5 ms·

Won't the market just correct them here? If others are willing to pay more for the RCE 0-day, and are more reliable, they'll stop getting the reports and end u

Won't the market just correct them here? If others are willing to pay more for the RCE 0-day, and are more reliable, they'll stop getting the reports and end up scrambling a few times trying to catch up to the curve until they get the message.

p410n3 6y ago
The only company you can get bug bounty money from is the company that makes the software. If you sell your findings elsewhere you're selling an exploit. Which is probably more lucrative in most cases but also far less ethical. So there isn't much choice here
- ocdtrekkie 6y ago
  The market still kind of works: Who is going to bother looking for vulnerabilities in your software if the pay is so much better elsewhere? There may be only one place you can sell a bug, but the security researchers have better places to spend their time.
- deleted 6y ago
  [deleted]
gruez 6y ago
I think most bug bounty programs are so pitiful in terms of time/effort vs reward that almost nobody is dedicating research on the basis of it. a $10k bounty works out to less than a week's of work for a cybersecurity consultant (at consulting rates), and it's not even guaranteed (both in terms of not finding a bug, and the company offering the bounty marking it as invalid/duplicate). Not to mention, that the black market will pay far more for a 0day than the companies offering the bounties.
- netsec_burn 6y ago
  I've successfully completed bounty programs for Google, MasterCard, Dropbox, Pinterest, and some others I can't quite remember. I did the math each time for dollars earned over time spent, and the resulting figure is always under minimum wage. This is for critical vulnerabilities only (P1).
netsec_burn 6y ago
I'm in a good position to answer your question. I've been involved with making both bug bounty and zeroday companies, and I have experience selling zerodays to bounties and independent buyers alike. The truth is that the exploit acquisition market has many legal issues. Zerodium, who is often thought to be the leading buyer, publishes misleading guides and has had unusual timing in between the initial disclosure and hacking attempts on the researcher themselves. Other buyers have non-negotiable sale (not license!) contracts that may result in your zeroday being misused, and you may find yourself in a conspiracy. And those are the reputable and responsible buyers, there are others outside the US that are fronts for Israel/UAE/China. The market has plenty of room for correction, but there's a shortage of ethical buyers. If you could easily sell an exploit outside of a bug bounty program for more money, you'd see more people doing it regardless of the ethics (see: the NSA doing a bulk of the hiring in infosec, noone I spoke with that applied cared about the illegal surveillance disclosures and said they chose it because they offered 100k+). So the researchers currently have no choice, and the bounty programs take advantage of that. When the pendulum swings the other direction, you'll see bounty programs becoming more fair/lucrative.
- AsyncAwait 6y ago
  > The market has plenty of room for correction, but there's a shortage of ethical buyers. I wonder whom you'd consider an ethical buyer apart from the software maker for a closed source software since no one else can realistically patch it?
  - netsec_burn 6y ago
    Well if you want my opinion, military sales. Most government entities apart from the NSA are likely to use vulnerabilities as you'd expect.

p410n3 6y ago

The only company you can get bug bounty money from is the company that makes the software. If you sell your findings elsewhere you're selling an exploit. Which is probably more lucrative in most cases but also far less ethical. So there isn't much choice here

ocdtrekkie 6y ago
The market still kind of works: Who is going to bother looking for vulnerabilities in your software if the pay is so much better elsewhere? There may be only one place you can sell a bug, but the security researchers have better places to spend their time.
deleted 6y ago
[deleted]

gruez 6y ago

I think most bug bounty programs are so pitiful in terms of time/effort vs reward that almost nobody is dedicating research on the basis of it. a $10k bounty works out to less than a week's of work for a cybersecurity consultant (at consulting rates), and it's not even guaranteed (both in terms of not finding a bug, and the company offering the bounty marking it as invalid/duplicate). Not to mention, that the black market will pay far more for a 0day than the companies offering the bounties.

netsec_burn 6y ago
I've successfully completed bounty programs for Google, MasterCard, Dropbox, Pinterest, and some others I can't quite remember. I did the math each time for dollars earned over time spent, and the resulting figure is always under minimum wage. This is for critical vulnerabilities only (P1).

netsec_burn 6y ago

I'm in a good position to answer your question. I've been involved with making both bug bounty and zeroday companies, and I have experience selling zerodays to bounties and independent buyers alike. The truth is that the exploit acquisition market has many legal issues. Zerodium, who is often thought to be the leading buyer, publishes misleading guides and has had unusual timing in between the initial disclosure and hacking attempts on the researcher themselves. Other buyers have non-negotiable sale (not license!) contracts that may result in your zeroday being misused, and you may find yourself in a conspiracy. And those are the reputable and responsible buyers, there are others outside the US that are fronts for Israel/UAE/China. The market has plenty of room for correction, but there's a shortage of ethical buyers. If you could easily sell an exploit outside of a bug bounty program for more money, you'd see more people doing it regardless of the ethics (see: the NSA doing a bulk of the hiring in infosec, noone I spoke with that applied cared about the illegal surveillance disclosures and said they chose it because they offered 100k+). So the researchers currently have no choice, and the bounty programs take advantage of that. When the pendulum swings the other direction, you'll see bounty programs becoming more fair/lucrative.

AsyncAwait 6y ago
> The market has plenty of room for correction, but there's a shortage of ethical buyers. I wonder whom you'd consider an ethical buyer apart from the software maker for a closed source software since no one else can realistically patch it?
- netsec_burn 6y ago
  Well if you want my opinion, military sales. Most government entities apart from the NSA are likely to use vulnerabilities as you'd expect.