7 ms·

> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts

> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.

jliptzin 6y ago
If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.
- SCHiM 6y ago
  As a hacker, I see a very easily exploitable flaw in your proposed solution :)
  - saagarjha 6y ago
    Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
- tptacek 6y ago
  Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
  - f- 6y ago
    If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
    - paulryanrogers 6y ago
      How about dividing among reporters, bounty increases the longer it's not fixed since first report, and those paid must be publicly acknowledged. Probably also need stiff penalties for insiders who might conspire to notify others of bugs and split the pay out.
      - craftinator 6y ago
        The trouble with your first point is that companies won't go for it; no point in having HackerOne around if no one will use their platform. It's a tricky problem; let's solve it with AI and Blockchain!
        paulryanrogers 6y ago
        Why not divide the payout? The companies paying will pay the same amount, just divided among all the reporters. They already do the work of identifying duplicate reports. Maybe it could be weighted to pay more to the first reporter. As far as not doing it. At some point critical industries may be have to be regulated to force them to behave responsibly.
      - tptacek 6y ago
alasdair_ 6y ago
One alternative is to allow a report without full documentation and a PoC. If it’s a dupe, mark it as a dupe, otherwise ask for the full writeup. As for the problem of spammy submissions: charge a small nominal fee of $10 or so to submit, with a full refund if it’s a legit issue (even if it’s a duplicate).
- kelnos 6y ago
  Isn't that a potential information leak, though? A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. Maybe that's a little farfetched, though.
  - kerng 6y ago
    Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. Not a perfect fix, but I think it helps.
    - alasdair_ 6y ago
      >Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money. It's not a major likelihood, unless the bounties are numerous or especially large.
  - mikemotherwell 6y ago
    No it's exactly the sort of thought process people have. Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.
    - lawnchair_larry 6y ago

jliptzin 6y ago

If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.

SCHiM 6y ago
As a hacker, I see a very easily exploitable flaw in your proposed solution :)
- saagarjha 6y ago
  Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…
tptacek 6y ago
Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic. The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.
- f- 6y ago
  If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent. The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).
  - paulryanrogers 6y ago
    How about dividing among reporters, bounty increases the longer it's not fixed since first report, and those paid must be publicly acknowledged. Probably also need stiff penalties for insiders who might conspire to notify others of bugs and split the pay out.
    - craftinator 6y ago
      The trouble with your first point is that companies won't go for it; no point in having HackerOne around if no one will use their platform. It's a tricky problem; let's solve it with AI and Blockchain!
      - paulryanrogers 6y ago
        Why not divide the payout? The companies paying will pay the same amount, just divided among all the reporters. They already do the work of identifying duplicate reports. Maybe it could be weighted to pay more to the first reporter. As far as not doing it. At some point critical industries may be have to be regulated to force them to behave responsibly.
    - tptacek 6y ago

alasdair_ 6y ago

One alternative is to allow a report without full documentation and a PoC. If it’s a dupe, mark it as a dupe, otherwise ask for the full writeup. As for the problem of spammy submissions: charge a small nominal fee of $10 or so to submit, with a full refund if it’s a legit issue (even if it’s a duplicate).

kelnos 6y ago
Isn't that a potential information leak, though? A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes. Maybe that's a little farfetched, though.
- kerng 6y ago
  Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. Not a perfect fix, but I think it helps.
  - alasdair_ 6y ago
    >Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days. One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money. It's not a major likelihood, unless the bounties are numerous or especially large.
- mikemotherwell 6y ago
  No it's exactly the sort of thought process people have. Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.
  - lawnchair_larry 6y ago