17 ms·

$100M in bounties paid via HackerOne to ethical hackers

227 points by badRNG 6y ago

guessmyname 6y ago
> $100M in bounties paid by HackerOne to ethical hackers Not by HackerOne per se but the companies using the platform. A better title would be “$100M in bounties paid to ethical hackers by companies via HackerOne”. To be fair, the original message on Twitter reads much better than the title of the article: > HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. I was on both sides of this: leading the security team at a company paying bug bounties via HackerOne and also reporting security problems to other companies as a freelancer. To be honest, the experience was always bad in both cases. I wasted several hours triaging bugs reported by “hackers” that often disregarded the conditions of our bug bounty program. People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. On the other side, as a bug bounty hunter, the experience is also awful. One of the biggest problems is the fact that you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Add to that all the back-and-forth trying to justify more complex issues that are slightly more difficult to prove without damaging the system you are testing. I am glad so many companies and people are still onboard with this service, but I wouldn’t blame anyone for closing their account after all the bad experiences I had.
- csours 6y ago
  As contentious as reporting bugs can be during the development process, while working at the same company as the developers, I'm not at all surprised that ethical disclosure is terrible, especially with a monetary motivation.
- thephyber 6y ago
  > you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.
  - jliptzin 6y ago
    If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.
    - SCHiM 6y ago
      As a hacker, I see a very easily exploitable flaw in your proposed solution :)
      - saagarjha 6y ago
        Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
    - tptacek 6y ago
      Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
      - f- 6y ago
        If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
- dang 6y ago
  We can fix that issue with the title with s/by/via/. Thanks!
- wnevets 6y ago
  > People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. sounds these "hackers" have an incentive to be stubborn over non issues
  - albntomat0 6y ago
    Agreed. There's also a clear incentive for companies offering the bounties to downplay valid bounties.
    - tptacek 6y ago
      No, there isn't. Bounty dollars are immaterial to the companies offering them. In fact: the opposite incentive exists. These programs justify themselves by uncovering significant bugs.
      - albntomat0 6y ago
        When a bug has been submitted, and the company is trying to figure out how much to reward? The companies that consistently publish their bugs have a good track record of giving appropriate bounties. I don't see a clear incentive for a company that doesn't allow their bugs to be published, to be anything other than stingy. Computer security is a cost center for a business, and the folks managing the bug bounty program have a clear incentive to minimize their costs, while maximizing the bugs found. I think a potential solution would be increased bug disclosure on platforms like Hackerone. Currently, a company has to agree to disclose the details, and most never do. Openness allows hackers to vote with their feet, and spend more time on the companies that are easier to work with, both in bounties rewarded, and easiness of the reporting process.
        tptacek 6y ago
        I've read this a couple times and don't really follow it. In reality, there is a tacit consensus scale for vulnerabilities by severity; a real XSS, for instance, in a platform where XSS isn't somehow sev:crit like it is on a large social network, is worth "hundreds" of dollars. Most companies have a scale worked out ahead of time. HackerOne will give you advice on scales if you want to take it. Whatever the scale is, companies have no incentive to avoid paying them, because even at the high end of the scale the amounts are immaterial. Remember, we're talking about H1 bounties here, not the Apple and Google platform bounties, which are totally different animals. The real risk companies that run bounties face is that their programs won't generate any real bugs at all, but will absorb costs from both the platform and all the nonsense bugs they have to triage. New serious bounties are good news, not bad news, for most bounty programs. (I've managed several, continuing until recently; before I did, I went around talking to people who ran them to get the lay of the land. I'm pretty confident in my answers here.)
- twox2 6y ago
  Same here. 90% of reports are from folks that didn't bother to read the terms and sending in useless reports. As a researcher, I'd spend days chasing something down just to get $50 for my finding months later.
  - julianeon 6y ago
    Wow, that's like a 90% discount from what is presumably the actual going rate. I don't know how you could live in the Bay Area and possibly afford to do this, other than as a sort of beer money game.
    - LilBytes 6y ago
      I find in BugCrowd that most of these reports that are spammy or useless in nature are from researchers in developing countries and have a limited grasp of the English language. They simply don't take no for an answer.
- DoofusOfDeath 6y ago
  > HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. (Tangent) Can anyone recommend a coherent interpretation of that statement? I know what it means for an individual person to be proud. And I could see an argument for extending that notion to a group of persons if every person in the organization was proud. But I assume HackerOne has had employees / members come and go over time. And I also assume that some of the past or current members don't share that feeling of pride for this particular milestone. So the only interpretation I can think of is that the person writing the PR was being sleazily vague. I.e., trying to get the audience to take a sentiment that's only meaningfully applied to individual humans / animals, and getting them to unwittingly apply it to a brand name instead. Is there a better explanation that eludes me?
  - qeternity 6y ago
    Not really sure what you’re getting at here. Without getting into the boilerplate cooperate “we’re helping the world”, it’s a perfectly coherent sentence.
