8 ms·

I found an exploit like this in Google+ back in 2013 that worked in basically the same fashion (script tag and onload/onerror handlers) to identify users, and t

I found an exploit like this in Google+ back in 2013 that worked in basically the same fashion (script tag and onload/onerror handlers) to identify users, and to tell if they were apart of certain groups. Google fixed the issue, but later wrote back: > The panel has determined your report did not meet the threshold for a reward or credit in our Hall of Fame. Thank you for reporting this issue and good luck with your continued bug hunting. That always kind of rubbed me the wrong way. I found a similar bug in Facebook [1], though it used image size instead of the script tag. Like the OP, I was given $1000. It definitely made me feel a lot more favorable towards Facebook's security team. [1] http://patorjk.com/blog/2013/03/01/facebook-user-identification-bug/ http://patorjk.com/blog/2013/03/01/facebook-user-identificat...

eveningcoffee 8y ago
How much did Google offer for a security bug (if they would have accepted it)?
- tptacek 8y ago
  It very much depends on the bug.
- chipperyman573 8y ago
  A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero" http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/ http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-byp...
  - tptacek 8y ago
    That's a really good bug! But $5k sounds pretty reasonable, since the only alternative market for it comes with pretty obscene legal risk (unlike an RCE, which will have a whole variety of white- and grey- market buyers, an SEO bug seller knows exactly what their buyer is doing with their work).
    - wolco 8y ago
      If you are in this business you are already connected with grey/black elements. Probably less risky than initially seems.
      - Izmaki 8y ago
        Plus I think it's safe to assume that they can handle themselves, anonymity wise. Tor and bitcoin is not rocket science
    - TomAnthony 8y ago
      OP here. Really interesting to get your take on that. From my (far less security educated) POV the Google XML bug felt less risky from a monetisation angle. I guess the difference is between exploiting it yourself vs selling it. There was a clear path to monetisation that didn't require selling the exploit on the black market, and which could well fly under the radar (from my reasonably well educated SEO POV). However, I don't think bug bounties necessarily need to equal the 'market value' of the bug, whatever that means.
      - tptacek 8y ago
        The logic I'd use is that selling a bug with full knowledge of the specific criminal or tortious activity it will be put to use in is more dangerous than selling a bug that has a relatively diverse market of buyers and for which you'd have strong plausible deniability (not to mention a network of gray-market middlemen insulating you from any actual knowledge of offenses). My mental model of this is Stephen Watt --- but I only know the surface level of what was reported in that case. Generally just my logic would be: selling bugs for which there's an established market is safer than selling one-off bugs to idiosyncratic buyers.
        TomAnthony 8y ago
        That makes absolute sense to me, and I agree. However, it doesn't cover the aspect that some bugs are directly monetizable without needing to be sold (as was the case with my Google XML Sitemap exploit). Of course, there is a risk to directly monetizing such a bug too, but the risk calculation is then different.
  - paxys 8y ago
    Bug bounties don't exist to prevent people from selling exploits on the black market. Those who were going to do so will do it anyways, and companies don't want a scenario where they have to bid against other buyers for such reports. They simply exist as a small incentive for folks who would have otherwise done nothing.
    - comboy 8y ago
      I don't understand your reasoning. If you are a black hat and you can get more money for the bug from the company than from selling it on the black market, why would you sell it on the black market?
      - notamy 8y ago
        Because maybe I can report it once to the company and make X amount of money, but if the black market price is X / 2, I can potentially sell it many times and make significantly more than X.
        comboy 8y ago
        What I mean by black market price is total amount of money that you can make on that bug selling it on the black market.
      - paxys 8y ago
        That's not what I said. A black hat can still try and sell it to the company, but (1) it won't be through the bug bounty process and (2) they are likely not going to pay "market price", whatever that is.
- asdfasgasdgasdg 8y ago
  https://www.google.com/about/appsecurity/reward-program/index.html https://www.google.com/about/appsecurity/reward-program/inde... Looks like up to $30k per bug.
ProAm 8y ago
$1000 bounty for this seems really low.
- tptacek 8y ago
  Why? There's no market for this bug. Nobody else will buy it. If you found an equivalent bug in, say, Grubhub, nobody would think it was worth much more than a token bounty. Is it just because Facebook is a big company and can afford to pay more for every bug, or is there a particular reason you think this bug is super valuable?
  - deleted 8y ago
    [deleted]
  - scintill76 8y ago
    TFA: "In addition, the most sinister exploiters (e.g. a repressive regime) of such a bug would likely have a list of people they cared about identifying (which they could also narrow down based on your location and other factors)." Wouldn't such orgs (or their vendors) pay at least $1k to find the people they want? I don't know what the right formula is to calculate bounty vs. expected black market value, but you only said nobody would buy it at all.
    - tptacek 8y ago
      My semi-educated guess at the answer to your question: no, China or Bahrain or whoever is not going to pay this guy $1000 for the differentiated error to a cross-domain request to Facebook; also, it's pretty hard to believe that there aren't 100 other ways to accomplish this attack, especially if you're a "global passive adversary" and can use traffic-analytic attacks to conduct it. It's worth finding and fixing these problems, and that's what happened here. It is not a significant economic event, though, and it would be a surprising departure from normal payouts on bounties to see this get much more money than it did. The only reason it was surprising Google didn't pay out for the same bug is that it's Google --- most sites would assign this bug $0.
deleted 8y ago
[deleted]
vilfredo 8y ago
When you disclose hacks on the Pareto Network the market values it instead of arbitrary panels. This is better for researchers because they don't have to risk liability by weaponizing an exploit, and they also don't get lowballed by the companies who have arbitrary policies and arbitrary payouts that aren't compatible with responsible disclosure.
crshstsh 8y ago
Pat! I've used your API Spy countless of times as a teenager. I used to always rename the wav explosion file and would ALWAYS drag the splash screen image to reveal your face! That is how often I used that application. Thank you so much for your contributions and I looked over your sites and am happy to see where you are. Thank you once again.
- patorjk 8y ago
  No prob, glad it was useful :)! Heh, I used to wonder how many people who find that easter egg. I figured it'd be a cool little surprise for anyone who tried to move the splash screen.
TomAnthony 8y ago
OP here. I had exact same experience (and was aware of your story!). I also found a similar Google bug which didn't receive a bounty [1]. [1] http://www.tomanthony.co.uk/blog/confirm-google-users-email/ http://www.tomanthony.co.uk/blog/confirm-google-users-email/
- patorjk 8y ago
  Kind of a bummer Google again didn't give a bounty for this type of issue, but also kind of interesting that we had the same experience. Also cool to hear you'd heard of my story before :).

