7 ms·

> $100M in bounties paid by HackerOne to ethical hackers Not by HackerOne per se but the companies using the platform. A better title would be “$100M in bount

> $100M in bounties paid by HackerOne to ethical hackers Not by HackerOne per se but the companies using the platform. A better title would be “$100M in bounties paid to ethical hackers by companies via HackerOne”. To be fair, the original message on Twitter reads much better than the title of the article: > HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. I was on both sides of this: leading the security team at a company paying bug bounties via HackerOne and also reporting security problems to other companies as a freelancer. To be honest, the experience was always bad in both cases. I wasted several hours triaging bugs reported by “hackers” that often disregarded the conditions of our bug bounty program. People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. On the other side, as a bug bounty hunter, the experience is also awful. One of the biggest problems is the fact that you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Add to that all the back-and-forth trying to justify more complex issues that are slightly more difficult to prove without damaging the system you are testing. I am glad so many companies and people are still onboard with this service, but I wouldn’t blame anyone for closing their account after all the bad experiences I had.

csours 6y ago
As contentious as reporting bugs can be during the development process, while working at the same company as the developers, I'm not at all surprised that ethical disclosure is terrible, especially with a monetary motivation.
thephyber 6y ago
> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.
- jliptzin 6y ago
  If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.
  - SCHiM 6y ago
    As a hacker, I see a very easily exploitable flaw in your proposed solution :)
    - saagarjha 6y ago
      Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
  - tptacek 6y ago
    Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
    - f- 6y ago
      If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
dang 6y ago
We can fix that issue with the title with s/by/via/. Thanks!
wnevets 6y ago
> People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. sounds these "hackers" have an incentive to be stubborn over non issues
- albntomat0 6y ago
  Agreed. There's also a clear incentive for companies offering the bounties to downplay valid bounties.
  - tptacek 6y ago
    No, there isn't. Bounty dollars are immaterial to the companies offering them. In fact: the opposite incentive exists. These programs justify themselves by uncovering significant bugs.
    - albntomat0 6y ago
      When a bug has been submitted, and the company is trying to figure out how much to reward? The companies that consistently publish their bugs have a good track record of giving appropriate bounties. I don't see a clear incentive for a company that doesn't allow their bugs to be published, to be anything other than stingy. Computer security is a cost center for a business, and the folks managing the bug bounty program have a clear incentive to minimize their costs, while maximizing the bugs found. I think a potential solution would be increased bug disclosure on platforms like Hackerone. Currently, a company has to agree to disclose the details, and most never do. Openness allows hackers to vote with their feet, and spend more time on the companies that are easier to work with, both in bounties rewarded, and easiness of the reporting process.
      - tptacek 6y ago
        I've read this a couple times and don't really follow it. In reality, there is a tacit consensus scale for vulnerabilities by severity; a real XSS, for instance, in a platform where XSS isn't somehow sev:crit like it is on a large social network, is worth "hundreds" of dollars. Most companies have a scale worked out ahead of time. HackerOne will give you advice on scales if you want to take it. Whatever the scale is, companies have no incentive to avoid paying them, because even at the high end of the scale the amounts are immaterial. Remember, we're talking about H1 bounties here, not the Apple and Google platform bounties, which are totally different animals. The real risk companies that run bounties face is that their programs won't generate any real bugs at all, but will absorb costs from both the platform and all the nonsense bugs they have to triage. New serious bounties are good news, not bad news, for most bounty programs. (I've managed several, continuing until recently; before I did, I went around talking to people who ran them to get the lay of the land. I'm pretty confident in my answers here.)
twox2 6y ago
Same here. 90% of reports are from folks that didn't bother to read the terms and sending in useless reports. As a researcher, I'd spend days chasing something down just to get $50 for my finding months later.
- julianeon 6y ago
  Wow, that's like a 90% discount from what is presumably the actual going rate. I don't know how you could live in the Bay Area and possibly afford to do this, other than as a sort of beer money game.
  - LilBytes 6y ago
    I find in BugCrowd that most of these reports that are spammy or useless in nature are from researchers in developing countries and have a limited grasp of the English language. They simply don't take no for an answer.
DoofusOfDeath 6y ago
> HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. (Tangent) Can anyone recommend a coherent interpretation of that statement? I know what it means for an individual person to be proud. And I could see an argument for extending that notion to a group of persons if every person in the organization was proud. But I assume HackerOne has had employees / members come and go over time. And I also assume that some of the past or current members don't share that feeling of pride for this particular milestone. So the only interpretation I can think of is that the person writing the PR was being sleazily vague. I.e., trying to get the audience to take a sentiment that's only meaningfully applied to individual humans / animals, and getting them to unwittingly apply it to a brand name instead. Is there a better explanation that eludes me?
- qeternity 6y ago
  Not really sure what you’re getting at here. Without getting into the boilerplate cooperate “we’re helping the world”, it’s a perfectly coherent sentence.
- Talanes 6y ago
  Expressing sentiment on behalf of collectives isn't a new idea from a PR writer, it's an ancient figure of communication.
- antonvs 6y ago
  Idiomatic English might be eluding you.
steve76 6y ago
Issue bug bounties to get users. Earn bug bounties in your day to day work. Best way to find a bug is to use the software. When you do, report it and send a quote for a fix which you will need to build anyways.
nstart 6y ago
I've started handling the security inbox at Buffer now and we use a normal email approach. I can honestly say that the experience is pretty much the same and I feel like the issues you describe are independent of Hackerone (perhaps the scale increases?). From my end, there are a lot of trivial things I have to go through where it's low effort on the researcher end (And I've even had automated searches where the researcher has sent mails to us assuming we'd have the same issue because of some similar HTTP Header or something similar). Thankfully I've gotten faster at keeping these out but it still takes up more time than needed. From the researcher end, I assume it's frustrating where they put in the effort to craft a well documented mail and I have to inform them that it's a duplicate or known issue that we are currently working on a fix for. It's a hard call and I'll often have to use a judgement call on these. But it's made harder still when I'll suddenly see an issue that has existed for a long time be reported by a single researcher. And then in a matter of two days 3 to 4 other researchers will pop up with the exact same issue leading me to believe that either there's different accounts under the same name, or some kind of researcher group that works together in sharing findings (And maybe bounty). Basically, I'm not sure how much this is a HackerOne issue vs a general bounty program pain ¯\_(ツ)_/¯
LMYahooTFY 6y ago
Is there a feasible way to ask an organization if they're aware of a vulnerability before you put in too much work on it? Can the query be ambiguous enough to avoid a free service rendered?
update 6y ago
As a bug bounty hunter, I can attest to having an awful experience at times. The three companies I have worked with @ HackerOne have all taken forever to payout or fix bugs. Currently, I have been waiting 4 months to be paid by a company on HackerOne, for a pretty dang high impact bug that leaves all their customers vulnerable; I checked today, & they still haven't fixed it, let alone paid out. You also have to be aware of policy changes. I've noticed companies remove language that told how much they'd pay out. Some companies have a mandatory pay out of 7-14 days but they are rare; with everyone else, you just have to hope they pay you, and they do, I guess... whenever they feel like it.
codexon 6y ago
HackerOne has people screening reports that don't seem very technical. They closed one of my reports for being a "denial of service" attack when it was a crash caused by malformed input. I've also heard of others having the same issue.
- XMPPwocky 6y ago
  "a crash caused by malformed input" absolutely does sound like a DoS, though. Sounds like you have a crash that you think might be exploitable- in that case, consider saying "memory corruption triggered by malformed input" to make it more clear that the crash isn't the point.
rasz 6y ago
>“closed: duplicate issue” cool, posting my PoC on pastebin then

