3 ms·

I guess there's someone who orders the marketing department to say "1 million", while telling the operational side "10k", because his bonus rides on it.

by tgv 4y ago

UncleMeat 4y ago
That's not how it works. Bug bounties work like this. Somebody sets up a bounty program and defines a framework for deciding how much to pay out. Security is complicated as hell and you cannot possibly devise a framework that accounts for all possible things so this framework is necessarily brittle. For example, you might reasonably decide that the highest payouts require very minimal attacker capabilities (fully remote unauthenticated attacks being the top payouts). This makes sense since those are the easiest attacks to mount. So now a bounty comes in. It goes to a triage person or, at best, a small group. They refer to the framework. Your bug doesn't really match any of the categories but it kind of looks like this thing over here so it gets bucketed as such. Maybe there is some discussion. Ultimately, the rules say "max payout requires unauthenticated remote attacks" so the payout ends up lower, even if the attack is exciting. Maybe somebody managing the system takes a note to update the framework and policy moving forward. The community then rages about how this bug is actually a big deal and deserves a lot of reward. In my experience, the people managing these programs get rewarded based on the amount they pay out going up, not down. But you need a payment framework otherwise each bug is paid out on somebody's whim (and trust me, the security researchers will complain to high heaven if they perceive inconsistency in bounty sizes). So you end up with novel bug structures that aren't handled well by the framework and get treated weirdly.
- eklitzke 4y ago
  I'm still surprised by the $10k payout given the disclosure timeline. For example they indicate that on 2022-05-04 there was a "conference call between Quarkslab engineers, Google Android Security Team members, and a Titan engineering team member." Since there were both Android security team members and a Titan engineer in the phone call there were clearly engineers in the loop who understood the technical details of the issue as well as the severity. The initial $10k payout was done on 2022-06-07, a month later. One would imagine that this would have been escalated to some pretty senior security folks at Google before the payout was decided. That would mean that there would be some amount of discretion on Google's end as to the payout, since there would (presumably) be someone senior enough to look at this closely and authorize a higher amount even if there was some rubric that might seem to award a lower amount. Obviously this is ultimately what happened, as they eventually did increase the payout. It's a little strange to me though that this wasn't done sooner.
  - UncleMeat 4y ago
    > One would imagine that this would have been escalated to some pretty senior security folks at Google before the payout was decided. Bug bounties are routine. "How much do you want to pay out" is way down the list of things that leadership is focused on for these things. "How do we mitigate this" and "how does the researcher get paid" are often questions owned by different people and teams. Directors aren't swooping in to make payout decisions.

I guess there's someone who orders the marketing department to say "1 million", while telling the operational side "10k", because his bonus rides on it.

by tgv 4y ago

I guess there's someone who orders the marketing department to say "1 million", while telling the operational side "10k", because his bonus rides on it.

UncleMeat 4y ago

That's not how it works. Bug bounties work like this. Somebody sets up a bounty program and defines a framework for deciding how much to pay out. Security is complicated as hell and you cannot possibly devise a framework that accounts for all possible things so this framework is necessarily brittle. For example, you might reasonably decide that the highest payouts require very minimal attacker capabilities (fully remote unauthenticated attacks being the top payouts). This makes sense since those are the easiest attacks to mount. So now a bounty comes in. It goes to a triage person or, at best, a small group. They refer to the framework. Your bug doesn't really match any of the categories but it kind of looks like this thing over here so it gets bucketed as such. Maybe there is some discussion. Ultimately, the rules say "max payout requires unauthenticated remote attacks" so the payout ends up lower, even if the attack is exciting. Maybe somebody managing the system takes a note to update the framework and policy moving forward. The community then rages about how this bug is actually a big deal and deserves a lot of reward. In my experience, the people managing these programs get rewarded based on the amount they pay out going up, not down. But you need a payment framework otherwise each bug is paid out on somebody's whim (and trust me, the security researchers will complain to high heaven if they perceive inconsistency in bounty sizes). So you end up with novel bug structures that aren't handled well by the framework and get treated weirdly.

eklitzke 4y ago
I'm still surprised by the $10k payout given the disclosure timeline. For example they indicate that on 2022-05-04 there was a "conference call between Quarkslab engineers, Google Android Security Team members, and a Titan engineering team member." Since there were both Android security team members and a Titan engineer in the phone call there were clearly engineers in the loop who understood the technical details of the issue as well as the severity. The initial $10k payout was done on 2022-06-07, a month later. One would imagine that this would have been escalated to some pretty senior security folks at Google before the payout was decided. That would mean that there would be some amount of discretion on Google's end as to the payout, since there would (presumably) be someone senior enough to look at this closely and authorize a higher amount even if there was some rubric that might seem to award a lower amount. Obviously this is ultimately what happened, as they eventually did increase the payout. It's a little strange to me though that this wasn't done sooner.
- UncleMeat 4y ago
  > One would imagine that this would have been escalated to some pretty senior security folks at Google before the payout was decided. Bug bounties are routine. "How much do you want to pay out" is way down the list of things that leadership is focused on for these things. "How do we mitigate this" and "how does the researcher get paid" are often questions owned by different people and teams. Directors aren't swooping in to make payout decisions.