3 ms·

> It's just unfortunate that the various channels like HackerOne[0] or wherever the skiddies flock to these days are not utilized thoroughly. A lot of the bug

by Kalium 6y ago

> It's just unfortunate that the various channels like HackerOne[0] or wherever the skiddies flock to these days are not utilized thoroughly. A lot of the bug bounty programs don't pay as well as using exploits to steal money. Some estimates put this particular breach at having netted upwards of $120k. I don't think I've ever seen a bug bounty that high. The highest I've ever heard of or see documentation describing is in the range of $40k. If you don't think you'll get caught, why would you take the $40k instead of tripling that?

tptacek 6y ago
The opposite thing is true; people have wildly inflated expectations of how much money marginal bugs like XSS can earn, or even game-over bugs in marginally important applications. And if you're doing the financial comparison, as you note, you have to do it risk-weighted. Your intuitions about the risk of exploiting a vulnerability are likely heavily biased by the fact that most exploitation, or at least most of the exploitation you hear about, is non-monetary. Monetizing an exploit ratchets the risk up significantly.
- Kalium 6y ago
  I remember being 17. I was spectacularly bad at evaluating risks. You're right - a lot of people who want to file bug bounties overestimate how much marginal ones are worth. At the same time, this scenario suggests to me that bug bounties aren't currently doing a good job of incentivizing people away from attempting to monetize significant exploits and towards more responsible security practices. If we have to depend on the risk analyses of teenagers, we may be in trouble. Which is to say I suspect we have both problems.
thaumasiotes 6y ago
> Some estimates put this particular breach at having netted upwards of $120k. > I don't think I've ever seen a bug bounty that high. The highest I've ever heard of or see documentation describing is in the range of $40k. You're not paying attention. https://www.microsoft.com/en-us/msrc/bounty-hyper-v?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-hyper-v?rtc=1
- Kalium 6y ago
  Thank you! That's absolutely amazing reading. Have any of those $250k bounties been paid out? The $40k figure was something I found from a bounty that's actually been paid, rather than a hypothetical one.

by Kalium 6y ago

tptacek 6y ago

The opposite thing is true; people have wildly inflated expectations of how much money marginal bugs like XSS can earn, or even game-over bugs in marginally important applications. And if you're doing the financial comparison, as you note, you have to do it risk-weighted. Your intuitions about the risk of exploiting a vulnerability are likely heavily biased by the fact that most exploitation, or at least most of the exploitation you hear about, is non-monetary. Monetizing an exploit ratchets the risk up significantly.

Kalium 6y ago
I remember being 17. I was spectacularly bad at evaluating risks. You're right - a lot of people who want to file bug bounties overestimate how much marginal ones are worth. At the same time, this scenario suggests to me that bug bounties aren't currently doing a good job of incentivizing people away from attempting to monetize significant exploits and towards more responsible security practices. If we have to depend on the risk analyses of teenagers, we may be in trouble. Which is to say I suspect we have both problems.

thaumasiotes 6y ago

> Some estimates put this particular breach at having netted upwards of $120k. > I don't think I've ever seen a bug bounty that high. The highest I've ever heard of or see documentation describing is in the range of $40k. You're not paying attention. https://www.microsoft.com/en-us/msrc/bounty-hyper-v?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-hyper-v?rtc=1

Kalium 6y ago
Thank you! That's absolutely amazing reading. Have any of those $250k bounties been paid out? The $40k figure was something I found from a bounty that's actually been paid, rather than a hypothetical one.