7 ms·

Hunting vulns like this is super tedious - glad that there are bounty programs and hunters with the time to find and responsibly disclose bugs.

xwdv 6y ago
Now if only they could get decent payouts.
- Deukhoofd 6y ago
  Well, this author states he got a $5000 payout, I'd consider that pretty decent.
  - sneak 6y ago
    It's not when you consider it in context of the unpaid work one has to do to find payout bugs like this. For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours. Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.
    - rewq4321 6y ago
      Security researchers can easily get $500 per hour on consult. The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.
      - hinkley 6y ago
        More importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told. As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.
    - unityByFreedom 6y ago
      After winning a $5k payout I bet you can get a decent consultancy going. These payouts are foot-in-the-door or for hobbyists, like Kaggle is for ML.
      - krageon 6y ago
        "Do it for the exposure" is a nasty thing to say to people, even if you couch it in disguising terms.
        leetcrew 6y ago
        disagree, especially when the "exposure" is not the entire compensation package.
        sangnoir 6y ago
        > Isn't the entire pen-test/security industry based on exposure (of your "brand") though? What you can bill depends directly on how well known you are & your past work, in lieu of an objective measure of how good at it a person is. Geohot could bill thousands (or tens of thousands) per hour of his time and no one would bat an eye, but if some guy named Blake tried that, he'd be laughed out of the room.
        unityByFreedom 6y ago
        Why? I wish it paid a salary too but it isn't worthless. At the end of the day the businesses that best allocate their dollars for internal vs. outsourced talent are going to come out on top. I certainly don't see room for adding regulatory requirements here. And, about public pressure, this type of work is in its infancy, relatively speaking. Going straight for the throat is too much.
        krageon 6y ago
        "The free market will solve it" is sadly no longer a uniquely US-based view, but it is still wrong. There are so many examples of this I don't even know where to begin telling you how wrong it is.
  - dessant 6y ago
    Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google. Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.
    - deleted 6y ago
      [deleted]
    - gfxgirl 6y ago
      Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?
      - asdfasgasdgasdg 6y ago
        Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
        gfxgirl 6y ago
        My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
        toast0 6y ago
        If a video used to be public, but was turned private, there could be references to it in other places.
        BHSPitMonkey 6y ago
  - throwaway2245 6y ago
    For this kind of specialism, I'd expect a company to pay an internal employee that much ($5000) per week of work - and contractors should be charging double. The fact that a company has undervalued this work and failed to identify it as important, and someone external has identified it, makes it worth even more. A ransom demand on YouTube might be unbounded in value, e.g.: https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db-49d1-9e8f-a25cabe7dfcf https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db...
    - wscott 6y ago
      Exactly. If you have the skill set to find exploits like described here or even more complicated ones, would that payout tempt you do this fulltime? If you live in the US then I would say no. It ends up being much lower pay than you could get in other areas. For brilliant hackers in other parts of the world, then this might be a nice job. But I don't know if these bug bounties are available everywhere.
  - Jimmc414 6y ago
    Factor in how rare it is to find a software defect like this and how many fruitless hours of work go into finding it, the author is hardly breaking even. The only financial advantage I see is bestowed by the credibility gained from the publicity. Considering the monetary damage that a defect like this can do to YT and considering the thriving black market for zero days, $5000 seems irresponsibly low.
- SCHiM 6y ago
  It seems like many people disagree. But it's true. Microsoft used to pay 20k for exploit primitives that could potentially lead privilege escalation. These days the bounty program seem to require a demonstration (read: working exploit). Zerodium offers up to 80k for a working local privilege escalation exploit. Depending on the workings, if that exploit can be used to break out of a browser sandbox you might earn a bonus. The whitehat bounties are not market rate, if you only look at the monetary rewards.