  - Talanes 6y ago
    Expressing sentiment on behalf of collectives isn't a new idea from a PR writer, it's an ancient figure of communication.
  - antonvs 6y ago
    Idiomatic English might be eluding you.
- steve76 6y ago
  Issue bug bounties to get users. Earn bug bounties in your day to day work. Best way to find a bug is to use the software. When you do, report it and send a quote for a fix which you will need to build anyways.
- nstart 6y ago
  I've started handling the security inbox at Buffer now and we use a normal email approach. I can honestly say that the experience is pretty much the same and I feel like the issues you describe are independent of Hackerone (perhaps the scale increases?). From my end, there are a lot of trivial things I have to go through where it's low effort on the researcher end (And I've even had automated searches where the researcher has sent mails to us assuming we'd have the same issue because of some similar HTTP Header or something similar). Thankfully I've gotten faster at keeping these out but it still takes up more time than needed. From the researcher end, I assume it's frustrating where they put in the effort to craft a well documented mail and I have to inform them that it's a duplicate or known issue that we are currently working on a fix for. It's a hard call and I'll often have to use a judgement call on these. But it's made harder still when I'll suddenly see an issue that has existed for a long time be reported by a single researcher. And then in a matter of two days 3 to 4 other researchers will pop up with the exact same issue leading me to believe that either there's different accounts under the same name, or some kind of researcher group that works together in sharing findings (And maybe bounty). Basically, I'm not sure how much this is a HackerOne issue vs a general bounty program pain ¯\_(ツ)_/¯
- LMYahooTFY 6y ago
  Is there a feasible way to ask an organization if they're aware of a vulnerability before you put in too much work on it? Can the query be ambiguous enough to avoid a free service rendered?
- update 6y ago
  As a bug bounty hunter, I can attest to having an awful experience at times. The three companies I have worked with @ HackerOne have all taken forever to payout or fix bugs. Currently, I have been waiting 4 months to be paid by a company on HackerOne, for a pretty dang high impact bug that leaves all their customers vulnerable; I checked today, & they still haven't fixed it, let alone paid out. You also have to be aware of policy changes. I've noticed companies remove language that told how much they'd pay out. Some companies have a mandatory pay out of 7-14 days but they are rare; with everyone else, you just have to hope they pay you, and they do, I guess... whenever they feel like it.
- codexon 6y ago
  HackerOne has people screening reports that don't seem very technical. They closed one of my reports for being a "denial of service" attack when it was a crash caused by malformed input. I've also heard of others having the same issue.
  - XMPPwocky 6y ago
    "a crash caused by malformed input" absolutely does sound like a DoS, though. Sounds like you have a crash that you think might be exploitable- in that case, consider saying "memory corruption triggered by malformed input" to make it more clear that the crash isn't the point.
- rasz 6y ago
  >“closed: duplicate issue” cool, posting my PoC on pastebin then
vmception 6y ago
I feel that bug bounties are still undervalued, and the market is still inefficient because the prices are unilaterally set by companies. The only other publicly disclosed signals for market price come from third party companies and state actors. The other signals are not public and hard to quantify, they come from trying to weaponize and monetize exploits yourself. This results in potentially incurring various forms of liability, or reducing that by selling information to a different broker, who will eventually find someone to weaponize or monetize a piece of the exploit. This part is a much more efficient market, but it is not vertically integrated. The prime bug bounties seem to be trending upwards in value, with the bottom being crowded and with non-serious companies testing the waters. Does anyone have any ideas to make the value of bug bounties be more dynamic and elastic, trend upwards towards their true value inline with the growth of the sector?
- contravariant 6y ago
  I don't think it's entirely fair to say there is no competition in this market. In the end companies are still competing for a limited supply of ethical hackers. Except that it is a bit of an unusual market, since both sides are operating with very limited information. Perhaps it will become more stable when people realise you can sell negative results as well (either implicitly by cooperating, or through an actual market). Anything that can bridge the gap between hackers wanting to get paid for their efforts and companies wanting to pay for results would help. More volume would also help, in the end it's hard to sustain a whole industry on just tens or hundreds of millions per year.
  - vmception 6y ago
    > I don't think it's entirely fair to say there is no competition in this market Good thing I never said that. The market is inefficient. I like that idea of monetizing negative results. More transaction volume generally helps, I think external market signals and their actual value are whats really missing. Like, how much would someone pay for an exploit should dictate how much a company should pay for letting a crowd try to fix it where only one person/group gets the payment. If there was a way for additional participants to get paid for bothering to look at all that would be helpful too, and different people can focus on how people try to game that instead of worrying about the idea of people gaming it.
mjayhn 6y ago
This is a tangent but it's been fascinating watching the infosec community grow on twitter. It makes me feel super out of the loop with a huge part of my field (i'm more dev/architecture but of course security is important). I kind of dove into it a tiny, tiny bit the last week. I figure with all this time at home for quarantine I might as well start playing in CTFs, etc and hone some skill I'm so used to only using in a reactionary manner. I'm honestly envious of their community and all of the tools they've created and tutorials and everything for newcomers. They've done a great job getting anyone who is remotely curious the ability to dabble. When I was coming up as a sysadmin "rtfm." Anyway, are people making lucrative careers out of bug bounties? What do these "infosec CEO" twitter people do day to day? Their goal is to hit bounties and sell pentesting/exploits I assume?
