5 ms·

$6,000 seems low for such a severe bug across almost all Google web properties. I would expect an order of magnitude larger.

by ipsum2 7y ago

lsaferite 7y ago
That was my exact thought when reading the payout amount.
tptacek 7y ago
Why? Who else is going to outbid Google for this serverside URL parsing bug?
- mjw1007 7y ago
  The "competition" that Google is bidding against is all the other ways that people capable of finding this sort of bug might choose to spend their free time.
  - tptacek 7y ago
    If this were Android drive-by RCE, I'd agree with you. But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. $6k is a strong bounty for that kind of work. (The work is important! But people who find web bugs like this tend to make their money on volume, not on a couple major hits a year, like the RCE researchers do.)
    - mygo 7y ago
      > But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. No they’re not. Just because this happened to be a URL whitelist bug doesn’t mean that this is the primary work that the researcher who found the bug does. Did a URL whitelist validation researcher find this, or did someone researching user auth access find this bug? If Google knew exactly who they wanted to find this bug, then Google would have already found it themselves.
      - tptacek 7y ago
        Yes, it does. Vulnerability research is a big field and it is specialized. There are different kinds of vulnerability researchers and, as an imperfect but generally useful rule, the ones doing RCE work aren't looking for web bugs. And the people running the Google bounty program are generally well plugged into the vulnerability research community; they are way, way, way, way, way, way more credible than the median HN comment.
        tptacek 7y ago
        It also just doesn't make sense as an objection, because it's not like the bounty rates on reliable clientside RCEs in browsers and mobile devices is capped at $6k, and everyone doing this work knows it.
  - deleted 7y ago
    [deleted]
- lucasmullens 7y ago
  Why not offer only a dollar then?
  - tptacek 7y ago
    You joke, but lots of places that don't offer cash bounties still get good bounty submissions. Google offers bounties because they can, and to attract more submissions. Like I said below: for this kind of work, $6k is a strong bounty. Not a lot of places will pay you thousands of dollars for a URL whitelist bypass bug.
    - crankylinuxuser 7y ago
      Depends. Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not. Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.
      - tptacek 7y ago
        No. People who find drive-by RCE vulnerabilities are in a market with "grayweb exploit dealers". People who find URL whitelist validation bugs are not. The distinction is important and directly reflected in the bounty rates for the different kinds of bugs. And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.
- joshspankit 7y ago
  As we’ve seen in the smartphone world: the competitors are people who would rather the bug stay secret so that they can exploit it.
- reaperducer 7y ago
  Who else is going to outbid Google for this serverside URL parsing bug? The black hats. $6,000 from Google, or $600,000 from some shadowy company in UTC+02. Google makes these choices too easy.
  - tptacek 7y ago
    Shadowy companies in UTC+02 don't even pay $600k for Android RCE. They pay zero for this stuff.
    - thasaleni 7y ago
      Ey man, Africa is also in UTC+02 and we are not known to be as shady as that one UTC+02 country
- Thorrez 7y ago
  Wouldn't this be considered clientside?
  - tptacek 7y ago
    Technically yes, but in a practical sense the distinction is between bugs that can be fixed globally and instantaneously by pushing a server fix and those that can't.
Someone1234 7y ago
Google's bug bounty has a $7.5K max on "Vulnerabilities giving access to client or authenticated session of the logged-in victim." See here: https://www.google.com/about/appsecurity/reward-program/index.html https://www.google.com/about/appsecurity/reward-program/inde... I guess they were awarded $6K instead of the full because they didn't demonstrate it against more substantial properties. But either way the ceiling is quite low on these classes of vulnerabilities.
- dessant 7y ago
  That payout is indeed quite low, especially because access to an authenticated client session could lead to compromised Google servers when the vulnerability affects web services used by Google employees.
  - bagacrap 7y ago
    Not really. Anything prod related is behind VPN.
- ehsankia 7y ago
  And it's not clear that such an exploit exists. Just because HenHouse happened to use the regex that way doesn't mean other places are, and that a similar exploit exists in the other products. I'm curious to know, but I'd think that the author would've tried to also exploit it in those other apps, and the fact that it's not documented here may be because they didn't find any issues with the other ones? It's a pretty generic regex that has many uses, and may be used for other stuff in other places.

