3 ms·

This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract t

by vxNsr 9y ago

This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract that specifies objectives and compensation. But these bounty programs that leave all the power in the hands of the company just aren't really a great idea. I wonder how many times something like this happened and it went unreported because the hacker just didn't want to sink more time into something that clearly wasn't paying out.

ztjio 9y ago
Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies? It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.
- bangonkeyboard 9y ago
  Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability. Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1] [0]: https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after... [1]: https://twitter.com/KhaosT/status/943283519119179776 https://twitter.com/KhaosT/status/943283519119179776
  - pixl97 9y ago
    And this kids, is why blackhats are selling your vulns to other blackhats.
  - ztjio 9y ago
    Clearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program. I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.
phyzome 9y ago
Lots of bug bounty programs work out great! But there are a couple of companies I would never try to get a bug bounty from, based on their reputations. Oracle is one, for being litigious fuckwads; Uber is another, for literally everything they do and say.
typomatic 9y ago
There are good programs, but this reveals that you shouldn't trust HackerOne as far as you can throw them
phamilton 9y ago
I work with HackerOne as an employee of a company with a bug bounty program. We're pretty sensitive about pissing off submitters. We're pretty strict about honoring our scope. Even if we know about a vulnerability, if we haven't specifically excluded it then we usually pay out (except duplicates where we have already paid out for it). I've seen many submitters respond with something along the lines of "thanks for the quick payout, I'm going to spend more time on your product". We want submitters to spend time finding issues for us. Thats why we set up the program. It's important to our brand that we don't have security issues and we recognize that a few thousand dollar payout to HackerOne is much cheaper than the potential legal bill if we were compromised.

by vxNsr 9y ago

ztjio 9y ago

Are you basing this opinion on this one account? I would like to point out that Uber has a history of sleaze and would absolutely not use their behavior to judge any such programs. Are there other well described, similar instances of such poor behavior from legitimate companies? It seems to me that most of the bigger corps offering bug bounties may be paying too little but at least they follow their own rules.

bangonkeyboard 9y ago
Khaos Tian published a writeup a few days ago about how he discovered a wide-open HomeKit vulnerability [0]. He reported it properly months prior, but Apple ignored his followups and was unresponsive. After this extended radio silence, Tian reached out to a media contact. Within hours of being contacted by the website, Apple finally pushed a hotfix for the vulnerability. Apple subsequently denied Tian access to their bug bounty program because going to the press "voided the qualification for the invitation." [1] [0]: https://medium.com/@khaost/your-home-was-not-so-secure-after-all-af52fbd6777c https://medium.com/@khaost/your-home-was-not-so-secure-after... [1]: https://twitter.com/KhaosT/status/943283519119179776 https://twitter.com/KhaosT/status/943283519119179776
- pixl97 9y ago
  And this kids, is why blackhats are selling your vulns to other blackhats.
- ztjio 9y ago
  Clearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program. I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.

phyzome 9y ago

Lots of bug bounty programs work out great! But there are a couple of companies I would never try to get a bug bounty from, based on their reputations. Oracle is one, for being litigious fuckwads; Uber is another, for literally everything they do and say.

typomatic 9y ago

There are good programs, but this reveals that you shouldn't trust HackerOne as far as you can throw them

phamilton 9y ago

I work with HackerOne as an employee of a company with a bug bounty program. We're pretty sensitive about pissing off submitters. We're pretty strict about honoring our scope. Even if we know about a vulnerability, if we haven't specifically excluded it then we usually pay out (except duplicates where we have already paid out for it). I've seen many submitters respond with something along the lines of "thanks for the quick payout, I'm going to spend more time on your product". We want submitters to spend time finding issues for us. Thats why we set up the program. It's important to our brand that we don't have security issues and we recognize that a few thousand dollar payout to HackerOne is much cheaper than the potential legal bill if we were compromised.