  - tachyonbeam 6y ago
    The other thing to keep in mind here is that serious vulnerabilities can also be sold on the dark web for ~50K+ IIRC. They can also be sold to multiple different entities looking to build bot nets or whatever it is that people who are always wearing Guy Fawkes masks while sitting in dark rooms do. If you're paying just 5-20K, you're kind of counting on the people who find the exploit being nice and doing the right thing. Maybe that's mitigated because people with the know-how to find exploits like that are usually well-educated and not desperately in need of money, but people can be greedy.
    - ridaj 6y ago
      Also mitigated by the concern researchers should probably have for selling exploits to "bad guys", and the associated liabilities, criminal and otherwise
      - anthony_r 6y ago
        Exactly. Only one of these paths does not have a hidden/probabilistic cost. Hard to say what's the market rate for exposing yourself to criminal prosecution, it's not like there's a hedging market for such things. Though if as a corp you cover the black market rate fully then there's really no reason for a researcher to ever sell on the black market.
        SCHiM 6y ago
        What's criminal about selling to Zerodium though? I guess a case could be made that selling on the darknet is 'not in good faith'. That is an important criteria for determining if you're aiding and abetting where I'm from. But this problem is not there with all avenues for grey market transactions.
- SkyBelow 6y ago
  They get paid so little because there isn't any other legal means to exchange a bug into money. A monopoly on the only legal way to sell goods means that you get bad prices. But I do wonder if it would be possible to set up a legal alternative. I suspect if you did you would find law makers lobbied to make it illegal and it would already be decided as unethical by the corporate designed ethics systems.
- otterley 6y ago
  If the payout were too small, nobody would bother researching vulnerabilities and claiming payment while following the rules. The fact that people are doing it suggests the market is working (and perhaps the payment is even high considering how much participation is going on).
- jcims 6y ago
  The answer is pretty simple, don't participate if you don't like the terms.
  - j0ej0ej0e 6y ago
    I don't think it's as simple as that as you don't know what you're necessarily going to find at the starting line. Last month on HN someone got £7500 from FB, but, everyone thought he should have got more: https://news.ycombinator.com/item?id=25401294 https://news.ycombinator.com/item?id=25401294 There is also a darknet diaries episode (can't remember which) but the guy who found a bug had got into instagram s3 buckets and source code, he felt he should have got the $1M bug bounty but instead facebook claimed he did it without permission to go further and got fuck all.
    - deleted 6y ago
      [deleted]
    - SeeManDo 6y ago
      This reply led to a google search for darknet diaries. Thanks!
      - j0ej0ej0e 6y ago
        Np! Enjoy hours of great content!
    - Jabbles 6y ago
      s/everyone/someone
      - j0ej0ej0e 6y ago
        I've only just seen your comment and cba to re-read every comment but just at a quick glance out of the small amount of top-level comments 3 of them in the thread suggesting the same.
- cg-enterprise 6y ago
  I think that it's a pretty reasonable payout - people running bug bounties are mostly interested in actual security impact and practical exploitability. And the necessity to hit G server thousands of times to extract even a short video reduces that by quite a large proportion; which is definitely not a shot at the researcher, it's a great find, but exploitability is definitely lower than more direct form of IDOR (e.g. input private video ID and get the whole video in response). By the same logic, blind SQLi will typically be valued 'less' (hence pay out less) than SQLi with output.
  - jonnycomputer 6y ago
    My concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the times spent looking for bugs where there were none, or where they didn't see them.
    - jononor 6y ago
      Maybe bug bounty researchers should include this in their writeup that they send with the disclosure. Label it "security" testing, some details on what endpoints/methods where checked. Suggest a market value for this work, and say that an invoice with 50% rebate can be made out to cover it, if they wish. Need to word it carefully to avoid it sounding like a threat or demand. Intention would be to highlight the work put in and the value for the company, and make it as easy as possible to compensate that.
  - thw0rted 6y ago
    You wouldn't have to hit the server "thousands of times", do a binary search across frames to get the interesting (i.e. incriminating) bits, then flesh out detail. Security cameras often capture single-digit frames per second, but that doesn't make the footage less valuable as evidence.

