7 ms·

>Microsoft agreed to pay Wiz $40,000 for finding the flaw and reporting it, A vulnerability on this scale.. and they pay out only 40K ? I don't understand, thi

>Microsoft agreed to pay Wiz $40,000 for finding the flaw and reporting it, A vulnerability on this scale.. and they pay out only 40K ? I don't understand, this is peanuts compared to the damages this could cause no? Why do they not pay out respectable amounts?

cheschire 5y ago
seriously if they started paying out something comparable to small ransoms, some folks may be swayed back from the dark side.
- inter_netuser 5y ago
  multi-millions?
SilverRed 5y ago
They pay out the amount that researchers find worthwhile for the time they spent. The vast majority of people do not want to commit a serious crime in order to make a little bit more money so Microsoft does not have to pay the same rates.
- ClumsyPilot 5y ago
  "They pay out the amount that researchers find worthwhile for the time they spent." How have you confirmed that this amount is accurate? Have there been bo zero-days on the black market, instead all hackers have gone to microsoft? Would the number of hack on black market change is amount paid out increased 10x? It seems you have no basis for claiming that the amount paid is optimal
  - SilverRed 5y ago
    I actually didn't claim it was optimal. I simply disputed the claim that they should pay equal to the damages that could have been caused.
beermonster 5y ago
That was my first thoughts..
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
wil421 5y ago
Wasn’t Wiz founded by an ex Microsoft Cloud security engineer?
- beermonster 5y ago
  Yes, second paragraph in the article “ Wiz Chief Technology Officer Ami Luttwak is a former chief technology officer at Microsoft's Cloud Security Group.”
- mensetmanusman 5y ago
  Yes, very interesting strat. Start another company to warn your prior employer who wasn’t listening… and get paid more.
  - onionisafruit 5y ago
    You just reminded me of something I heard on a recent Darknet Diaries episode: > Some of the best hackers within the NSA turned into independent contractors so they could work faster and make more money, but were on the outside? This is one of those things that someone like Microsoft is afraid of, too. If they pay too much for bugs, then some of their internal bug hunters might decide to quit but keep doing the same thing; just make more money on the outside. He even used Microsoft as an example. I wonder if they paid less because the researcher was a turncoat in their mind.
eljimmy 5y ago
They don’t need to pay out anything.
- belter 5y ago
  You have a point there and the researcher has also no obligation of disclosing it to them.
  - latch 5y ago
    But they do have obligations that make it otherwise worthless to the them.
    - ClumsyPilot 5y ago
      They could contact a three letter agency, that's totally legal. Or they could release information publically, without informing M$
      - manbart 5y ago
        Apparently it would also be legal to sell it to authoritarian regimes a la NSO
      - abledon 5y ago
        sell it to FBI/CIA< and they use it on Azure China run by 21Vianet ?
Galanwe 5y ago
This logic could apply to any profession. You just happen to be on the expert side for this one. Should a surgeon ask you for millions? After all he saved your life. What about the mechanic that finds an issue with your breaks? If you paid someone not for the work done, but for the resulting loss if criminals exploited something, a lot of professions would ask for crazy prices.
- athorax 5y ago
  Or maybe a biomedical researcher discovers you have a special mutation that makes your kidney worth millions on the black market and informs you instead of the guys with a tub full of ice ready to go
- Gimpei 5y ago
  You're thinking about this in moralistic terms of deservedness. The shock I encountered at the 40K was that it wasn't enough to incentive future security researchers to find bugs. This just seems like a bad business decision.
  - asah 5y ago
    I think people underestimate how much work it is to find and report security issues... Including the unpaid labor of training... Anyway, seems like an NFT with the instructions would've sold for far more than 40k...
    - onionisafruit 5y ago
      Aren’t the contents of NFTs public before the sale? I agree with your general point that there were buyers willing to pay more, but NFT might not be the right vehicle for it.
      - cwilkes 5y ago
        It could be an NFT of the digitally signed exploit. Or something, NFTs confuse me
mikem170 5y ago
Maybe it's an imperfect market. Is there an auction site for zero days where Microsoft could bid on their own exploits? I'd be in favor of something like this. Why should the criminal justice system and every tax payer be on the hook for protecting these big companies from the consequences of their bug-ridden software?
- jonas21 5y ago
  Because the rule of law?
  - mikem170 5y ago
    Do you think laws are sacrosanct and can't be examined or changed? Do you think they don't need to be justified? There's many examples where the law doesn't stop companies from ripping off individuals, obfuscating terms and conditions to their advantage, hiding prices, etc. Recent example that bothers me is the paperwork at a doctors office, expecting the patient to be responsible for all bills insurance doesn't pay, without letting the patient know the costs involved, basically signing a blank check, even on a signature pad where the contract can't be seen, being told "this is just consent for the exam". The justification that these are standard forms is not a justification. Too often big companies get subsidized at public expense. That money goes right from taxpayers to shareholders. Microsoft should deal with the fallout from it's less secure software, not taxpayers. Instead these big companies race ahead to make features and sales, playing games with juristictions to avoid paying taxes, etc. Doesn't seem fair, and just saying "because rule of law" doesn't seem like a good explanation of why we should defend this kind of thing. Maybe a bug exploit should be considered protected free speech. How about that law?
- 0x426577617265 5y ago
  zerodium does payout for zero days -- but I don't think this would qualify. Scroll down to see list of prices. https://zerodium.com/program.html https://zerodium.com/program.html
1vuio0pswjnm7 5y ago
"... this is peanuts compared to the damages this could cause no?" But if no one can succesfully sue for those damages, then what is it really worth. The idea that Microsoft with its gargantuan resources cannot discover these mistakes and has to wait for "security researchers" to discover them and then pay them a paltry sum for their "valuable work" makes little sense; a more sensible interpretation is that the company has little incentive to find such mistakes because it has little exposure to potential liability arising from them. It needs to stage "security theater" to avoid reputational damage but does not need to achieve real results. Mistake after mistake, the stock price is not affected. Regarding an ongoing lapse in quality control that spans four decades, it has no skin in the game.
kerng 5y ago
I think payouts are defined in bug bounty programs upfront, so there are naturally upper bounds.