eveningcoffee 8y ago

How much did Google offer for a security bug (if they would have accepted it)?

tptacek 8y ago
It very much depends on the bug.
chipperyman573 8y ago
A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero" http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-hat-seo-bug-bounty/ http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-byp...
- tptacek 8y ago
  That's a really good bug! But $5k sounds pretty reasonable, since the only alternative market for it comes with pretty obscene legal risk (unlike an RCE, which will have a whole variety of white- and grey- market buyers, an SEO bug seller knows exactly what their buyer is doing with their work).
  - wolco 8y ago
    If you are in this business you are already connected with grey/black elements. Probably less risky than initially seems.
    - Izmaki 8y ago
      Plus I think it's safe to assume that they can handle themselves, anonymity wise. Tor and bitcoin is not rocket science
  - TomAnthony 8y ago
    OP here. Really interesting to get your take on that. From my (far less security educated) POV the Google XML bug felt less risky from a monetisation angle. I guess the difference is between exploiting it yourself vs selling it. There was a clear path to monetisation that didn't require selling the exploit on the black market, and which could well fly under the radar (from my reasonably well educated SEO POV). However, I don't think bug bounties necessarily need to equal the 'market value' of the bug, whatever that means.
    - tptacek 8y ago
      The logic I'd use is that selling a bug with full knowledge of the specific criminal or tortious activity it will be put to use in is more dangerous than selling a bug that has a relatively diverse market of buyers and for which you'd have strong plausible deniability (not to mention a network of gray-market middlemen insulating you from any actual knowledge of offenses). My mental model of this is Stephen Watt --- but I only know the surface level of what was reported in that case. Generally just my logic would be: selling bugs for which there's an established market is safer than selling one-off bugs to idiosyncratic buyers.
      - TomAnthony 8y ago
        That makes absolute sense to me, and I agree. However, it doesn't cover the aspect that some bugs are directly monetizable without needing to be sold (as was the case with my Google XML Sitemap exploit). Of course, there is a risk to directly monetizing such a bug too, but the risk calculation is then different.
- paxys 8y ago
  Bug bounties don't exist to prevent people from selling exploits on the black market. Those who were going to do so will do it anyways, and companies don't want a scenario where they have to bid against other buyers for such reports. They simply exist as a small incentive for folks who would have otherwise done nothing.
  - comboy 8y ago
    I don't understand your reasoning. If you are a black hat and you can get more money for the bug from the company than from selling it on the black market, why would you sell it on the black market?
    - notamy 8y ago
      Because maybe I can report it once to the company and make X amount of money, but if the black market price is X / 2, I can potentially sell it many times and make significantly more than X.
      - comboy 8y ago
        What I mean by black market price is total amount of money that you can make on that bug selling it on the black market.
    - paxys 8y ago
      That's not what I said. A black hat can still try and sell it to the company, but (1) it won't be through the bug bounty process and (2) they are likely not going to pay "market price", whatever that is.
asdfasgasdgasdg 8y ago
https://www.google.com/about/appsecurity/reward-program/index.html https://www.google.com/about/appsecurity/reward-program/inde... Looks like up to $30k per bug.

