? I hope you are being sarcastic; guess again!