$6,000 seems low for such a severe bug across almost all Google web properties. I would expect an order of magnitude larger.

by ipsum2 7y ago

$6,000 seems low for such a severe bug across almost all Google web properties. I would expect an order of magnitude larger.

lsaferite 7y ago

That was my exact thought when reading the payout amount.

tptacek 7y ago

Why? Who else is going to outbid Google for this serverside URL parsing bug?

mjw1007 7y ago
The "competition" that Google is bidding against is all the other ways that people capable of finding this sort of bug might choose to spend their free time.
- tptacek 7y ago
  If this were Android drive-by RCE, I'd agree with you. But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. $6k is a strong bounty for that kind of work. (The work is important! But people who find web bugs like this tend to make their money on volume, not on a couple major hits a year, like the RCE researchers do.)
  - mygo 7y ago
    > But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. No they’re not. Just because this happened to be a URL whitelist bug doesn’t mean that this is the primary work that the researcher who found the bug does. Did a URL whitelist validation researcher find this, or did someone researching user auth access find this bug? If Google knew exactly who they wanted to find this bug, then Google would have already found it themselves.
    - tptacek 7y ago
      Yes, it does. Vulnerability research is a big field and it is specialized. There are different kinds of vulnerability researchers and, as an imperfect but generally useful rule, the ones doing RCE work aren't looking for web bugs. And the people running the Google bounty program are generally well plugged into the vulnerability research community; they are way, way, way, way, way, way more credible than the median HN comment.
      - tptacek 7y ago
        It also just doesn't make sense as an objection, because it's not like the bounty rates on reliable clientside RCEs in browsers and mobile devices is capped at $6k, and everyone doing this work knows it.
- deleted 7y ago
  [deleted]
lucasmullens 7y ago
Why not offer only a dollar then?
- tptacek 7y ago
  You joke, but lots of places that don't offer cash bounties still get good bounty submissions. Google offers bounties because they can, and to attract more submissions. Like I said below: for this kind of work, $6k is a strong bounty. Not a lot of places will pay you thousands of dollars for a URL whitelist bypass bug.
  - crankylinuxuser 7y ago
    Depends. Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not. Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.
    - tptacek 7y ago
      No. People who find drive-by RCE vulnerabilities are in a market with "grayweb exploit dealers". People who find URL whitelist validation bugs are not. The distinction is important and directly reflected in the bounty rates for the different kinds of bugs. And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.
joshspankit 7y ago
As we’ve seen in the smartphone world: the competitors are people who would rather the bug stay secret so that they can exploit it.
reaperducer 7y ago
Who else is going to outbid Google for this serverside URL parsing bug? The black hats. $6,000 from Google, or $600,000 from some shadowy company in UTC+02. Google makes these choices too easy.
- tptacek 7y ago
  Shadowy companies in UTC+02 don't even pay $600k for Android RCE. They pay zero for this stuff.
  - thasaleni 7y ago
    Ey man, Africa is also in UTC+02 and we are not known to be as shady as that one UTC+02 country
Thorrez 7y ago
Wouldn't this be considered clientside?
- tptacek 7y ago
  Technically yes, but in a practical sense the distinction is between bugs that can be fixed globally and instantaneously by pushing a server fix and those that can't.

Someone1234 7y ago

Google's bug bounty has a $7.5K max on "Vulnerabilities giving access to client or authenticated session of the logged-in victim." See here: https://www.google.com/about/appsecurity/reward-program/index.html https://www.google.com/about/appsecurity/reward-program/inde... I guess they were awarded $6K instead of the full because they didn't demonstrate it against more substantial properties. But either way the ceiling is quite low on these classes of vulnerabilities.

dessant 7y ago
That payout is indeed quite low, especially because access to an authenticated client session could lead to compromised Google servers when the vulnerability affects web services used by Google employees.
- bagacrap 7y ago
  Not really. Anything prod related is behind VPN.
ehsankia 7y ago
And it's not clear that such an exploit exists. Just because HenHouse happened to use the regex that way doesn't mean other places are, and that a similar exploit exists in the other products. I'm curious to know, but I'd think that the author would've tried to also exploit it in those other apps, and the fact that it's not documented here may be because they didn't find any issues with the other ones? It's a pretty generic regex that has many uses, and may be used for other stuff in other places.