5 ms·
$7500? Why are these bug bounties so piddling? How much would an exploit like this be worth on the black market? What's the potential loss / liability on Faceb
by ForHackernews 6y ago
$7500? Why are these bug bounties so piddling?
How much would an exploit like this be worth on the black market? What's the potential loss / liability on Facebook's side? Hundreds of thousands? Millions?
- tptacek 6y agoThere is no market for bugs like these.
- saltyshake 6y agonot even for nation states/APTs? Are you sure about that?
- _tk_ 6y agoI can’t speak for Thomas- but generally you’d want to invest your money in a vuln that is rather static. Web applications with attack surfaces that are constantly changing are not a good fit for a sophisticated attack with potentially huge blowback.
- dennisy 6y agoCould you please elaborate?
- tptacek 6y agoSorry, I didn't write clearly. What I meant was, there is no market for RCEs in random Facebook backoffice sites.
- VWWHFSfQ 6y agoWhere are you going to go to sell it? are you going to go find some tor hidden service with a forum that you can post your exploit on and hope that somebody will give you some bitcoins for it? You think that those are not under heavy surveillance already? The "black market" for this kind of thing is way overblown. And if you think you can just go sell it to some nation state, think again. That's an easy way to end up in a federal supermax.
- mszcz 6y agoIsn’t legal involved in most business moves? Getting a wind of those ahead of a public announcement surely must be worth something ;)
- detaro 6y agoA "market" needs a bit more than "is worth something". What multiplier of the $7500 bounty would you want for the trouble of committing a crime? Who's the buyer (FB afaik doesn't buy a whole lot of publicly traded companies, so it probably needs to be someone who can get into the deals, and quickly)? How do you find them? How do you convince that buyer that your deal is worth the money and the hassle of committing a crime? How do you trust the buyer? How do you handle it if the hole gets closed before the buyer can profit? How do you value the risk it gets closed before you got your deal? Does all that work out in a way that you really don't want to take the bounty? People buying backdoor access into companies probably happens occasionally, but it's probably not the easy high-profit thing compared to bounties many people think, but rather on the level of selling account information by the dozen for a few bucks - and for something like that you'll burn them quickly.
- tedunangst 6y agoIn other words, how much would Pepsi pay for the secret recipe to Coke?
- rascul 6y agoPepsi would report the person to Coca Cola instead of buying the recipe. https://thehustle.co/coca-cola-stolen-recipe https://thehustle.co/coca-cola-stolen-recipe > Months earlier, when Pepsi received the trio’s initial letter, they’d promptly forwarded it to Coca-Cola, and informed them they had a leaker. In turn, Coca-Cola had brought in the FBI to conduct an undercover investigation. > On July 5, 2006, Williams, Dimson, and Duhaney were arrested on charges of wire fraud and unlawfully stealing and selling trade secrets.
- tptacek 6y agoI believe a good way to think about the market for vulnerabilities is this: There are markets for vulnerabilities that slot seamlessly into existing business processes. In other words, you can tend to find a buyer for a vulnerability that would replace another vulnerability already being used, that accomplishes pretty much exactly the same thing as that vulnerability. The more people run that business process, the more likely it is that there's a liquid market. Lots of organizations have business processes that rely on browser RCEs. Generally, there aren't many organizations that have business process that rely on serverside vulnerabilities in line-of-business applications that have instantaneous half-lives, because once the patch is developed they're gone.
- deleted 6y ago[deleted]
- xwdv 6y agoHedge funds that employ blackhat hackers to steal confidential information from a public company would buy it.
- paxys 6y agoThere is no easily accessible "black market" for a hack like this. As an average person what is your alternative really? Pick up the phone and call the government of Iran? It is far more convenient (and safer) to just take the guaranteed ~$10K and move on with your life.
- rriepe 6y ago> Pick up the phone and call the government of Iran? Would that work? Asking for a friend.
- toyg 6y agoEven if it did, you wouldn’t want to do it. Someone like that can dispatch goons after the deal, to make sure they’ll be the only ones to know the hole.
- Biganon 6y agoHave you seen "Burn after reading"?
- rriepe 6y agoYes! I was trying to think of the name of it after making this comment. Thanks.
- ForHackernews 6y agoIt doesn't have to be "easily accessible" to be valuable. Corporate espionage exists, insider trading exists (and is more common than you might think), there's any number of parties who might pay for insider info (once properly laundered) about Facebook activities. Why would "the government of Iran" care about what Facebook is up to? Isn't FB banned in Iran?
- fakedang 6y agoYou forget that intelligence and espionage goes both ways. Iran could use FB in some way to attack the US, just like Russia did, just as it could shield itself from FB.
- anonytrary 6y agoExcept going to the black market is not legal and Facebook already knows of the exploit, so... People have been imprisoned for less.