cheschire 5y ago

seriously if they started paying out something comparable to small ransoms, some folks may be swayed back from the dark side.

inter_netuser 5y ago
multi-millions?

SilverRed 5y ago

They pay out the amount that researchers find worthwhile for the time they spent. The vast majority of people do not want to commit a serious crime in order to make a little bit more money so Microsoft does not have to pay the same rates.

ClumsyPilot 5y ago
"They pay out the amount that researchers find worthwhile for the time they spent." How have you confirmed that this amount is accurate? Have there been bo zero-days on the black market, instead all hackers have gone to microsoft? Would the number of hack on black market change is amount paid out increased 10x? It seems you have no basis for claiming that the amount paid is optimal
- SilverRed 5y ago
  I actually didn't claim it was optimal. I simply disputed the claim that they should pay equal to the damages that could have been caused.

beermonster 5y ago

That was my first thoughts..

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

wil421 5y ago

Wasn’t Wiz founded by an ex Microsoft Cloud security engineer?

beermonster 5y ago
Yes, second paragraph in the article “ Wiz Chief Technology Officer Ami Luttwak is a former chief technology officer at Microsoft's Cloud Security Group.”
mensetmanusman 5y ago
Yes, very interesting strat. Start another company to warn your prior employer who wasn’t listening… and get paid more.
- onionisafruit 5y ago
  You just reminded me of something I heard on a recent Darknet Diaries episode: > Some of the best hackers within the NSA turned into independent contractors so they could work faster and make more money, but were on the outside? This is one of those things that someone like Microsoft is afraid of, too. If they pay too much for bugs, then some of their internal bug hunters might decide to quit but keep doing the same thing; just make more money on the outside. He even used Microsoft as an example. I wonder if they paid less because the researcher was a turncoat in their mind.

