5 ms·

Is 5k an appropriate amount for such a finding? Sounds incredibly cheap for such a large organization. How much would something like this be worth on the black

by davnn 3y ago

Is 5k an appropriate amount for such a finding? Sounds incredibly cheap for such a large organization. How much would something like this be worth on the black market?

vicktorium 3y ago
you have to consider that in the black market the rates would absorb the illegality of the action. while 5k is 'clean'
- ZoomerCretin 3y ago
  Monero is always clean, too.
wslh 3y ago
No, that is in general the issue with security bounties. They attract mainly people who have enough time for trial and error and/or prior domain expertise and/or extremely smart in specific software. Nowadays cybersecurity is a vast field and it is not the same to be a white hat hacker specialized in Google Chrome issues than one in iOS. Not saying it cannot be the same person but the amount of time required to catch issues is long. I think supply chain attacks are not being taken very seriously. Think that people working, for example, in Python or JavaScript use pip or npm daily no matter if they work for a nuclear agency or your uncle's bar.
mardifoufs 3y ago
In an earlier article about the exploitation of GitHub actions in general (which this specific attack on pytorch is part of) they said: >So far, we’ve submitted over 20 bug bounty reports, raking in hundreds of thousands of dollars in bounties. So I think this is part of a chain of bounties? Though that can still be argued to be a bit too low for how powerful this exploit could be :)
- nightpool 3y ago
  Those are from different organizations, I think. So 5k from pytorch only but more from other orgs
1B05H1N 3y ago
Maybe 5k is the max payout for the bug class?
deleted 3y ago
[deleted]
pvg 3y ago
This question comes of up frequently with these and it's premised on the hypothetical value of the bug on 'the black market'. The vast majority of such reported vulnerabilities have a 'black market' value of roughly zero, though, including this one. This doesn't say anything about the quality of the research, just that it's pretty hard to get monetary or other value out of most vulnerabilities.
- withinboredom 3y ago
  It’s quite a bit more nuanced than that. Businesses only want to pay because it costs less than the damage done to the brand and/or lawsuits from users/data controllers. They don’t want to pay more than that. Researchers need money and are able to sell the fruits of their research to whomever they want. Generally, good-natured people will especially see if the bounty is worth it. It’s clean money, so it has additional value vs. selling it on the black market. So, as you can hopefully see, it is a balancing act between all parties.
  - pvg 3y ago
    No, I don't think that holds much explanatory power - the vast majority of vulns have not only zero black market value, they also carry effectively zero brand or legal liability risk. This is also the case for this vuln.
    - withinboredom 3y ago
      Generally, getting root on internal infrastructure is just a step away from doing whatever you want. Even if it is just waiting for someone to ssh in with -A set so they can steal your ash keys.
      - pvg 3y ago
        Yes that is exactly the sort of thing that has zero non-bounty dollar value and next to no legal or brand risk.
      - tptacek 3y ago
sp332 3y ago
Bug bounties do not compete with the black market. Also on the business side, they are not as efficient as just paying an internal QA or security team. Katie Mousouris, who set up Microsoft's original bug bounty program has gone into a lot of detail on this. E.g. https://www.zdnet.com/article/relying-on-bug-bounties-not-appropriate-risk-management-katie-moussouris/ https://www.zdnet.com/article/relying-on-bug-bounties-not-ap...

by davnn 3y ago

Is 5k an appropriate amount for such a finding? Sounds incredibly cheap for such a large organization. How much would something like this be worth on the black market?

vicktorium 3y ago

you have to consider that in the black market the rates would absorb the illegality of the action. while 5k is 'clean'

ZoomerCretin 3y ago
Monero is always clean, too.

wslh 3y ago

No, that is in general the issue with security bounties. They attract mainly people who have enough time for trial and error and/or prior domain expertise and/or extremely smart in specific software. Nowadays cybersecurity is a vast field and it is not the same to be a white hat hacker specialized in Google Chrome issues than one in iOS. Not saying it cannot be the same person but the amount of time required to catch issues is long. I think supply chain attacks are not being taken very seriously. Think that people working, for example, in Python or JavaScript use pip or npm daily no matter if they work for a nuclear agency or your uncle's bar.

mardifoufs 3y ago

In an earlier article about the exploitation of GitHub actions in general (which this specific attack on pytorch is part of) they said: >So far, we’ve submitted over 20 bug bounty reports, raking in hundreds of thousands of dollars in bounties. So I think this is part of a chain of bounties? Though that can still be argued to be a bit too low for how powerful this exploit could be :)

nightpool 3y ago
Those are from different organizations, I think. So 5k from pytorch only but more from other orgs

1B05H1N 3y ago

Maybe 5k is the max payout for the bug class?

deleted 3y ago

[deleted]

pvg 3y ago

This question comes of up frequently with these and it's premised on the hypothetical value of the bug on 'the black market'. The vast majority of such reported vulnerabilities have a 'black market' value of roughly zero, though, including this one. This doesn't say anything about the quality of the research, just that it's pretty hard to get monetary or other value out of most vulnerabilities.

withinboredom 3y ago
It’s quite a bit more nuanced than that. Businesses only want to pay because it costs less than the damage done to the brand and/or lawsuits from users/data controllers. They don’t want to pay more than that. Researchers need money and are able to sell the fruits of their research to whomever they want. Generally, good-natured people will especially see if the bounty is worth it. It’s clean money, so it has additional value vs. selling it on the black market. So, as you can hopefully see, it is a balancing act between all parties.
- pvg 3y ago
  No, I don't think that holds much explanatory power - the vast majority of vulns have not only zero black market value, they also carry effectively zero brand or legal liability risk. This is also the case for this vuln.
  - withinboredom 3y ago
    Generally, getting root on internal infrastructure is just a step away from doing whatever you want. Even if it is just waiting for someone to ssh in with -A set so they can steal your ash keys.
    - pvg 3y ago
      Yes that is exactly the sort of thing that has zero non-bounty dollar value and next to no legal or brand risk.
    - tptacek 3y ago

sp332 3y ago

Bug bounties do not compete with the black market. Also on the business side, they are not as efficient as just paying an internal QA or security team. Katie Mousouris, who set up Microsoft's original bug bounty program has gone into a lot of detail on this. E.g. https://www.zdnet.com/article/relying-on-bug-bounties-not-appropriate-risk-management-katie-moussouris/ https://www.zdnet.com/article/relying-on-bug-bounties-not-ap...