- arkadiyt 6y ago
  > Anyway, are people making lucrative careers out of bug bounties? There's a strong power law distribution - the top folks make a lot of money (say, > $500k/yr) and then it quickly drops off from there.
  - lawnchair_larry 6y ago
    You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes. Unless you’re talking about private exploit sales, which is totally different.
    - LilBytes 6y ago
      It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)
darepublic 6y ago
What if I introduce security bugs only to be paid bounty on them later
- saagarjha 6y ago
  I believe that most platforms have restrictions barring you from submitting bug reports if you're affiliated with the company offering them.
  - cortesoft 6y ago
    The platform doesn't really care, it is the company with the bugs that pays out. It is probably the client companies that have those policies.
  - hnick 6y ago
    Easy loophole, work with a friend.
    - lawnchair_larry 6y ago
      And risk losing your 100s of k a year career for a $250 Amazon gift card. Knock yourself out.
- cortesoft 6y ago
  Are you asking what would happen if you defraud the company you work for?
- imtringued 6y ago
  It would be more sensible to just report existing bugs via the platform instead of reporting them to the project manager.
- gitgud 6y ago
  You would be an unethical hacker I suppose
- mhh__ 6y ago
dpeck 6y ago
"ethical hacker" is such a trash term.
- tim44 6y ago
  agree. and the term "hacker" has been driven through the ground and back up so many times its lost and changed meanings. Now "i got hacked" is akin to the dog ate my homework or I gave someone my password.
- tptacek 6y ago
  Yes. You should generally think less of companies that use it.
- hnick 6y ago
  It's funny since this term is rising in popularity in recent years, at exactly the same time that "hack" seems to be coming more popular in everyday use and losing some of its stigma. "IKEA hacks", "life hacks", etc.
- lawnchair_larry 6y ago
  For what it’s worth, nobody who actually works in security uses it, and they mostly cringe when others do. That and “cyber” are pretty good smell tests that you’re interacting with someone who is very out of touch.
  - dpeck 6y ago
    yeah, old (by todays standards anyway) infosec hacker here. "cyber" has always a fed/consultant tip off
- shacrw 6y ago
  curious to know, what's the term which people in the infosec community use then? pen-tester? cybersecurity researcher?
  - wglb 6y ago
    Penetration tester or application security audit. Not cyber.
ngneer 6y ago
The missing figure is how many hours those hackers spent. Most of the companies that were on HackerOne when last I checked are using the platform as a kind of a substitute for contracting with a pen test firm. Things like "will you break my website". With bug bounties, the payout is only for vulnerabilities found, not for analysis effort, and therefore one has to carefully weigh the expectancy. I think that vulnerabilities found is the wrong metric for the industry, because it is really downstream of the true desire. If anything, the metric should be complexity removed. Prove that you made the system simpler.
kerng 6y ago
As company you should do bug bounty but in addition, not as replacement of doing your own testing. The reason: Bug bounty is fundamentally favoring the companies that sign up. They pay next to nothing for getting a lot of eyes on their site and here and there a valuable find will be made. Rewards should probably be much higher, like 10x I think to attract better researchers. Also, the latest invention of private programs, where testers aren't even allowed to talk about it or share finds after is a joke as well - it's all just in favor of the companies. The basically buy the researchers silence, e.g. they can dismiss a find and don't pay and just say oops duplicate. For someone skilled and interested in infosec there are better ways to make money.
- wp381640 6y ago
  Make your program private, increase your bounties 3-5x, put in a $1k+ first bug report bonus and invite in people who have previously reported good and/or well documented bugs and you'll save time and get a lot more out of it These free-for-all bug bounty programs are a drain on resources that could be better spent elsewhere The real value hackerone and similar should be providing is filtering out the time wasting reporters and the vendors who slow roll on reports - but they do neither of those
- lawnchair_larry 6y ago
  This is correct in theory but not in practice. Commodity bug bounties have become somewhat of a failed experiment. For most companies, they cost more than they are worth, and that cost doesn’t even come from the reward payout.
  - kerng 6y ago
    That's a good point, but if I understand correctly Hackerone staff has to triage bugs before a company is even responding or required to look at it? So it's all offloaded, or is that incorrect?
29athrowaway 6y ago
Paid through HackerOne not by HackerOne.
jamez1 6y ago
Seems a bit funny, the top scorers didn't have a few massive bounties, but many many little ones. Both of these accounts made most of their hits on Verizon. To get those kind of rates it's probably the same type of flaw present in many places of the system. It's questionable if these companies are getting massive value for money if most of the bugs are oversights rather than intricate flaws in a bespoke process. https://hackerone.com/try_to_hack?filter=type:bounty-awarded https://hackerone.com/try_to_hack?filter=type:bounty-awarded https://hackerone.com/mlitchfield?filter=type:bounty-awarded https://hackerone.com/mlitchfield?filter=type:bounty-awarded
shafner99 6y ago
Worth every penny
semisober 6y ago
Here's a link to "The 2020 hacker report" by HackerOne https://www.hackerone.com/lp/resources/2020-hacker-report https://www.hackerone.com/lp/resources/2020-hacker-report I've looked through it and there's some nice information on how hacker industry emerged and grew into what it is now, talks about money earned by ethical hacking as well.

