5 ms·

The context you're missing is it doesn't matter. Next person to discover a similar vulnerability in Azure will have a choice: 1. Disclose to Microsoft for $40k

The context you're missing is it doesn't matter. Next person to discover a similar vulnerability in Azure will have a choice: 1. Disclose to Microsoft for $40k 2. Disclose to an intelligence agency for several times that 3. Disclose to criminals for several times that, in turn The incentives are now publicly known to be misaligned, and as a potential Azure customer, I have to contend with the simple reality that a significant number of vulnerabilities will be exploited rather than reported. $40k doesn't even come close to covering engineer time here. This should be a $1M payout.

deleted 5y ago
[deleted]
jcims 5y ago
If companies have to outcompete criminals and intelligence agencies in the open market there will be no bug bounties, we'll just go back to the old way of doing things. The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.
- woofie11 5y ago
  Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.
  - jcims 5y ago
    My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
    - throwaway739 5y ago
      You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
      - pojzon 5y ago
        The reason you pay so little is to not encourage ppl to even start looking. Knowledge required to find stuff like that is very scarse. And you have to know where to look for. Chances to find something really big are so small that its not worth it to look for them finnancially. Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee. TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
      - jcims 5y ago
        Would you pay 100x as much for a service that is protected by that level of award?
      - EVa5I7bHFq9mnYK 5y ago
        1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
        syrgian 5y ago
        Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal. The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
        ta988 5y ago
        Thats why many doing that kind of stuff probably use a third party that keep money for a definite amount of time.
    - 5y ago
cortesoft 5y ago
Options 2 and 3 pose a moral and physical risk. Money isn't the only factor.
didntknowya 5y ago
if you're only in it for the money i don't think white hat is your calling.
jobigoud 5y ago
It does matter that they are ex-employees though. At some point you start to risk employees planting bugs themselves stealthily to claim the bounty later.

deleted 5y ago

[deleted]

jcims 5y ago

If companies have to outcompete criminals and intelligence agencies in the open market there will be no bug bounties, we'll just go back to the old way of doing things. The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.

woofie11 5y ago
Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.
- jcims 5y ago
  My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
  - throwaway739 5y ago
    You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
    - pojzon 5y ago
      The reason you pay so little is to not encourage ppl to even start looking. Knowledge required to find stuff like that is very scarse. And you have to know where to look for. Chances to find something really big are so small that its not worth it to look for them finnancially. Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee. TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
    - jcims 5y ago
      Would you pay 100x as much for a service that is protected by that level of award?
    - EVa5I7bHFq9mnYK 5y ago
      1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
      - syrgian 5y ago
        Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal. The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
        ta988 5y ago
        Thats why many doing that kind of stuff probably use a third party that keep money for a definite amount of time.
  - 5y ago

cortesoft 5y ago

Options 2 and 3 pose a moral and physical risk. Money isn't the only factor.

didntknowya 5y ago

if you're only in it for the money i don't think white hat is your calling.

jobigoud 5y ago

It does matter that they are ex-employees though. At some point you start to risk employees planting bugs themselves stealthily to claim the bounty later.