4 ms·

Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything exce

by Svoka 5y ago

Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything except "application specific password" you could generate to use for POP3/IMAP access. When reported I was confronted by AI; unwelcoming replies "you don't understand this is a feature, not a bug". But, regardless, I was sent a bunch of scary emails with threats not to disclose this to anyone. I gave up, I had other stuff going on in my life. In two years, with fanfares some "security firm" discovered a bug and rolled out the full self-PR campaign with nice pictures describing a bug and how they got 1337 money. At that point I realized that bug bounty is only for professionals who have connections and willing ears to listen to them. I understand that from standpoint of big companies, they are flooded with requests, but it doesn't makes me feel better. I reported a serious security issue whole two years before they fixed it, but got absolutely nothing for it except threats and gaslighting.

volta83 5y ago
So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?
- paulryanrogers 5y ago
  These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
  - paulryanrogers 5y ago
    ^half hearted bug bounties
  - volta83 5y ago
    > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.
- marcosdumay 5y ago
  > So what did you learn out of this, and what would you do differently? The obvious lesson is "don't participate in bug hunting programs".
- handrous 5y ago
  > What do you think people should do differently when reporting these issues? ... sell vulns to bad actors for Monero or something?
todd3834 5y ago
I share some of this frustration. I once spent a ton of time finding XSS vulnerabilities for a Delta Airlines bug bounty program. One by one I would find and submit a report with instructions and screenshots. Every time they would reply saying they were already aware of the bug so no bounty. While I don’t doubt they were telling the truth it took away my motivation to invest time in this type of exercise going further.

by Svoka 5y ago

volta83 5y ago

So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?

paulryanrogers 5y ago
These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
- paulryanrogers 5y ago
  ^half hearted bug bounties
- volta83 5y ago
  > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.
marcosdumay 5y ago
> So what did you learn out of this, and what would you do differently? The obvious lesson is "don't participate in bug hunting programs".
handrous 5y ago
> What do you think people should do differently when reporting these issues? ... sell vulns to bad actors for Monero or something?

todd3834 5y ago

I share some of this frustration. I once spent a ton of time finding XSS vulnerabilities for a Delta Airlines bug bounty program. One by one I would find and submit a report with instructions and screenshots. Every time they would reply saying they were already aware of the bug so no bounty. While I don’t doubt they were telling the truth it took away my motivation to invest time in this type of exercise going further.