5 ms·

$1337 is not enough money. A bug like this if used secretly and correctly could have made millions easily.

TomAnthony 9y ago
I think if it worked more broadly (I couldn't test without risk at that point) you could make decent money off of this just through affiliate programs. I've been doing research like this for 5+ years, and you go in knowing most if it won't lead to anything. I'd hoped for more, but I could have simply failed again and got nothing! :) As I've said below, I'd have reported it anyway even without a bounty; however I probably wouldn't have done the research in the first place were there not a bug bounty programme. I've previously had 2 bounties from Google. One was an easy find and was also $1337. The other was more technical but still straight forward and also played to SEO and got $5000 - in that instance Matt Cutts was involved and I believe advocated for the amount (thanks, Matt!). This was far more impactful than that other issue, and more directly monetisable.
- downandout 9y ago
  I do have to ask...were you at all tempted to try to monetize this? The guys in the BHW thread aren’t wrong about the potential. I applaud you for taking the high road, I’m just curious if the thought of giving away probably low six figures/day for $1337 nags at you at all.
  - TomAnthony 9y ago
    It is a good question. I wouldn't have monetised this and would have still report it, because doing so would hurt legitimate businesses (by pushing them out of the results). However, I have to admit it does nag at me a bit that the bounty is so small - it is like they are trying to send a message but I'm just not sure what it is! I have done loads of research over the last 5 years (this exploit took me a couple of months to craft) and most comes to nothing, and then when I do find something big that the bounty is so small is frustrating. A bigger bounty would have made a meaningful difference to me (kids+no savings!). The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer.
    - downandout 9y ago
      The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer. Agreed. Relative to the value of exercising this exploit, your bounty is missing a few 0’s at the end. I hope that you at least get some professional credit for this, and that it translates to a financial boost. You certainly deserve it for discovering something like this and doing the right thing with it.
    - emerongi 9y ago
      This is a straight-up 100k-500k bug. If I were to discover this bug and know I'd only get $1k and be a "good guy" vs. getting millions, well... The fact is that these bug bounty programs should start paying competitive prices. They can lowball it by 10x-20x at most, but lowballing by 1000x leads to people just giving up their ethics.
      - um_ya 9y ago
        Almost as if a bug bounty program should show the effect of the bug before explaining how it works. Then, Google will be more inclined to pay more if it wants the info on how the bug works.
    - brownbat 9y ago
      The cybersecurity research community should solicit some sort of endowment, like a Nobel Prize, that goes to deserving WH bug discoveries each year. Uncovering bugs that aren't attached to bug bounty programs still has external benefits for the security community. Thanks for your work here, even without such a program.
verroq 9y ago
Can you explain how you can make millions with this?
- TomAnthony 9y ago
  Maybe not millions, but you could make a decent chunk of money in a number of ways. The obvious 'easy' one would be to spin up affiliate sites and rank quickly and easily for competitive terms (with a site that does not deserve to rank), by hijacking the equity (PageRank essentially) of one site and using it to rank in another region. For example I could leverage the equity of a US made second hand car marketplace and to rank my site in the UK and list UK Autotrader listings on my site. They have a nice affiliate program for clicks/leads. Alternatively, I may only operate in one country but I could 'top up' by equity by leeching it from a company in a similar niche in another country. My competitors in my home country would be at a loss to how I'm ranking so well. It should be noted that there are a number of parameters that may change between my initial experiment and these uses, so we'll never know how viable it really was.
  - TomAnthony 9y ago
    There are a number of people lamenting about this 'missed opportunity' (and calling me some colourful names!) here: https://www.blackhatworld.com/seo/immediately-be-in-the-top-results-for-money-terms-in-the-us.1018533/ https://www.blackhatworld.com/seo/immediately-be-in-the-top-...
    - tclancy 9y ago
      And republishing the article in full! Some people got no class.
    - anonnel 9y ago
      That’s really epic :)
  - tagoog_2323 9y ago
    You could absolutely make millions off this. Getting to Google's fist SERP for popular terms gives you huge amount of very high quality, free traffic. Once this traffic lands in your site, you can use either CPM ads, sell the traffic on CPC basis or just redirect through affiliate links to the searched product. It will be HIGHLY profitable since the traffic is essentially free.