227 points by badRNG 6y ago

> $100M in bounties paid by HackerOne to ethical hackers Not by HackerOne per se but the companies using the platform. A better title would be “$100M in bounties paid to ethical hackers by companies via HackerOne”. To be fair, the original message on Twitter reads much better than the title of the article: > HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. I was on both sides of this: leading the security team at a company paying bug bounties via HackerOne and also reporting security problems to other companies as a freelancer. To be honest, the experience was always bad in both cases. I wasted several hours triaging bugs reported by “hackers” that often disregarded the conditions of our bug bounty program. People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. On the other side, as a bug bounty hunter, the experience is also awful. One of the biggest problems is the fact that you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Add to that all the back-and-forth trying to justify more complex issues that are slightly more difficult to prove without damaging the system you are testing. I am glad so many companies and people are still onboard with this service, but I wouldn’t blame anyone for closing their account after all the bad experiences I had.

csours 6y ago
As contentious as reporting bugs can be during the development process, while working at the same company as the developers, I'm not at all surprised that ethical disclosure is terrible, especially with a monetary motivation.
thephyber 6y ago
> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.
- jliptzin 6y ago
  If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.
  - SCHiM 6y ago
    As a hacker, I see a very easily exploitable flaw in your proposed solution :)
    - saagarjha 6y ago
      Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
  - tptacek 6y ago
    Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
    - f- 6y ago
      If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
dang 6y ago
We can fix that issue with the title with s/by/via/. Thanks!
wnevets 6y ago
> People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. sounds these "hackers" have an incentive to be stubborn over non issues
- albntomat0 6y ago
  Agreed. There's also a clear incentive for companies offering the bounties to downplay valid bounties.
  - tptacek 6y ago
    No, there isn't. Bounty dollars are immaterial to the companies offering them. In fact: the opposite incentive exists. These programs justify themselves by uncovering significant bugs.
    - albntomat0 6y ago
      When a bug has been submitted, and the company is trying to figure out how much to reward? The companies that consistently publish their bugs have a good track record of giving appropriate bounties. I don't see a clear incentive for a company that doesn't allow their bugs to be published, to be anything other than stingy. Computer security is a cost center for a business, and the folks managing the bug bounty program have a clear incentive to minimize their costs, while maximizing the bugs found. I think a potential solution would be increased bug disclosure on platforms like Hackerone. Currently, a company has to agree to disclose the details, and most never do. Openness allows hackers to vote with their feet, and spend more time on the companies that are easier to work with, both in bounties rewarded, and easiness of the reporting process.
      - tptacek 6y ago
        I've read this a couple times and don't really follow it. In reality, there is a tacit consensus scale for vulnerabilities by severity; a real XSS, for instance, in a platform where XSS isn't somehow sev:crit like it is on a large social network, is worth "hundreds" of dollars. Most companies have a scale worked out ahead of time. HackerOne will give you advice on scales if you want to take it. Whatever the scale is, companies have no incentive to avoid paying them, because even at the high end of the scale the amounts are immaterial. Remember, we're talking about H1 bounties here, not the Apple and Google platform bounties, which are totally different animals. The real risk companies that run bounties face is that their programs won't generate any real bugs at all, but will absorb costs from both the platform and all the nonsense bugs they have to triage. New serious bounties are good news, not bad news, for most bounty programs. (I've managed several, continuing until recently; before I did, I went around talking to people who ran them to get the lay of the land. I'm pretty confident in my answers here.)
twox2 6y ago
Same here. 90% of reports are from folks that didn't bother to read the terms and sending in useless reports. As a researcher, I'd spend days chasing something down just to get $50 for my finding months later.
- julianeon 6y ago