xwdv 6y ago

Now if only they could get decent payouts.

Deukhoofd 6y ago
Well, this author states he got a $5000 payout, I'd consider that pretty decent.
- sneak 6y ago
  It's not when you consider it in context of the unpaid work one has to do to find payout bugs like this. For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours. Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.
  - rewq4321 6y ago
    Security researchers can easily get $500 per hour on consult. The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.
    - hinkley 6y ago
      More importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told. As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.
  - unityByFreedom 6y ago
    After winning a $5k payout I bet you can get a decent consultancy going. These payouts are foot-in-the-door or for hobbyists, like Kaggle is for ML.
    - krageon 6y ago
      "Do it for the exposure" is a nasty thing to say to people, even if you couch it in disguising terms.
      - leetcrew 6y ago
        disagree, especially when the "exposure" is not the entire compensation package.
      - sangnoir 6y ago
        > Isn't the entire pen-test/security industry based on exposure (of your "brand") though? What you can bill depends directly on how well known you are & your past work, in lieu of an objective measure of how good at it a person is. Geohot could bill thousands (or tens of thousands) per hour of his time and no one would bat an eye, but if some guy named Blake tried that, he'd be laughed out of the room.
      - unityByFreedom 6y ago
        Why? I wish it paid a salary too but it isn't worthless. At the end of the day the businesses that best allocate their dollars for internal vs. outsourced talent are going to come out on top. I certainly don't see room for adding regulatory requirements here. And, about public pressure, this type of work is in its infancy, relatively speaking. Going straight for the throat is too much.
        krageon 6y ago
        "The free market will solve it" is sadly no longer a uniquely US-based view, but it is still wrong. There are so many examples of this I don't even know where to begin telling you how wrong it is.
- dessant 6y ago
  Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google. Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.
  - deleted 6y ago
    [deleted]
  - gfxgirl 6y ago
    Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?
    - asdfasgasdgasdg 6y ago
      Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
      - gfxgirl 6y ago
        My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
      - toast0 6y ago
        If a video used to be public, but was turned private, there could be references to it in other places.
        BHSPitMonkey 6y ago
- throwaway2245 6y ago
  For this kind of specialism, I'd expect a company to pay an internal employee that much ($5000) per week of work - and contractors should be charging double. The fact that a company has undervalued this work and failed to identify it as important, and someone external has identified it, makes it worth even more. A ransom demand on YouTube might be unbounded in value, e.g.: https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db-49d1-9e8f-a25cabe7dfcf https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db...
  - wscott 6y ago
    Exactly. If you have the skill set to find exploits like described here or even more complicated ones, would that payout tempt you do this fulltime? If you live in the US then I would say no. It ends up being much lower pay than you could get in other areas. For brilliant hackers in other parts of the world, then this might be a nice job. But I don't know if these bug bounties are available everywhere.
- Jimmc414 6y ago
  Factor in how rare it is to find a software defect like this and how many fruitless hours of work go into finding it, the author is hardly breaking even. The only financial advantage I see is bestowed by the credibility gained from the publicity. Considering the monetary damage that a defect like this can do to YT and considering the thriving black market for zero days, $5000 seems irresponsibly low.
SCHiM 6y ago
It seems like many people disagree. But it's true. Microsoft used to pay 20k for exploit primitives that could potentially lead privilege escalation. These days the bounty program seem to require a demonstration (read: working exploit). Zerodium offers up to 80k for a working local privilege escalation exploit. Depending on the workings, if that exploit can be used to break out of a browser sandbox you might earn a bonus. The whitehat bounties are not market rate, if you only look at the monetary rewards.
