11 ms·
Google launches new vulnerability reward platform
- dang 5y agoIt's here: https://bughunters.google.com/ https://bughunters.google.com/. Not sure which is the better top-level URL.
- encryptluks2 5y agoDang, that is super slow to load on mobile. Seriously takes like 5 seconds.
- jackson1442 5y agoYikes, it gets a 19 on Lighthouse for performance on desktop. It gets a 5 for performance on mobile. Guess it won't be ranked very well on Google Search!
- joshxyz 5y agoSame on desktop lmao, neat site though
- alphabet9000 5y agojust awful. pointlessly slow for such a simple page.
- sschueller 5y agoI didn't see anything regarding higher rewards. Have they increased them at all? $29m for 10 years of bug fixes seem like a steal for a multi billion dollar company. Especially if some of those bugs that have been reported and fixed are potentially lethal for the company.
- asah 5y agoThey pay what they need to pay. I'm sure they're also monitoring the dark web for black hats selling vulnerabilities instead of collecting bounties.
- smorgusofborg 5y agoGoogle and Apple's bids weren't high enough to get anyone in dozens of shady governments with access to NSO Group's services to successfully risk adding burner phones and then analyze these attacks. I think any alternative explanation to too cheap is even less savory.
- tptacek 5y agoPeople will sell bugs on the grey market no matter what Google pays, because not everybody can do business with Google. A reminder that grey market exploit purchases are tranched; the figures you hear for them are payout caps, not lump sums. If your bug is burned before all the tranches pay out, you're SOL.
- smorgusofborg 5y agoTrue, but I think you missed my point a little. The NSO group has been entrusting its vulnerabilities to people who would happily embezzle if it is some sufficient amount of money. If the bounty is ~2X these people's typical price in many countries that are NSO Group clients, then it is remarkable these bugs aren't being burned as a form of embezzlement. Your description of tranched payment risk only makes that more remarkable.
- tptacek 5y agoNSO's clients have effectively unlimited budgets. The bang for the buck on exploits is probably pretty shocking compared to alternative intelligence collection methods; sending actual people out to do stuff is incredibly expensive. When you raise the price of exploits --- which you should do for other reasons! --- you don't necessarily harm NSO. Since they effectively take a cut of exploit valuation, you may even help them.
- botwriter 5y agoI take it you'll get more money selling bugs to other actors. The story about the guy who only got $5k for owning Starbucks entire user database sticks in my mind.
- zibzab 5y agoIf only Google could run their other businesses as frictionless as this... Found an interesting bug? Let's have a 1-1 chat over lunch, drinks are on us BTW. Your developer account was banned by some bot gone wild? Sorry, no human interaction is allows in my department. Maybe if you have a famous buddy that can pester some hotshots on twitter...
- deleted 5y ago[deleted]
- shadowgovt 5y agoIt's tough; I wish I had a good solution to the latter problem. Half the trouble is the majority of what Google bans is semi-automated bot farms; the "minimal human contact" policies are to avoid making the company vulnerable to social engineering. (That vulnerability goes deep. People would look up the phone numbers of Google offices and call with stories about kidnapped family members and the need to get into a Gmail account to find the ransom note.)
- saalweachter 5y agoTo some extent, it all comes down to identity. If you knew which unique person was associated with each account and if you knew which unique person you were talking to on the phone, it would be possible to verify both that you are talking to the person you should be and that you aren't talking to Notorious Social Engineer #2344 trying to do something shady. But instead you're stuck trying to figure out if "Saal Weachter" on the the phone is the proper owner of the 'saalweachter' account, or even if it is someone named "Saal Weachter" on the phone at all.
- Cromation 5y agoIs it just me or does the graphic towards the end of the post misspell triage? I dont believe tirage fits at all for that use, but I could be wrong.
- invalidusernam3 5y agoReport it as a bug and get that bug bounty!
- haydenchambers 5y agoDon't you always draw wine from a barrel after someone reports a bug?
- sirdarckcat 5y agoIt can be tiring at times.
- alphabet9000 5y agoit was fixed but here's the one this person was referring to https://web.archive.org/web/20210727142303im_/https://lh4.googleusercontent.com/BxfBq5JzWlEigIvudlhSk5hJRq4h9jG-92La8srRynzIAr7hhjRZgV1yFIILq8rrsapM8rjX-4xrIBdN2x19zP9XadBmVIQ-p2PbNWfWVeEb082wAhMjvkcrgt08R8ARsr1GOV07gw https://web.archive.org/web/20210727142303im_/https://lh4.go...
- bostondavidvc 5y agoWhoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards https://bughunters.google.com/about/patch-rewards Payouts for security-positive improvements to security-critical OSS projects: * $20,000 for setting up continuous fuzzing with OSS-Fuzz * $10,000 for high-impact improvements that prevent major classes of vulnerabilities but the low end of the scale is kind of neat too: * "$1,337 for submissions of modest complexity, or for ones that offer fairly speculative gains." * "$500 our "one-liner special" for smaller improvements that still have a merit from the security standpoint." ... and you can qualify for these even if your day job is working on one of these OSS projects! > Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify? > A: They most certainly do. Neat stuff. (Googler here, but I don't work on the VRP.)