  Wow, that's like a 90% discount from what is presumably the actual going rate. I don't know how you could live in the Bay Area and possibly afford to do this, other than as a sort of beer money game.
  - LilBytes 6y ago
    I find in BugCrowd that most of these reports that are spammy or useless in nature are from researchers in developing countries and have a limited grasp of the English language. They simply don't take no for an answer.
DoofusOfDeath 6y ago
> HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. (Tangent) Can anyone recommend a coherent interpretation of that statement? I know what it means for an individual person to be proud. And I could see an argument for extending that notion to a group of persons if every person in the organization was proud. But I assume HackerOne has had employees / members come and go over time. And I also assume that some of the past or current members don't share that feeling of pride for this particular milestone. So the only interpretation I can think of is that the person writing the PR was being sleazily vague. I.e., trying to get the audience to take a sentiment that's only meaningfully applied to individual humans / animals, and getting them to unwittingly apply it to a brand name instead. Is there a better explanation that eludes me?
- qeternity 6y ago
  Not really sure what you’re getting at here. Without getting into the boilerplate cooperate “we’re helping the world”, it’s a perfectly coherent sentence.
- Talanes 6y ago
  Expressing sentiment on behalf of collectives isn't a new idea from a PR writer, it's an ancient figure of communication.
- antonvs 6y ago
  Idiomatic English might be eluding you.
steve76 6y ago
Issue bug bounties to get users. Earn bug bounties in your day to day work. Best way to find a bug is to use the software. When you do, report it and send a quote for a fix which you will need to build anyways.
nstart 6y ago
I've started handling the security inbox at Buffer now and we use a normal email approach. I can honestly say that the experience is pretty much the same and I feel like the issues you describe are independent of Hackerone (perhaps the scale increases?). From my end, there are a lot of trivial things I have to go through where it's low effort on the researcher end (And I've even had automated searches where the researcher has sent mails to us assuming we'd have the same issue because of some similar HTTP Header or something similar). Thankfully I've gotten faster at keeping these out but it still takes up more time than needed. From the researcher end, I assume it's frustrating where they put in the effort to craft a well documented mail and I have to inform them that it's a duplicate or known issue that we are currently working on a fix for. It's a hard call and I'll often have to use a judgement call on these. But it's made harder still when I'll suddenly see an issue that has existed for a long time be reported by a single researcher. And then in a matter of two days 3 to 4 other researchers will pop up with the exact same issue leading me to believe that either there's different accounts under the same name, or some kind of researcher group that works together in sharing findings (And maybe bounty). Basically, I'm not sure how much this is a HackerOne issue vs a general bounty program pain ¯\_(ツ)_/¯
LMYahooTFY 6y ago
Is there a feasible way to ask an organization if they're aware of a vulnerability before you put in too much work on it? Can the query be ambiguous enough to avoid a free service rendered?
update 6y ago
As a bug bounty hunter, I can attest to having an awful experience at times. The three companies I have worked with @ HackerOne have all taken forever to payout or fix bugs. Currently, I have been waiting 4 months to be paid by a company on HackerOne, for a pretty dang high impact bug that leaves all their customers vulnerable; I checked today, & they still haven't fixed it, let alone paid out. You also have to be aware of policy changes. I've noticed companies remove language that told how much they'd pay out. Some companies have a mandatory pay out of 7-14 days but they are rare; with everyone else, you just have to hope they pay you, and they do, I guess... whenever they feel like it.
codexon 6y ago
HackerOne has people screening reports that don't seem very technical. They closed one of my reports for being a "denial of service" attack when it was a crash caused by malformed input. I've also heard of others having the same issue.
- XMPPwocky 6y ago
  "a crash caused by malformed input" absolutely does sound like a DoS, though. Sounds like you have a crash that you think might be exploitable- in that case, consider saying "memory corruption triggered by malformed input" to make it more clear that the crash isn't the point.
rasz 6y ago
>“closed: duplicate issue” cool, posting my PoC on pastebin then