ProAm 8y ago

$1000 bounty for this seems really low.

tptacek 8y ago
Why? There's no market for this bug. Nobody else will buy it. If you found an equivalent bug in, say, Grubhub, nobody would think it was worth much more than a token bounty. Is it just because Facebook is a big company and can afford to pay more for every bug, or is there a particular reason you think this bug is super valuable?
- deleted 8y ago
  [deleted]
- scintill76 8y ago
  TFA: "In addition, the most sinister exploiters (e.g. a repressive regime) of such a bug would likely have a list of people they cared about identifying (which they could also narrow down based on your location and other factors)." Wouldn't such orgs (or their vendors) pay at least $1k to find the people they want? I don't know what the right formula is to calculate bounty vs. expected black market value, but you only said nobody would buy it at all.
  - tptacek 8y ago
    My semi-educated guess at the answer to your question: no, China or Bahrain or whoever is not going to pay this guy $1000 for the differentiated error to a cross-domain request to Facebook; also, it's pretty hard to believe that there aren't 100 other ways to accomplish this attack, especially if you're a "global passive adversary" and can use traffic-analytic attacks to conduct it. It's worth finding and fixing these problems, and that's what happened here. It is not a significant economic event, though, and it would be a surprising departure from normal payouts on bounties to see this get much more money than it did. The only reason it was surprising Google didn't pay out for the same bug is that it's Google --- most sites would assign this bug $0.

deleted 8y ago

[deleted]

vilfredo 8y ago

When you disclose hacks on the Pareto Network the market values it instead of arbitrary panels. This is better for researchers because they don't have to risk liability by weaponizing an exploit, and they also don't get lowballed by the companies who have arbitrary policies and arbitrary payouts that aren't compatible with responsible disclosure.

crshstsh 8y ago

Pat! I've used your API Spy countless of times as a teenager. I used to always rename the wav explosion file and would ALWAYS drag the splash screen image to reveal your face! That is how often I used that application. Thank you so much for your contributions and I looked over your sites and am happy to see where you are. Thank you once again.

patorjk 8y ago
No prob, glad it was useful :)! Heh, I used to wonder how many people who find that easter egg. I figured it'd be a cool little surprise for anyone who tried to move the splash screen.

TomAnthony 8y ago

OP here. I had exact same experience (and was aware of your story!). I also found a similar Google bug which didn't receive a bounty [1]. [1] http://www.tomanthony.co.uk/blog/confirm-google-users-email/ http://www.tomanthony.co.uk/blog/confirm-google-users-email/

patorjk 8y ago
Kind of a bummer Google again didn't give a bounty for this type of issue, but also kind of interesting that we had the same experience. Also cool to hear you'd heard of my story before :).