3 ms·

It's because of behavior like this that future Microsoft RCEs may be sold on the black market instead.

ciarannolan 6y ago
Microsoft only grossed $100,000,000,000 last year. What makes you think they can afford more than $500 for a bug bounty?
tartrate 6y ago
Everyone, literally everyone working on exploits right now will see this and potentially be influenced by how Microsoft chose to handle it.
robocat 6y ago
An ethical way of dealing with it in this case would be to publish that you found a security flaw (without actually disclosing the exact details) and maybe have some trusted third party verify it e.g. another white hat organisation like Google zero? Then the clients of Microsoft will put pressure to get it paid for and fixed - because they are the ones that bear the true cost of security violations (Microsoft only has indirect costs).
- ryan29 6y ago
  Yeah. This is how it should work IMO. Have a trustworthy organization that confirms bugs, but doesn’t require disclosure before payment. Let researchers place a value on their own work via a “buy it now” option and let organizations negotiate to buy bugs affecting their products. The only info shown publicly should be a severity rating. If an exploit is fixed, published, or used before a company buys it, the 3rd party could publish proof of previous knowledge about the exploit. There are a lot of good incentives in that system. The trusted third party will want to do a high quality job of verifying and categorizing exploits because overselling them will deter companies from buying and companies would be increasing their liability when they fail to buy bugs. For example, in this case, what’s the damage? IMO you could do millions of dollars in damage. In fact, if you went hog wild exfiltrating or destroying data, I bet the industry would value the damage over $1 billion dollars when you’re being prosecuted. I wonder what kind of legal hurdles a company would face trying to set something like that up. I think it makes a lot more sense than having companies working on the honor system because they’ve demonstrated they don’t play fair and bugs are severely undervalued. This is a $1 million bug IMO.
- chillfox 6y ago
  The clients won't care until after all of their files have been encrypted/deleted.

Microsoft only grossed $100,000,000,000 last year. What makes you think they can afford more than $500 for a bug bounty?

tartrate 6y ago

Everyone, literally everyone working on exploits right now will see this and potentially be influenced by how Microsoft chose to handle it.

robocat 6y ago

An ethical way of dealing with it in this case would be to publish that you found a security flaw (without actually disclosing the exact details) and maybe have some trusted third party verify it e.g. another white hat organisation like Google zero? Then the clients of Microsoft will put pressure to get it paid for and fixed - because they are the ones that bear the true cost of security violations (Microsoft only has indirect costs).

ryan29 6y ago
Yeah. This is how it should work IMO. Have a trustworthy organization that confirms bugs, but doesn’t require disclosure before payment. Let researchers place a value on their own work via a “buy it now” option and let organizations negotiate to buy bugs affecting their products. The only info shown publicly should be a severity rating. If an exploit is fixed, published, or used before a company buys it, the 3rd party could publish proof of previous knowledge about the exploit. There are a lot of good incentives in that system. The trusted third party will want to do a high quality job of verifying and categorizing exploits because overselling them will deter companies from buying and companies would be increasing their liability when they fail to buy bugs. For example, in this case, what’s the damage? IMO you could do millions of dollars in damage. In fact, if you went hog wild exfiltrating or destroying data, I bet the industry would value the damage over $1 billion dollars when you’re being prosecuted. I wonder what kind of legal hurdles a company would face trying to set something like that up. I think it makes a lot more sense than having companies working on the honor system because they’ve demonstrated they don’t play fair and bugs are severely undervalued. This is a $1 million bug IMO.
chillfox 6y ago
The clients won't care until after all of their files have been encrypted/deleted.