6 ms·

I think it was irresponsible to keep collecting more phone numbers, and I think he should've let Twitter handle informing users of this vulnerability. Had he us

by 1f60c 7y ago

I think it was irresponsible to keep collecting more phone numbers, and I think he should've let Twitter handle informing users of this vulnerability. Had he used responsible disclosure, he could have claimed a nice bug bounty (between $280 and $2,940, according to [0]). [0]: https://hackerone.com/twitter

chance_state 7y ago
I'm always curious why these bug bounty programs for billion dollar companies pay so little. Why not make this a 10K, 25K bounty even if it's small potatoes? That amount is nothing to Twitter but might prevent what happened in this case (continued collection of data, public release before Twitter could notify users, etc). I've noticed this trend of painfully cheap bounties at most other tech giants too.
- DataWorker 7y ago
  Supply of labor. The lump of labor fallacy does not apply to software bugs.
- throwiay987 7y ago
  its literally the main reason i will never be in favor of this "responsible disclosure" It pays shit and also vilifies users for learning how the system was built
- sp332 7y ago
  Katie Moussouris has spoken a lot about this. The incentives are pretty complex. https://www.computerweekly.com/news/252450337/Bug-bounties-not-a-silver-bullet-Katie-Moussouris-warns https://www.computerweekly.com/news/252450337/Bug-bounties-n... https://www.zdnet.com/article/relying-on-bug-bounties-not-appropriate-risk-management-katie-moussouris/ https://www.zdnet.com/article/relying-on-bug-bounties-not-ap... https://threatpost.com/newsmaker-interview-katie-moussouris-on-improving-bug-bounty-programs/139488/ https://threatpost.com/newsmaker-interview-katie-moussouris-...
  - munk-a 7y ago
    I mean, there is a mix here, some genuine notes about how high bounties can cause coordinated breaches to farm income but also notes about how bounties shouldn't replace pen testing (I agree, but have both and don't, as a pen tester, just argue that more money should go to pen testing, it's way too self-serving) and a weird comment that having a low bounty and then overpaying for a return of privileged data if the compromise could expose that data is a bad idea because it encourages bad actors - if the bounty is 3k and the data is worth 30 mil then yea, bad actors will emerge because you're criminally underpaying for exploits. Honestly, a lot of the reasons I'm seeing for lowering the payout of bounties seems to revolve around "It's too expensive"
    - sp332 7y ago
      More reasons https://twitter.com/k8em0/status/1078798252151992320 https://twitter.com/k8em0/status/1078798252151992320 Almost any amount of money allocated to bug bounties would be more efficiently spent developing in-house talent.
      - Red_Leaves_Flyy 7y ago
        Which serves the argument that instead of rewarding people for sharing vulnerabilities we should be punishing companies for having them. Harshly. The more data points a company tracks the faster the fine should approach 100% entire company market cap. Their subsidiaries, parent company's, board, and executives should also not be immune but rather personally liable for egregious cases of not knowing, failing to, or cutting corners around documented best practices, security patching, hardware rotation etc. The entire industry needs to be reworked to put security and make All pii hazardous. Sadly software is going the way of construction. Things Will only change when tptb get inordinately effected.
clubm8 7y ago
A bit entitled to expect them to take ~3k. You could get more than that for one famous person's phone number from paparazzi.
- charleslmunger 7y ago
  There are a lot of unethical and illegal things that will earn more money than bug bounties. Some, like posting fake "elon musk giving away ETH" tweets, don't even require finding a security vulnerability. Twitter should increase their bounties to incentivize reporting and auditing, but they're never going to win a bidding war with state-sponsored vulnerability markets.
- krick 7y ago
  Exactly. And it's not even 3K, it's "280-2940", and well can be argued to be of low importance, because it's "a misused feature, and not a critical bug" (I remember exactly that happening with WhatsApp or Telegram — not sure which it was — after somebody brute-forced phone numbers to collect accounts exactly the same way; and unlike Twitter, they even have a less made-up reason to have your number). Even if you are relatively law-abiding person you have to be absolutely crazy to be expected to collect measly $300-3000 and restraint yourself from finding out Donald Trump's personal phone number.

