6 ms·

$40k? Lol. I’m poor and I’d have to think twice about disclosing it for that. How many government lists does having the ability to discover that type of expl

$40k? Lol. I’m poor and I’d have to think twice about disclosing it for that. How many government lists does having the ability to discover that type of exploit get you on? I bet Microsoft would claim damages of $1+ billion if someone used that type of exploit maliciously by damaging data and undermining customer confidence in Azure. What a joke. This should pay $1+ million.

cagenut 5y ago
The context you're missing here is the company/research-team that found this are ex-MS employees who started a company (Wiz.io) to help other companies secure their cloud hosting/environments. This is some of the most pure-gold viral content marketing they can dream of, they don't care about the $40k at all, its just to acknowledge this is non-trivial.
- doliveira 5y ago
  That sounds like paying artists with "exposure".
  - ufmace 5y ago
    There is kind of a 2-sided argument here: 1. Small time cheap skate business owners sometimes try to cheat professional artists by "paying with exposure", when they have no meaningful audience or influence and therefore no meaningful exposure to give. 2. Sources that do genuinely have very large audiences and influence can infact give an artist so much exposure that it's worth far more than any reasonable direct payment This situation seems a lot more like 2 than 1. The company is in the business of helping companies secure their cloud environments, and these articles going around the tech press are being read by hundreds of thousands of people who are generally more interested in cloud security than a random person. They could spend many times the amounts discussed here on advertising and still not get their name in front of that many of the right people in a good context.
    - doliveira 5y ago
      Big or small company, I doubt they can pay the employees' salary with "exposure". They might have pratically infinite VC money for now, but that's an orthogonal discussion, just as "exposure" and being fairly compensated are. edit: and what about it had been a smaller company or individual researcher who wouldn't be able to gain as much from this publicity? Are you saying that Microsoft would have awarded them $ 500k? Because that's not the message sent with this reward. And frankly, even this discussion is kind of off-the-point because I doubt that's what they took into account when defining the money quantity.
- scrollaway 5y ago
  Uh, yeah, maybe, I'm not sure how much this changes things to be honest. I fully agree with grandparent this is $1MM reward territory. (Edit: sibling put it really elegantly, this is pay-with-exposure justification) PR campaign or not, you don't spit on those kinds of rewards. And it's a bad look on MS to award 40k on one of the worst vulnerabilities to ever hit a cloud provider...
- woofie11 5y ago
  The context you're missing is it doesn't matter. Next person to discover a similar vulnerability in Azure will have a choice: 1. Disclose to Microsoft for $40k 2. Disclose to an intelligence agency for several times that 3. Disclose to criminals for several times that, in turn The incentives are now publicly known to be misaligned, and as a potential Azure customer, I have to contend with the simple reality that a significant number of vulnerabilities will be exploited rather than reported. $40k doesn't even come close to covering engineer time here. This should be a $1M payout.
  - deleted 5y ago
    [deleted]
  - jcims 5y ago
    If companies have to outcompete criminals and intelligence agencies in the open market there will be no bug bounties, we'll just go back to the old way of doing things. The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.
    - woofie11 5y ago
      Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.
      - jcims 5y ago
        My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
        throwaway739 5y ago
        You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
oaiey 5y ago
Because it is unethical and in most countries illegal :) But you are right. They should pay them more.
- donmcronald 5y ago
  I wouldn’t use it maliciously, but I would honestly think twice about disclosing it. I think that’s especially true for anyone that doesn’t have a way to gain from the publicity.
  - cortesoft 5y ago
    This seems like a strange calculation... you think the scrutiny from being identified as talented enough to find this is bad enough to not be worth $40k + the reputation bump for your CV? That seems overly paranoid.
  - RealStickman_ 5y ago
    What would you use it for instead? 40k + recognition sounds way better than 0 and sitting on it.
- ramraj07 5y ago
  What if you sell to the NSA itself?
  - oaiey 5y ago
    Still unethical regards the users in risk. And most likely, still illegal since you were hacking before (i do not know the exact legal situation in the US)
Jyaif 5y ago
Maybe they have already sold the exploit months ago to everybody that would buy it?
YetAnotherNick 5y ago
The question is if this wouldn't have been reported what are the chances that this would have been exploited. Or what are the chances that Microsoft got saved from a hack in the wild from this knowing this vulnerability. If we assume that the codebase has one vulnerability for 10k lines, we would still get 10s of thousands of vulnerabilities. Any one of those could cost billion dollar to Microsoft, but patching one of those doesn't make the chance of getting hacked much different.
didntknowya 5y ago
well the black market is always going to pay more. that's kinda why criminals tend to go there...
jtsiskin 5y ago
Yes, the next person will contact someone like https://zerodium.com/program.html https://zerodium.com/program.html instead

cagenut 5y ago

The context you're missing here is the company/research-team that found this are ex-MS employees who started a company (Wiz.io) to help other companies secure their cloud hosting/environments. This is some of the most pure-gold viral content marketing they can dream of, they don't care about the $40k at all, its just to acknowledge this is non-trivial.