I think if it worked more broadly (I couldn't test without risk at that point) you could make decent money off of this just through affiliate programs. I've been doing research like this for 5+ years, and you go in knowing most if it won't lead to anything. I'd hoped for more, but I could have simply failed again and got nothing! :) As I've said below, I'd have reported it anyway even without a bounty; however I probably wouldn't have done the research in the first place were there not a bug bounty programme. I've previously had 2 bounties from Google. One was an easy find and was also $1337. The other was more technical but still straight forward and also played to SEO and got $5000 - in that instance Matt Cutts was involved and I believe advocated for the amount (thanks, Matt!). This was far more impactful than that other issue, and more directly monetisable.

downandout 9y ago
I do have to ask...were you at all tempted to try to monetize this? The guys in the BHW thread aren’t wrong about the potential. I applaud you for taking the high road, I’m just curious if the thought of giving away probably low six figures/day for $1337 nags at you at all.
- TomAnthony 9y ago
  It is a good question. I wouldn't have monetised this and would have still report it, because doing so would hurt legitimate businesses (by pushing them out of the results). However, I have to admit it does nag at me a bit that the bounty is so small - it is like they are trying to send a message but I'm just not sure what it is! I have done loads of research over the last 5 years (this exploit took me a couple of months to craft) and most comes to nothing, and then when I do find something big that the bounty is so small is frustrating. A bigger bounty would have made a meaningful difference to me (kids+no savings!). The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer.
  - downandout 9y ago
    The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer. Agreed. Relative to the value of exercising this exploit, your bounty is missing a few 0’s at the end. I hope that you at least get some professional credit for this, and that it translates to a financial boost. You certainly deserve it for discovering something like this and doing the right thing with it.
  - emerongi 9y ago
    This is a straight-up 100k-500k bug. If I were to discover this bug and know I'd only get $1k and be a "good guy" vs. getting millions, well... The fact is that these bug bounty programs should start paying competitive prices. They can lowball it by 10x-20x at most, but lowballing by 1000x leads to people just giving up their ethics.
    - um_ya 9y ago
      Almost as if a bug bounty program should show the effect of the bug before explaining how it works. Then, Google will be more inclined to pay more if it wants the info on how the bug works.
  - brownbat 9y ago
    The cybersecurity research community should solicit some sort of endowment, like a Nobel Prize, that goes to deserving WH bug discoveries each year. Uncovering bugs that aren't attached to bug bounty programs still has external benefits for the security community. Thanks for your work here, even without such a program.

verroq 9y ago

Can you explain how you can make millions with this?

TomAnthony 9y ago
Maybe not millions, but you could make a decent chunk of money in a number of ways. The obvious 'easy' one would be to spin up affiliate sites and rank quickly and easily for competitive terms (with a site that does not deserve to rank), by hijacking the equity (PageRank essentially) of one site and using it to rank in another region. For example I could leverage the equity of a US made second hand car marketplace and to rank my site in the UK and list UK Autotrader listings on my site. They have a nice affiliate program for clicks/leads. Alternatively, I may only operate in one country but I could 'top up' by equity by leeching it from a company in a similar niche in another country. My competitors in my home country would be at a loss to how I'm ranking so well. It should be noted that there are a number of parameters that may change between my initial experiment and these uses, so we'll never know how viable it really was.
- TomAnthony 9y ago
  There are a number of people lamenting about this 'missed opportunity' (and calling me some colourful names!) here: https://www.blackhatworld.com/seo/immediately-be-in-the-top-results-for-money-terms-in-the-us.1018533/ https://www.blackhatworld.com/seo/immediately-be-in-the-top-...
  - tclancy 9y ago
    And republishing the article in full! Some people got no class.
  - anonnel 9y ago
    That’s really epic :)
- tagoog_2323 9y ago
  You could absolutely make millions off this. Getting to Google's fist SERP for popular terms gives you huge amount of very high quality, free traffic. Once this traffic lands in your site, you can use either CPM ads, sell the traffic on CPC basis or just redirect through affiliate links to the searched product. It will be HIGHLY profitable since the traffic is essentially free.