by 1f60c 7y ago

chance_state 7y ago

I'm always curious why these bug bounty programs for billion dollar companies pay so little. Why not make this a 10K, 25K bounty even if it's small potatoes? That amount is nothing to Twitter but might prevent what happened in this case (continued collection of data, public release before Twitter could notify users, etc). I've noticed this trend of painfully cheap bounties at most other tech giants too.

DataWorker 7y ago
Supply of labor. The lump of labor fallacy does not apply to software bugs.
throwiay987 7y ago
its literally the main reason i will never be in favor of this "responsible disclosure" It pays shit and also vilifies users for learning how the system was built
sp332 7y ago
Katie Moussouris has spoken a lot about this. The incentives are pretty complex. https://www.computerweekly.com/news/252450337/Bug-bounties-not-a-silver-bullet-Katie-Moussouris-warns https://www.computerweekly.com/news/252450337/Bug-bounties-n... https://www.zdnet.com/article/relying-on-bug-bounties-not-appropriate-risk-management-katie-moussouris/ https://www.zdnet.com/article/relying-on-bug-bounties-not-ap... https://threatpost.com/newsmaker-interview-katie-moussouris-on-improving-bug-bounty-programs/139488/ https://threatpost.com/newsmaker-interview-katie-moussouris-...
- munk-a 7y ago
  I mean, there is a mix here, some genuine notes about how high bounties can cause coordinated breaches to farm income but also notes about how bounties shouldn't replace pen testing (I agree, but have both and don't, as a pen tester, just argue that more money should go to pen testing, it's way too self-serving) and a weird comment that having a low bounty and then overpaying for a return of privileged data if the compromise could expose that data is a bad idea because it encourages bad actors - if the bounty is 3k and the data is worth 30 mil then yea, bad actors will emerge because you're criminally underpaying for exploits. Honestly, a lot of the reasons I'm seeing for lowering the payout of bounties seems to revolve around "It's too expensive"
  - sp332 7y ago
    More reasons https://twitter.com/k8em0/status/1078798252151992320 https://twitter.com/k8em0/status/1078798252151992320 Almost any amount of money allocated to bug bounties would be more efficiently spent developing in-house talent.
    - Red_Leaves_Flyy 7y ago
      Which serves the argument that instead of rewarding people for sharing vulnerabilities we should be punishing companies for having them. Harshly. The more data points a company tracks the faster the fine should approach 100% entire company market cap. Their subsidiaries, parent company's, board, and executives should also not be immune but rather personally liable for egregious cases of not knowing, failing to, or cutting corners around documented best practices, security patching, hardware rotation etc. The entire industry needs to be reworked to put security and make All pii hazardous. Sadly software is going the way of construction. Things Will only change when tptb get inordinately effected.

clubm8 7y ago

A bit entitled to expect them to take ~3k. You could get more than that for one famous person's phone number from paparazzi.

charleslmunger 7y ago
There are a lot of unethical and illegal things that will earn more money than bug bounties. Some, like posting fake "elon musk giving away ETH" tweets, don't even require finding a security vulnerability. Twitter should increase their bounties to incentivize reporting and auditing, but they're never going to win a bidding war with state-sponsored vulnerability markets.
krick 7y ago
Exactly. And it's not even 3K, it's "280-2940", and well can be argued to be of low importance, because it's "a misused feature, and not a critical bug" (I remember exactly that happening with WhatsApp or Telegram — not sure which it was — after somebody brute-forced phone numbers to collect accounts exactly the same way; and unlike Twitter, they even have a less made-up reason to have your number). Even if you are relatively law-abiding person you have to be absolutely crazy to be expected to collect measly $300-3000 and restraint yourself from finding out Donald Trump's personal phone number.