- Trias11 5y ago1. Press [Submit] 2. Thank you for your submission, that was already known issue.
- biryani_chicken 5y agoWill project maintainers avoid writing issue tickets before sending the patch to this platform?
- HenryKissinger 5y agoThey need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.
- H8crilA 5y agoNot sure why you're downvoted, but the $3M/year total rewards payoff is likely smaller than the corporate administrative and developer time (for review) costs. I.e. if this was a charity it would pay out less than 50 cents on the dollar.
- 5y ago
- deckar01 5y agoI would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independently discovered. I would like to see status updates from developers. I would like to see some kind of shared compensation system that acknowledges it can take more than one person to investigate a problem before it is fixable and that even time spent replicating a vulnerability has value.
- anonymouswacker 5y agoSounds like a full time job vs. a gig.
- notatoad 5y agoyeah, these are all features of working on the development team of a project. involving every developer who wants to work on a bounty at that level would be an insane amount of management overhead. It makes sense if you're vetting people beforehand to make sure that giving them this level of access and communication is worth the effort, but that's what a job interview is.
- deckar01 5y agoNot work on the bug, just be kept in the loop like the initial reporter. Putting in the same effort as the first reporter should earn you the same trust that is afforded to the first reporter.
- ehsankia 5y agoIf you're not going to win a prize, why would you need to be kept in the loop about an internal vulnerability that is being worked on? As for getting a prize, it goes back to the dupe issue which is the source of a lot of abuse. There's no way to prove you also worked on it or if you just got the info from your friend and want to double your winnings.
- ds 5y agoThere must be something I am missing, because I dont understand how underpaid most bug bounty programs are. If I ran Googles program, I would immediately 10x all payments, unironically. Yes, that means paying 1 million bucks for something you previously paid 100k for. Drop in the bucket. You also get a ton more eyeballs on you, letting you patch everything ASAP. But they dont do this. I dont know why. Security through obscurity? I suppose that works if you are myspace.com in 2021. Nobody likely gives a shit to try and hack it, but at the end of the day this is still google so that really doesn't apply. The downside of not paying handsomely is people realize they can make more money selling to third party vendors, (which some do) then every once in a while you get a bad PR story showing that your stuff was hacked and exploited for months/years and it potentially knocks a few points off your stock price. Money is really the end all be all. If you pay more than third party vendors, I can see almost no reason people would sell to them. At that point, your only adversary's are gov employees of nation states and the staff of companies dedicated to finding vulnerabilities.
- bsamuels 5y agoBug bounty prizes are set to encourage a certain quantity of bugs to be reported. If you offer 10x as much, your triage channels will get overwhelmed and you'll have to deal with a bunch of hostile researchers and development teams who hate your guts because you just blocked their next 2 sprints. If a bug bounty program is effective, then the payouts should trend up slowly over time as your security program becomes more efficient and produces more secure code. It's important to remember that purpose of bug bounty programs is not to reduce the number of bugs in the code base - it is a validation measure to check whether your controls are effective or if additional controls need to be added elsewhere.
- gibba999 5y agoAs a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. Google Docs, Search, and Mail do little in 2021 that I need that they didn't do in 2016. There's a lot more churn than bona fide improvement. Most tech just doesn't change that much. Heck, I'd take an online version of WordPerfect 7 from 1996 if it was trustworthy. That's a quarter-century. There's nothing Google Docs does, aside from collaboration, that I need that WP7 didn't do. On the other hand, I strongly distrust Google to maintain my data securely. As far as I can tell, aside from backwards compatibility/legacy reasons, the major reason people use Office 365, for better or worse, are issues like compliance and security. Security bugs ought to be sold to Google, found, and fixed. They shouldn't be sold to a ransomware gang or a government.
- mrRandomGuy 5y agoWith rewards this low it's no surprise that people sell bugs and exploits to often shady third party entities.
- tptacek 5y agoNobody is selling XSS bugs to NSO.
- _kbh_ 5y agowith the huge uptake in Electron apps you can probably sell an XSS if you can turn it into a RCE.
- drtgh 5y ago"How I Found a Vulnerability to Hack iCloud Accounts and How Apple Reacted to It" https://news.ycombinator.com/item?id=27564236 https://news.ycombinator.com/item?id=27564236 Spoiler: Apple didn't paid him (even they tried to fool him a second time). By reading HN its not the first time it happens..
- egberts 5y agoOh cool, look! Lower rewards!
- herpderperator 5y ago> To recap our progress on these goals, here is a snapshot of what VRP has accomplished with the community over the past 10 years: > Total bugs rewarded: 11,055 > Number of rewarded researchers: 2,022 So each person found an average of 5.5 bugs? That seems really high, no?
- heavyset_go 5y agoThe distribution probably has a relatively small amount of people reporting a disproportionately large amount of the bugs.
- deviation 5y agoThis is very true. It's been a reality for a long time that the most successful (measured in $x rewarded) bug hunters sometimes have hundreds or even thousands of bugs submitted per year. This way, they can capitalise on the fact that smaller security issues are much easier to find, especially if the bug hunter has expertise in the underlying framework.
- julienreszka 5y agoThe website doesn't give the option to have a light mode therefore makes it very difficult for me to read.