vmception 6y ago

I feel that bug bounties are still undervalued, and the market is still inefficient because the prices are unilaterally set by companies. The only other publicly disclosed signals for market price come from third party companies and state actors. The other signals are not public and hard to quantify, they come from trying to weaponize and monetize exploits yourself. This results in potentially incurring various forms of liability, or reducing that by selling information to a different broker, who will eventually find someone to weaponize or monetize a piece of the exploit. This part is a much more efficient market, but it is not vertically integrated. The prime bug bounties seem to be trending upwards in value, with the bottom being crowded and with non-serious companies testing the waters. Does anyone have any ideas to make the value of bug bounties be more dynamic and elastic, trend upwards towards their true value inline with the growth of the sector?

contravariant 6y ago
I don't think it's entirely fair to say there is no competition in this market. In the end companies are still competing for a limited supply of ethical hackers. Except that it is a bit of an unusual market, since both sides are operating with very limited information. Perhaps it will become more stable when people realise you can sell negative results as well (either implicitly by cooperating, or through an actual market). Anything that can bridge the gap between hackers wanting to get paid for their efforts and companies wanting to pay for results would help. More volume would also help, in the end it's hard to sustain a whole industry on just tens or hundreds of millions per year.
- vmception 6y ago
  > I don't think it's entirely fair to say there is no competition in this market Good thing I never said that. The market is inefficient. I like that idea of monetizing negative results. More transaction volume generally helps, I think external market signals and their actual value are whats really missing. Like, how much would someone pay for an exploit should dictate how much a company should pay for letting a crowd try to fix it where only one person/group gets the payment. If there was a way for additional participants to get paid for bothering to look at all that would be helpful too, and different people can focus on how people try to game that instead of worrying about the idea of people gaming it.

mjayhn 6y ago

This is a tangent but it's been fascinating watching the infosec community grow on twitter. It makes me feel super out of the loop with a huge part of my field (i'm more dev/architecture but of course security is important). I kind of dove into it a tiny, tiny bit the last week. I figure with all this time at home for quarantine I might as well start playing in CTFs, etc and hone some skill I'm so used to only using in a reactionary manner. I'm honestly envious of their community and all of the tools they've created and tutorials and everything for newcomers. They've done a great job getting anyone who is remotely curious the ability to dabble. When I was coming up as a sysadmin "rtfm." Anyway, are people making lucrative careers out of bug bounties? What do these "infosec CEO" twitter people do day to day? Their goal is to hit bounties and sell pentesting/exploits I assume?

arkadiyt 6y ago
> Anyway, are people making lucrative careers out of bug bounties? There's a strong power law distribution - the top folks make a lot of money (say, > $500k/yr) and then it quickly drops off from there.
- lawnchair_larry 6y ago
  You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes. Unless you’re talking about private exploit sales, which is totally different.
  - LilBytes 6y ago
    It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)

darepublic 6y ago

What if I introduce security bugs only to be paid bounty on them later

saagarjha 6y ago
I believe that most platforms have restrictions barring you from submitting bug reports if you're affiliated with the company offering them.
- cortesoft 6y ago
  The platform doesn't really care, it is the company with the bugs that pays out. It is probably the client companies that have those policies.
- hnick 6y ago
  Easy loophole, work with a friend.
  - lawnchair_larry 6y ago
    And risk losing your 100s of k a year career for a $250 Amazon gift card. Knock yourself out.
cortesoft 6y ago
Are you asking what would happen if you defraud the company you work for?
imtringued 6y ago
It would be more sensible to just report existing bugs via the platform instead of reporting them to the project manager.
gitgud 6y ago
You would be an unethical hacker I suppose
mhh__ 6y ago

dpeck 6y ago

"ethical hacker" is such a trash term.