eljimmy 5y ago

They don’t need to pay out anything.

belter 5y ago
You have a point there and the researcher has also no obligation of disclosing it to them.
- latch 5y ago
  But they do have obligations that make it otherwise worthless to the them.
  - ClumsyPilot 5y ago
    They could contact a three letter agency, that's totally legal. Or they could release information publically, without informing M$
    - manbart 5y ago
      Apparently it would also be legal to sell it to authoritarian regimes a la NSO
    - abledon 5y ago
      sell it to FBI/CIA< and they use it on Azure China run by 21Vianet ?

Galanwe 5y ago

This logic could apply to any profession. You just happen to be on the expert side for this one. Should a surgeon ask you for millions? After all he saved your life. What about the mechanic that finds an issue with your breaks? If you paid someone not for the work done, but for the resulting loss if criminals exploited something, a lot of professions would ask for crazy prices.

athorax 5y ago
Or maybe a biomedical researcher discovers you have a special mutation that makes your kidney worth millions on the black market and informs you instead of the guys with a tub full of ice ready to go
Gimpei 5y ago
You're thinking about this in moralistic terms of deservedness. The shock I encountered at the 40K was that it wasn't enough to incentive future security researchers to find bugs. This just seems like a bad business decision.
- asah 5y ago
  I think people underestimate how much work it is to find and report security issues... Including the unpaid labor of training... Anyway, seems like an NFT with the instructions would've sold for far more than 40k...
  - onionisafruit 5y ago
    Aren’t the contents of NFTs public before the sale? I agree with your general point that there were buyers willing to pay more, but NFT might not be the right vehicle for it.
    - cwilkes 5y ago
      It could be an NFT of the digitally signed exploit. Or something, NFTs confuse me

mikem170 5y ago

Maybe it's an imperfect market. Is there an auction site for zero days where Microsoft could bid on their own exploits? I'd be in favor of something like this. Why should the criminal justice system and every tax payer be on the hook for protecting these big companies from the consequences of their bug-ridden software?

jonas21 5y ago
Because the rule of law?
- mikem170 5y ago
  Do you think laws are sacrosanct and can't be examined or changed? Do you think they don't need to be justified? There's many examples where the law doesn't stop companies from ripping off individuals, obfuscating terms and conditions to their advantage, hiding prices, etc. Recent example that bothers me is the paperwork at a doctors office, expecting the patient to be responsible for all bills insurance doesn't pay, without letting the patient know the costs involved, basically signing a blank check, even on a signature pad where the contract can't be seen, being told "this is just consent for the exam". The justification that these are standard forms is not a justification. Too often big companies get subsidized at public expense. That money goes right from taxpayers to shareholders. Microsoft should deal with the fallout from it's less secure software, not taxpayers. Instead these big companies race ahead to make features and sales, playing games with juristictions to avoid paying taxes, etc. Doesn't seem fair, and just saying "because rule of law" doesn't seem like a good explanation of why we should defend this kind of thing. Maybe a bug exploit should be considered protected free speech. How about that law?
0x426577617265 5y ago
zerodium does payout for zero days -- but I don't think this would qualify. Scroll down to see list of prices. https://zerodium.com/program.html https://zerodium.com/program.html

1vuio0pswjnm7 5y ago

"... this is peanuts compared to the damages this could cause no?" But if no one can succesfully sue for those damages, then what is it really worth. The idea that Microsoft with its gargantuan resources cannot discover these mistakes and has to wait for "security researchers" to discover them and then pay them a paltry sum for their "valuable work" makes little sense; a more sensible interpretation is that the company has little incentive to find such mistakes because it has little exposure to potential liability arising from them. It needs to stage "security theater" to avoid reputational damage but does not need to achieve real results. Mistake after mistake, the stock price is not affected. Regarding an ongoing lapse in quality control that spans four decades, it has no skin in the game.

kerng 5y ago

I think payouts are defined in bug bounty programs upfront, so there are naturally upper bounds.