csours 6y ago

As contentious as reporting bugs can be during the development process, while working at the same company as the developers, I'm not at all surprised that ethical disclosure is terrible, especially with a monetary motivation.

thephyber 6y ago

> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.

jliptzin 6y ago
If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.
- SCHiM 6y ago
  As a hacker, I see a very easily exploitable flaw in your proposed solution :)
  - saagarjha 6y ago
    Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
- tptacek 6y ago
  Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
  - f- 6y ago
    If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).

dang 6y ago

We can fix that issue with the title with s/by/via/. Thanks!

wnevets 6y ago

> People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days. sounds these "hackers" have an incentive to be stubborn over non issues

albntomat0 6y ago
Agreed. There's also a clear incentive for companies offering the bounties to downplay valid bounties.
- tptacek 6y ago
  No, there isn't. Bounty dollars are immaterial to the companies offering them. In fact: the opposite incentive exists. These programs justify themselves by uncovering significant bugs.
  - albntomat0 6y ago
    When a bug has been submitted, and the company is trying to figure out how much to reward? The companies that consistently publish their bugs have a good track record of giving appropriate bounties. I don't see a clear incentive for a company that doesn't allow their bugs to be published, to be anything other than stingy. Computer security is a cost center for a business, and the folks managing the bug bounty program have a clear incentive to minimize their costs, while maximizing the bugs found. I think a potential solution would be increased bug disclosure on platforms like Hackerone. Currently, a company has to agree to disclose the details, and most never do. Openness allows hackers to vote with their feet, and spend more time on the companies that are easier to work with, both in bounties rewarded, and easiness of the reporting process.
    - tptacek 6y ago
      I've read this a couple times and don't really follow it. In reality, there is a tacit consensus scale for vulnerabilities by severity; a real XSS, for instance, in a platform where XSS isn't somehow sev:crit like it is on a large social network, is worth "hundreds" of dollars. Most companies have a scale worked out ahead of time. HackerOne will give you advice on scales if you want to take it. Whatever the scale is, companies have no incentive to avoid paying them, because even at the high end of the scale the amounts are immaterial. Remember, we're talking about H1 bounties here, not the Apple and Google platform bounties, which are totally different animals. The real risk companies that run bounties face is that their programs won't generate any real bugs at all, but will absorb costs from both the platform and all the nonsense bugs they have to triage. New serious bounties are good news, not bad news, for most bounty programs. (I've managed several, continuing until recently; before I did, I went around talking to people who ran them to get the lay of the land. I'm pretty confident in my answers here.)