tim44 6y ago
agree. and the term "hacker" has been driven through the ground and back up so many times its lost and changed meanings. Now "i got hacked" is akin to the dog ate my homework or I gave someone my password.
tptacek 6y ago
Yes. You should generally think less of companies that use it.
hnick 6y ago
It's funny since this term is rising in popularity in recent years, at exactly the same time that "hack" seems to be coming more popular in everyday use and losing some of its stigma. "IKEA hacks", "life hacks", etc.
lawnchair_larry 6y ago
For what it’s worth, nobody who actually works in security uses it, and they mostly cringe when others do. That and “cyber” are pretty good smell tests that you’re interacting with someone who is very out of touch.
- dpeck 6y ago
  yeah, old (by todays standards anyway) infosec hacker here. "cyber" has always a fed/consultant tip off
shacrw 6y ago
curious to know, what's the term which people in the infosec community use then? pen-tester? cybersecurity researcher?
- wglb 6y ago
  Penetration tester or application security audit. Not cyber.

ngneer 6y ago

The missing figure is how many hours those hackers spent. Most of the companies that were on HackerOne when last I checked are using the platform as a kind of a substitute for contracting with a pen test firm. Things like "will you break my website". With bug bounties, the payout is only for vulnerabilities found, not for analysis effort, and therefore one has to carefully weigh the expectancy. I think that vulnerabilities found is the wrong metric for the industry, because it is really downstream of the true desire. If anything, the metric should be complexity removed. Prove that you made the system simpler.

kerng 6y ago

As company you should do bug bounty but in addition, not as replacement of doing your own testing. The reason: Bug bounty is fundamentally favoring the companies that sign up. They pay next to nothing for getting a lot of eyes on their site and here and there a valuable find will be made. Rewards should probably be much higher, like 10x I think to attract better researchers. Also, the latest invention of private programs, where testers aren't even allowed to talk about it or share finds after is a joke as well - it's all just in favor of the companies. The basically buy the researchers silence, e.g. they can dismiss a find and don't pay and just say oops duplicate. For someone skilled and interested in infosec there are better ways to make money.

wp381640 6y ago
Make your program private, increase your bounties 3-5x, put in a $1k+ first bug report bonus and invite in people who have previously reported good and/or well documented bugs and you'll save time and get a lot more out of it These free-for-all bug bounty programs are a drain on resources that could be better spent elsewhere The real value hackerone and similar should be providing is filtering out the time wasting reporters and the vendors who slow roll on reports - but they do neither of those
lawnchair_larry 6y ago
This is correct in theory but not in practice. Commodity bug bounties have become somewhat of a failed experiment. For most companies, they cost more than they are worth, and that cost doesn’t even come from the reward payout.
- kerng 6y ago
  That's a good point, but if I understand correctly Hackerone staff has to triage bugs before a company is even responding or required to look at it? So it's all offloaded, or is that incorrect?

29athrowaway 6y ago

Paid through HackerOne not by HackerOne.

jamez1 6y ago

Seems a bit funny, the top scorers didn't have a few massive bounties, but many many little ones. Both of these accounts made most of their hits on Verizon. To get those kind of rates it's probably the same type of flaw present in many places of the system. It's questionable if these companies are getting massive value for money if most of the bugs are oversights rather than intricate flaws in a bespoke process. https://hackerone.com/try_to_hack?filter=type:bounty-awarded https://hackerone.com/try_to_hack?filter=type:bounty-awarded https://hackerone.com/mlitchfield?filter=type:bounty-awarded https://hackerone.com/mlitchfield?filter=type:bounty-awarded

shafner99 6y ago

Worth every penny

semisober 6y ago

Here's a link to "The 2020 hacker report" by HackerOne https://www.hackerone.com/lp/resources/2020-hacker-report https://www.hackerone.com/lp/resources/2020-hacker-report I've looked through it and there's some nice information on how hacker industry emerged and grew into what it is now, talks about money earned by ethical hacking as well.