4 ms·

I was a bit disappointed by Cloudflare's HackerOne-based disclosure / bug bounty program. I submitted a working proof-of-concept that would allow you to use Cl

I was a bit disappointed by Cloudflare's HackerOne-based disclosure / bug bounty program. I submitted a working proof-of-concept that would allow you to use Cloudflare's page-customizing preview function to create a Cloudflare phishing site. The issue was closed as "accepted as the nature of the cloudflarepreview playground". Then they went ahead and fixed the issue. Not the end of the world, but definitely didn't inspire confidence in the program.

Tenoke 5y ago
I find this is extremely common. Last year I submitted a working proof of concept with detailed explanations of how you can steal passwords and details of users as an app maker on Shopify, and it got denied for a similar reason (though I dont think it's been fixed). I've since stopped wasting my time on such pursuits.
- azemetre 5y ago
  No joke, have you thought about selling your exploits to other actors? Exploitation has such a rich history between sellers, buyers, and users; the marketplace is way more sophisticated than what it was in the 90s. You can probably get $5k to $20k for the exploit to Shopify. There are plenty of nationstate actors that create honeypots for a variety of targets. I'm sure Shopify exploits are worth something to someone.
  - juancampa 5y ago
    Wouldn't that be a serious crime?
    - obedm 5y ago
      Highly depends on which country you're based on I think. But yeah, it probably is
    - driverdan 5y ago
      Why? There's a difference between selling knowledge of software and using it to commit a crime.
    - azemetre 5y ago
      No, not if you sell it through an appropriate vendor that acts on behalf of the FBI/NSA/CIA (assuming you're US based). https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits Selling exploits use to be way more common prior to 2010. Previously many companies wouldn't pay for bug fixes and would periodically sue developers for disclosing issues. There eventually became a large movement within the cyber security groups about no longer giving bugs away for free and demanding fair market value for exploits (imagine the NSA paying $100k for a zero-day, versus the company giving you $500): https://threatpost.com/no-more-free-bugs-software-vendors-032309/72484/ https://threatpost.com/no-more-free-bugs-software-vendors-03... Nowadays the highly sought out targets like Android or iOS have premiums for zero-days (upwards to $1mil), in-fact it wasn't until Google started paying more for exploits was when Android security started getting better. But if some companies aren't willing to pay fair market value for their exploits, why should it matter if you sell it to someone else?
  - ipaddr 5y ago
    Who are you going to sell it to? Making those connections to state actors only makes sense if you are finding a lot of these. Not taking part and allowing that system to be exploited is the safest easiest way to fix these programs. The only legal way.
    - sangnoir 5y ago
      Zerodium is known to purchase exploits on behalf of their clients.
  - azinman2 5y ago
    I’m disappointed that no comment yet below is concerned about the morality of such a thing.
ipaddr 5y ago
The bug bounty programs can rip you off. I hope more people just stop taking part so they are forced to change into something honest.

Tenoke 5y ago

I find this is extremely common. Last year I submitted a working proof of concept with detailed explanations of how you can steal passwords and details of users as an app maker on Shopify, and it got denied for a similar reason (though I dont think it's been fixed). I've since stopped wasting my time on such pursuits.

azemetre 5y ago
No joke, have you thought about selling your exploits to other actors? Exploitation has such a rich history between sellers, buyers, and users; the marketplace is way more sophisticated than what it was in the 90s. You can probably get $5k to $20k for the exploit to Shopify. There are plenty of nationstate actors that create honeypots for a variety of targets. I'm sure Shopify exploits are worth something to someone.
- juancampa 5y ago
  Wouldn't that be a serious crime?
  - obedm 5y ago
    Highly depends on which country you're based on I think. But yeah, it probably is
  - driverdan 5y ago
    Why? There's a difference between selling knowledge of software and using it to commit a crime.
  - azemetre 5y ago
    No, not if you sell it through an appropriate vendor that acts on behalf of the FBI/NSA/CIA (assuming you're US based). https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits Selling exploits use to be way more common prior to 2010. Previously many companies wouldn't pay for bug fixes and would periodically sue developers for disclosing issues. There eventually became a large movement within the cyber security groups about no longer giving bugs away for free and demanding fair market value for exploits (imagine the NSA paying $100k for a zero-day, versus the company giving you $500): https://threatpost.com/no-more-free-bugs-software-vendors-032309/72484/ https://threatpost.com/no-more-free-bugs-software-vendors-03... Nowadays the highly sought out targets like Android or iOS have premiums for zero-days (upwards to $1mil), in-fact it wasn't until Google started paying more for exploits was when Android security started getting better. But if some companies aren't willing to pay fair market value for their exploits, why should it matter if you sell it to someone else?
- ipaddr 5y ago
  Who are you going to sell it to? Making those connections to state actors only makes sense if you are finding a lot of these. Not taking part and allowing that system to be exploited is the safest easiest way to fix these programs. The only legal way.
  - sangnoir 5y ago
    Zerodium is known to purchase exploits on behalf of their clients.
- azinman2 5y ago
  I’m disappointed that no comment yet below is concerned about the morality of such a thing.

ipaddr 5y ago

The bug bounty programs can rip you off. I hope more people just stop taking part so they are forced to change into something honest.