5 ms·

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand imp

Honest question. Given that RCE's are extremely rare, can't FB and AAPL announce 100M USD bounty to get them first and patch them, avoiding bad PR and brand impact? Damn, make it 200M?! Or bad actors can easily pay 5x more to exploit said 0 day on a few targets, so hackers will sell to them instead?

icandoit 7y ago
I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.
- nopriorarrests 7y ago
  Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?
  - zulln 7y ago
    > what makes people work for nefarius inc? No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.
  - mywittyname 7y ago
    > what makes people work for nefarius inc? Very good pay; the ability to work remotely; pride/prestige; community; political reasons. Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.
- thaeli 7y ago
  Brokers ("grey market") usually pay out over time, for this reason. If a seller double-dipped by also selling the vuln to the vendor via a bounty program, it could get fixed before they actually got most of their grey-market money.
fooey 7y ago
It's not worth anything like $100m to facebook. They pay barely enough to say they're willing to pay, but they don't really care.
- seppin 7y ago
  Exactly. Facebook lost no customers and their stock took no hit as a result of this news. 99.999999% of their users will never know.
dickjocke 7y ago
I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. I think the problem is these 0 days are worth more to bad actors than the bad press costs companies.
- nopriorarrests 7y ago
  >I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. Depends on your personal risk profile, I guess. If I was a highly professional security researcher (one can dream!), the one can find 0 day RCE in whatsapp, well, I would happily accept 10-20M bounty from FB and retire for life, instead of bargaining with wealthy monarch and accepting non-trivial risk of being dismembered with some blunt tools in embassy of Turkey or somewhere else.
  - p1necone 7y ago
    Indeed, any money after the "never work again and have a decent middle class lifestyle" point is worth significantly less to me than money before that point.
hloiuweri 7y ago
The actual prices are in the $100k-$200k range. $1m if you are extremely generous.
- Ididntdothis 7y ago
  I wonder what size the supply is. How many could you buy immediately or over time?
CamperBob2 7y ago
Same reason that putting a bounty on dead rats isn't a good way to get rid of your city's rat infestation.
p1necone 7y ago
I think the problem is that FB or Apple don't really get directly hurt from these exploits being used. Some politician gets hacked and important personal data gets leaked - oh well, there was a bug, we've patched it, one less user out of a few billion. And the vast majority of people probably don't rank this kind of thing very high on their threat model, they're either not going to know or aren't going to care.

icandoit 7y ago

I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.

nopriorarrests 7y ago
Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?
- zulln 7y ago
  > what makes people work for nefarius inc? No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.
- mywittyname 7y ago
  > what makes people work for nefarius inc? Very good pay; the ability to work remotely; pride/prestige; community; political reasons. Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.
thaeli 7y ago
Brokers ("grey market") usually pay out over time, for this reason. If a seller double-dipped by also selling the vuln to the vendor via a bounty program, it could get fixed before they actually got most of their grey-market money.

fooey 7y ago

It's not worth anything like $100m to facebook. They pay barely enough to say they're willing to pay, but they don't really care.

seppin 7y ago
Exactly. Facebook lost no customers and their stock took no hit as a result of this news. 99.999999% of their users will never know.

dickjocke 7y ago

I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. I think the problem is these 0 days are worth more to bad actors than the bad press costs companies.

nopriorarrests 7y ago
>I don't think FB or Apple can win a bidding war with state actors, and especially not a wealthy monarch. Depends on your personal risk profile, I guess. If I was a highly professional security researcher (one can dream!), the one can find 0 day RCE in whatsapp, well, I would happily accept 10-20M bounty from FB and retire for life, instead of bargaining with wealthy monarch and accepting non-trivial risk of being dismembered with some blunt tools in embassy of Turkey or somewhere else.
- p1necone 7y ago
  Indeed, any money after the "never work again and have a decent middle class lifestyle" point is worth significantly less to me than money before that point.

hloiuweri 7y ago

The actual prices are in the $100k-$200k range. $1m if you are extremely generous.

Ididntdothis 7y ago
I wonder what size the supply is. How many could you buy immediately or over time?

CamperBob2 7y ago

Same reason that putting a bounty on dead rats isn't a good way to get rid of your city's rat infestation.

p1necone 7y ago

I think the problem is that FB or Apple don't really get directly hurt from these exploits being used. Some politician gets hacked and important personal data gets leaked - oh well, there was a bug, we've patched it, one less user out of a few billion. And the vast majority of people probably don't rank this kind of thing very high on their threat model, they're either not going to know or aren't going to care.