7 ms·
To the people publishing these exploits and collecting the trivial bounties. Hats off to you, no idea why you wouldn't just sell this off considering how poorl
by diveanon 6y ago
To the people publishing these exploits and collecting the trivial bounties.
Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded.
- Jabbles 6y agoFun? Integrity? Professionalism? The fact that there isn't a market for these kinds of bugs?
- eganist 6y agohttps://zerodium.com/program.html https://zerodium.com/program.html Google's SaaS apps aren't specifically in scope, but I'm not seeing exclusions, and I'm seeing potential parallel programs ("sensitive information disclosure: - MS Office (Word/Excel)") that could imply that they'd be comfortable buying SaaS Productivity Suite exploits as well. I'm not OP. I'm only presenting this to counter the assertion that there's no market.
- fireattack 6y ago> why you wouldn't just sell this off Wouldn't it be immoral if not straight up illegal?
- NeutronStar 6y agoAre lock picking tools illegal?
- judge2020 6y agoIllegal, including the logistics of selling it to shady/nation state actors. You can't just put a craigslist ad out for "selling google docs exploit" and expect them to reach out to you, if you don't already have contacts in the game you're probably not going to find a place to sell it (and then you might have issues receiving the money if you're US-based). The only grey area where you could really sell an exploit is something like zerodium https://zerodium.com/program.html https://zerodium.com/program.html
- whimsicalism 6y agoYou could definitely find a place to sell it as no trust is necessary: it would be trivial to prove you have the exploit without revealing the details.
- thaumasiotes 6y agoYour parent comment isn't talking about the difficulty of closing the transaction, but initiating it.
- whimsicalism 6y agoYou really don't have to look hard to find forums where people are selling exploits for $10k and up, though I imagine for multi-million transactions there are different forums.
- mkr-hn 6y agoYou can find people who claim all kinds of things on the internet. That doesn't mean they're credible.
- cutemonster 6y agoIf they were offering to buy for $10k and up, maybe that'd be different? (more likely to be serious? Or a honeypot somehow?)
- Someone1234 6y agoSpecifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (depending on buyer). Should it be illegal? Yeah, potentially. Is it? Unclear.
- rtsil 6y agoAt least accessory to crime if the exploit is used in a criminal activity, I presume?
- MeinBlutIstBlau 6y agoIf you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.
- ufmace 6y agoI'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices? Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet. We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.
- Arainach 6y agoThere's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.
- ta988 6y agoWhat should be made illegal is selling and use of exploits. That would put a lot of those shady "security" companies in trouble...
- jcims 6y agoI see this sentiment frequently, but there many ways to make money if you ignore the ethics of the transaction.
- coldpie 6y agoMost people aren't sociopaths.
- diveanon 6y agoAgree to disagree.
- speedgoose 6y agoNot everyone do bad things for a living.
- diveanon 6y agoAgreed, not everyone works for google.
- thegginthesky 6y agoFor a lot of that pursue white-hat career, it comes down to: 1. Principle - Some people are raised with really high morals and don't optimize for money. Depending on their own conscience, they wouldn't be able to sleep at night. 2. Obeying the law - Although one can easily make more money by using or selling these exploits, it can be a very dark path to dig yourself in. And depending on where you live the risk for life ruining litigation is very high too. 3. Brand reputation / Brand building / Professionalism - one can see that they can make more money for their own by building a solid portfolio of their achievements, and these bounties are a really strong signal when corporations look for security consulting. It also builds a good reputation which is really hard to build when doing white hat hacking for a living.
- diveanon 6y agoKudos to them disclosing critical bugs to one of the largest companies on the planet for less than their developers get paid for a week of work. Not saying they aren't good people, they are just undervaluing their work.
- thegginthesky 6y agoJust to be be clear I'm not supporting the low value of the bounty. My point is that there's more to it than just that. Aside from the subjective point 1 in my comment, I think points 2 and 3 are very objective and don't really depend on the pay of the bounty. If they find the bug and try to sell it on the dark/grey market, you risk litigation. If they are smart they can derive more value from it than just the bounty, although the bounty being bigger would be nice and would encourage more white hat hackers to invest their time on these programs.
- diveanon 6y agoSo google cheaps out on bounties because developers are clamoring to do free work for mega-adtech corp in hopes that the clout they get from it will pay out down the road. That's the most dystopian thing I've heard in a while.
- 6y ago
- kwanbix 6y agoBecause it is ilegal?
- diveanon 6y agoWhich law does selling a exploit break?
- random5634 6y agoI thought the US govt actively BOUGHT these types of cracks and hacks and used tools that used them. How do police departments crack open phones? Does this mean they are breaking the law by buying these exploits?
- ric2b 6y agoIs it? Which law is being broken?
- drstewart 6y agoH So by that token, hats off to the developers who don't intentionally put bugs in their code when they could and allow a friend to capture the exploit to split the bounty.
- cutemonster 6y agoI suppose if the bounties got really high, and higher and higher, eventually that'd start happening more and more often.
- xapata 6y agoI'm pretty sure most humans are nice to each other because they enjoy it and feel obligated to be nice, not for reward nor fear of punishment.
- diveanon 6y agoThat seems naive and is refuted by the existence of a legal system.
- xapata 6y agoQuoting myself: "most". Therefore, the existence of a legal system does not refute the claim. One example: At times it seems there are more dogs in my neighborhood than humans, yet, I thankfully seldom see dog poop left on the ground.
- tptacek 6y agoIf this bug works the way I think it does --- again, I could be wrong, but this looks like a pretty forward Clickjacking exploit to me --- there is nobody in the whole world that is going to pay what Google just did for it, because the only value this bug has is to be resold to Google for a bounty.
- cutemonster 6y agoSpear phishing?
- tptacek 6y agoIf you can spear phish someone into a fake Google Docs site to interact with a real document, you can almost certainly spear phish that person to simply reveal their credentials to you.
- NationalPark 6y agoYou'd have to be pretty well connected wouldn't you? It's not like you can just put up a craigslist ad that says, "looking for cybercriminal to buy my hack". But from the description, it doesn't sound like this vulnerability has much practical use. If you can convince someone to do all the things necessary to tee this up, you can probably just convince them to email you their password.
- notretarded 6y agoBecause it's difficult to, and difficult to ensure that those you're selling it to are trusted, means of transmission are secure and won't be intercepted etc etc... You also need the means to value it, how do you go about that? This also does not build your career. Saying >Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded. Is just naïve. 3.3k for doing nothing but disclose is incredibly generous, especially for this where vector is incredibly targeted and needs private information to begin with (doc ID).
- fractionalhare 6y ago> Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded. Aside from the ethical considerations you'd have to navigate, there isn't a market for vulns like this outside of bug bounties. People on HN always cite Zerodium or whatever but don't realize those markets exist for vulns with a long half life. The expected return on a vuln which exists in one website is quite bad.