doliveira 5y ago
That sounds like paying artists with "exposure".
- ufmace 5y ago
  There is kind of a 2-sided argument here: 1. Small time cheap skate business owners sometimes try to cheat professional artists by "paying with exposure", when they have no meaningful audience or influence and therefore no meaningful exposure to give. 2. Sources that do genuinely have very large audiences and influence can infact give an artist so much exposure that it's worth far more than any reasonable direct payment This situation seems a lot more like 2 than 1. The company is in the business of helping companies secure their cloud environments, and these articles going around the tech press are being read by hundreds of thousands of people who are generally more interested in cloud security than a random person. They could spend many times the amounts discussed here on advertising and still not get their name in front of that many of the right people in a good context.
  - doliveira 5y ago
    Big or small company, I doubt they can pay the employees' salary with "exposure". They might have pratically infinite VC money for now, but that's an orthogonal discussion, just as "exposure" and being fairly compensated are. edit: and what about it had been a smaller company or individual researcher who wouldn't be able to gain as much from this publicity? Are you saying that Microsoft would have awarded them $ 500k? Because that's not the message sent with this reward. And frankly, even this discussion is kind of off-the-point because I doubt that's what they took into account when defining the money quantity.
scrollaway 5y ago
Uh, yeah, maybe, I'm not sure how much this changes things to be honest. I fully agree with grandparent this is $1MM reward territory. (Edit: sibling put it really elegantly, this is pay-with-exposure justification) PR campaign or not, you don't spit on those kinds of rewards. And it's a bad look on MS to award 40k on one of the worst vulnerabilities to ever hit a cloud provider...
woofie11 5y ago
The context you're missing is it doesn't matter. Next person to discover a similar vulnerability in Azure will have a choice: 1. Disclose to Microsoft for $40k 2. Disclose to an intelligence agency for several times that 3. Disclose to criminals for several times that, in turn The incentives are now publicly known to be misaligned, and as a potential Azure customer, I have to contend with the simple reality that a significant number of vulnerabilities will be exploited rather than reported. $40k doesn't even come close to covering engineer time here. This should be a $1M payout.
- deleted 5y ago
  [deleted]
- jcims 5y ago
  If companies have to outcompete criminals and intelligence agencies in the open market there will be no bug bounties, we'll just go back to the old way of doing things. The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.
  - woofie11 5y ago
    Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.
    - jcims 5y ago
      My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
      - throwaway739 5y ago
        You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.

oaiey 5y ago

Because it is unethical and in most countries illegal :) But you are right. They should pay them more.

donmcronald 5y ago
I wouldn’t use it maliciously, but I would honestly think twice about disclosing it. I think that’s especially true for anyone that doesn’t have a way to gain from the publicity.
- cortesoft 5y ago
  This seems like a strange calculation... you think the scrutiny from being identified as talented enough to find this is bad enough to not be worth $40k + the reputation bump for your CV? That seems overly paranoid.
- RealStickman_ 5y ago
  What would you use it for instead? 40k + recognition sounds way better than 0 and sitting on it.
ramraj07 5y ago
What if you sell to the NSA itself?
- oaiey 5y ago
  Still unethical regards the users in risk. And most likely, still illegal since you were hacking before (i do not know the exact legal situation in the US)

Jyaif 5y ago

Maybe they have already sold the exploit months ago to everybody that would buy it?

YetAnotherNick 5y ago

The question is if this wouldn't have been reported what are the chances that this would have been exploited. Or what are the chances that Microsoft got saved from a hack in the wild from this knowing this vulnerability. If we assume that the codebase has one vulnerability for 10k lines, we would still get 10s of thousands of vulnerabilities. Any one of those could cost billion dollar to Microsoft, but patching one of those doesn't make the chance of getting hacked much different.

didntknowya 5y ago

well the black market is always going to pay more. that's kinda why criminals tend to go there...

jtsiskin 5y ago

Yes, the next person will contact someone like https://zerodium.com/program.html https://zerodium.com/program.html instead