twox2 6y ago

Same here. 90% of reports are from folks that didn't bother to read the terms and sending in useless reports. As a researcher, I'd spend days chasing something down just to get $50 for my finding months later.

julianeon 6y ago
Wow, that's like a 90% discount from what is presumably the actual going rate. I don't know how you could live in the Bay Area and possibly afford to do this, other than as a sort of beer money game.
- LilBytes 6y ago
  I find in BugCrowd that most of these reports that are spammy or useless in nature are from researchers in developing countries and have a limited grasp of the English language. They simply don't take no for an answer.

DoofusOfDeath 6y ago

> HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform. (Tangent) Can anyone recommend a coherent interpretation of that statement? I know what it means for an individual person to be proud. And I could see an argument for extending that notion to a group of persons if every person in the organization was proud. But I assume HackerOne has had employees / members come and go over time. And I also assume that some of the past or current members don't share that feeling of pride for this particular milestone. So the only interpretation I can think of is that the person writing the PR was being sleazily vague. I.e., trying to get the audience to take a sentiment that's only meaningfully applied to individual humans / animals, and getting them to unwittingly apply it to a brand name instead. Is there a better explanation that eludes me?

qeternity 6y ago
Not really sure what you’re getting at here. Without getting into the boilerplate cooperate “we’re helping the world”, it’s a perfectly coherent sentence.
Talanes 6y ago
Expressing sentiment on behalf of collectives isn't a new idea from a PR writer, it's an ancient figure of communication.
antonvs 6y ago
Idiomatic English might be eluding you.

steve76 6y ago

Issue bug bounties to get users. Earn bug bounties in your day to day work. Best way to find a bug is to use the software. When you do, report it and send a quote for a fix which you will need to build anyways.

nstart 6y ago

I've started handling the security inbox at Buffer now and we use a normal email approach. I can honestly say that the experience is pretty much the same and I feel like the issues you describe are independent of Hackerone (perhaps the scale increases?). From my end, there are a lot of trivial things I have to go through where it's low effort on the researcher end (And I've even had automated searches where the researcher has sent mails to us assuming we'd have the same issue because of some similar HTTP Header or something similar). Thankfully I've gotten faster at keeping these out but it still takes up more time than needed. From the researcher end, I assume it's frustrating where they put in the effort to craft a well documented mail and I have to inform them that it's a duplicate or known issue that we are currently working on a fix for. It's a hard call and I'll often have to use a judgement call on these. But it's made harder still when I'll suddenly see an issue that has existed for a long time be reported by a single researcher. And then in a matter of two days 3 to 4 other researchers will pop up with the exact same issue leading me to believe that either there's different accounts under the same name, or some kind of researcher group that works together in sharing findings (And maybe bounty). Basically, I'm not sure how much this is a HackerOne issue vs a general bounty program pain ¯\_(ツ)_/¯

LMYahooTFY 6y ago

Is there a feasible way to ask an organization if they're aware of a vulnerability before you put in too much work on it? Can the query be ambiguous enough to avoid a free service rendered?

update 6y ago

As a bug bounty hunter, I can attest to having an awful experience at times. The three companies I have worked with @ HackerOne have all taken forever to payout or fix bugs. Currently, I have been waiting 4 months to be paid by a company on HackerOne, for a pretty dang high impact bug that leaves all their customers vulnerable; I checked today, & they still haven't fixed it, let alone paid out. You also have to be aware of policy changes. I've noticed companies remove language that told how much they'd pay out. Some companies have a mandatory pay out of 7-14 days but they are rare; with everyone else, you just have to hope they pay you, and they do, I guess... whenever they feel like it.

codexon 6y ago

HackerOne has people screening reports that don't seem very technical. They closed one of my reports for being a "denial of service" attack when it was a crash caused by malformed input. I've also heard of others having the same issue.

XMPPwocky 6y ago
"a crash caused by malformed input" absolutely does sound like a DoS, though. Sounds like you have a crash that you think might be exploitable- in that case, consider saying "memory corruption triggered by malformed input" to make it more clear that the crash isn't the point.

rasz 6y ago

>“closed: duplicate issue” cool, posting my PoC on pastebin then