- tachyonbeam 6y ago
  The other thing to keep in mind here is that serious vulnerabilities can also be sold on the dark web for ~50K+ IIRC. They can also be sold to multiple different entities looking to build bot nets or whatever it is that people who are always wearing Guy Fawkes masks while sitting in dark rooms do. If you're paying just 5-20K, you're kind of counting on the people who find the exploit being nice and doing the right thing. Maybe that's mitigated because people with the know-how to find exploits like that are usually well-educated and not desperately in need of money, but people can be greedy.
  - ridaj 6y ago
    Also mitigated by the concern researchers should probably have for selling exploits to "bad guys", and the associated liabilities, criminal and otherwise
    - anthony_r 6y ago
      Exactly. Only one of these paths does not have a hidden/probabilistic cost. Hard to say what's the market rate for exposing yourself to criminal prosecution, it's not like there's a hedging market for such things. Though if as a corp you cover the black market rate fully then there's really no reason for a researcher to ever sell on the black market.
      - SCHiM 6y ago
        What's criminal about selling to Zerodium though? I guess a case could be made that selling on the darknet is 'not in good faith'. That is an important criteria for determining if you're aiding and abetting where I'm from. But this problem is not there with all avenues for grey market transactions.
SkyBelow 6y ago
They get paid so little because there isn't any other legal means to exchange a bug into money. A monopoly on the only legal way to sell goods means that you get bad prices. But I do wonder if it would be possible to set up a legal alternative. I suspect if you did you would find law makers lobbied to make it illegal and it would already be decided as unethical by the corporate designed ethics systems.
otterley 6y ago
If the payout were too small, nobody would bother researching vulnerabilities and claiming payment while following the rules. The fact that people are doing it suggests the market is working (and perhaps the payment is even high considering how much participation is going on).
jcims 6y ago
The answer is pretty simple, don't participate if you don't like the terms.
- j0ej0ej0e 6y ago
  I don't think it's as simple as that as you don't know what you're necessarily going to find at the starting line. Last month on HN someone got £7500 from FB, but, everyone thought he should have got more: https://news.ycombinator.com/item?id=25401294 https://news.ycombinator.com/item?id=25401294 There is also a darknet diaries episode (can't remember which) but the guy who found a bug had got into instagram s3 buckets and source code, he felt he should have got the $1M bug bounty but instead facebook claimed he did it without permission to go further and got fuck all.
  - deleted 6y ago
    [deleted]
  - SeeManDo 6y ago
    This reply led to a google search for darknet diaries. Thanks!
    - j0ej0ej0e 6y ago
      Np! Enjoy hours of great content!
  - Jabbles 6y ago
    s/everyone/someone
    - j0ej0ej0e 6y ago
      I've only just seen your comment and cba to re-read every comment but just at a quick glance out of the small amount of top-level comments 3 of them in the thread suggesting the same.
cg-enterprise 6y ago
I think that it's a pretty reasonable payout - people running bug bounties are mostly interested in actual security impact and practical exploitability. And the necessity to hit G server thousands of times to extract even a short video reduces that by quite a large proportion; which is definitely not a shot at the researcher, it's a great find, but exploitability is definitely lower than more direct form of IDOR (e.g. input private video ID and get the whole video in response). By the same logic, blind SQLi will typically be valued 'less' (hence pay out less) than SQLi with output.
- jonnycomputer 6y ago
  My concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the times spent looking for bugs where there were none, or where they didn't see them.
  - jononor 6y ago
    Maybe bug bounty researchers should include this in their writeup that they send with the disclosure. Label it "security" testing, some details on what endpoints/methods where checked. Suggest a market value for this work, and say that an invoice with 50% rebate can be made out to cover it, if they wish. Need to word it carefully to avoid it sounding like a threat or demand. Intention would be to highlight the work put in and the value for the company, and make it as easy as possible to compensate that.
- thw0rted 6y ago
  You wouldn't have to hit the server "thousands of times", do a binary search across frames to get the interesting (i.e. incriminating) bits, then flesh out detail. Security cameras often capture single-digit frames per second, but that doesn't make the footage less valuable as evidence.