5 ms·

I'm not a security researcher, but this seems extremely low.

• highwaylights 4y ago
  It certainly seems like a strong disincentive to report the next one, yes.
  • eli 4y ago
    And do what with it instead?
    • solveit 4y ago
      Just... not find it. It takes concentrated intentional effort to find these.
    • highwaylights 4y ago
      I’m quite certain there are groups in the world who would have paid far north of $20k for the ability to copy PS4/PS5 discs that don’t need a modification or jailbreak to play. I’m not saying that’s what should have happened, but $20k for something this severe is practically asking for that to happen.
    • synicalx 4y ago
      Sell the exploit to the highest bidder, I assume
  • numpad0 4y ago
    It feels like an another bullet point towards the end of the history of dedicated game consoles.
• rvz 4y ago
  It is very low for the target and also for that effort. I've seen a small amount of effort bounties that reel in $100K+. If that was a chain of 5 vulnerabilities for say the iPhone or Android, that would be worth over $1 million.
  • whoknew1122 4y ago
    Because a similar iPhone or Android vulnerability would be useful to state actors, APTs, and everything in between. It'd be easy to weaponize and market. Hell, you could start a career in the ethically dubious world of selling 0 days to to governments. But what we got here is a way to pirate video games. Weaponizing this vulnerability means someone can play bootleg video games. And to profit from bootlegging video games, you'd have to create manufacturing and distribution channels. Then you'd have to find people who want to buy games. That's a lot of work, and when you inevitably get caught you'll like face stiff fines (if not prison). Is this vulnerability worth more than $20k to Sony? Yes. Is it worth more than $20k to the person who found the vulnerability? Only if they can monetize it, which would require breaking various and sundry laws.
    • Cyph0n 4y ago
      > Only if they can monetize it, which would require breaking various and sundry laws. I mean, doesn't the same restriction apply to mobile exploits? You'd be breaking some kind of law by selling the exploit off, no? In my opinion, game piracy for latest gen consoles would be very easily monetizable. The challenge is figuring out how to make money without revealing your identity and/or basing your operations out of a more piracy-tolerant jurisdiction. Or you could sell the exploit off to someone who is willing to deal with all of this.
      • pvg 4y ago
        Distributing pirated games for hacked consoles without getting caught is not easy, as you point out yourself. This also goes for whoever you're trying to sell the exploit to it. I can't see any combination of these facts that add up to 'very easily monetizable'.
        • Cyph0n 4y ago
          “Very easily monetizable” is referring to the fact that you will easily find people who would pay to play the latest titles (in the past: modchips, emulators, etc.). This is especially true with PS5 thanks to the ongoing console shortage.