8 ms·
Google paid $10M in bug bounty rewards last year
- jobs_throwaway 3y agoanyone have data on comparable companies' bug bounty payouts? $10m seems like a drop in the bucket for an org worth nearly $2 trillion, but its hard to say without seeing what similar-size companies do
- jsnell 3y agoTotally comparable to the amounts paid out by $3 trillion companies: Apple: https://security.apple.com/blog/apple-security-bounty-upgraded/ https://security.apple.com/blog/apple-security-bounty-upgrad... ($20M in 2.5 years) Microsoft: https://msrc.microsoft.com/blog/2023/08/microsoft-bug-bounty-program-year-in-review-13.8m-in-rewards/ https://msrc.microsoft.com/blog/2023/08/microsoft-bug-bounty... ($14M in a year)
- xeckr 3y agoProbably averting billions in damage.
- robertlagrant 3y agoYeah, smart, and contributing to the commons. As it should be.
- xeckr 3y agoI think it's still pretty clear that the bug hunters are getting the short end of the stick.
- tptacek 3y agoIn what way? If they're not getting a market offer from Google, they don't have to participate.
- xeckr 3y agoIn the way that they're getting pennies on the dollar. Of course they don't have to participate, but neither do workers in any other economy where slavery was abolished, so I don't see the point you're making.
- renewiltord 3y agoYou can't get a raw deal in a market economy. The deal you get is what the deal was worth.
- CyberDildonics 3y agoOnly if there is perfect information for everyone, which never happens.
- xeckr 3y agoThis isn't a market in any classical sense. First because Google decides what your bug is worth only after you submit it, second because the quantity of the product is indeterminable, and lastly because it includes participants at the state level on the buy side with basically infinitely deep pockets.
- renewiltord 3y agoYou can sell to lots of people. You don't have to sell to Google.
- willcipriano 3y agoAhh but first you have a find a market economy.
- remus 3y agoI think it depends on how you look at it. If your treated it as a job where you're trying to make a living from bounties then I think it is hard to do that, but if you do it as a side project or you happen to stumble on an issue then 5k or whatever is a nice bonus for reporting the issue responsibly.
- anonu 3y agoDoesn't seem like a lot of money, either in aggregate or to individuals.
- nlunbeck 3y agoExactly. Bug bounty seems like one of the smartest financial decisions a company can make. As for devs, it seems like a good deal if they're going to be finding these vulnerabilities anyway
- htrp 3y agoProbably a really cheap cost for security research recruitment. That's the recruiter cost for 200 security personnel.
- reaperman 3y agoor the annual salary of 10 really, really good security engineers at Google.
- neilv 3y agoOne way to look at it is a small price to pay, relative to the cost of those vulnerabilities being discovered and exploited in ways that cause major brand damage, negligence liabilities, and regulatory pressure. (Though, as developers, we shouldn't forget: not continuously creating vast numbers of defects in the first place would be better for society, and for the professionalism of our field.)
- Workaccount2 3y agoGoogle spending $10M is roughly equivalent to their share price moving 1/10 of 1 penny. Compare this to the cost of an exploit making into the wild and causing potentially hundreds of billions in value being lost. From this perspective one could make a reasonable argument that the bounty should be far higher.
- tptacek 3y agoExploits have a market clearing price, and for most vulnerabilities, that price is drastically lower (often asymptotically approaching zero) than technologists not i the field assume. Exploits can also cause damage, and the scale of damage inflicted doesn't have to connect to the market clearing price; that's a valid point to make. But it doesn't necessarily follow from it that researchers should get a bigger cut of the hypothetical damages. The most essential thing to understand about FAANG/hyperscaler bug bounty programs is: the people running these programs are incentivized to pay out more money. Google (or at least, the people running the bounty programs) would be happier i they were paying $20MM instead of $10MM. But they modulate prices to attract more and better submissions, and they can't raise prices "just because".
- mrkramer 3y ago>Compare this to the cost of an exploit making into the wild and causing potentially hundreds of billions in value being lost. Hundreds of billions?! What software vulnerability ever caused financial loss even close to that? Although you are right, that if your products are used on millions of devices you want to earn and keep users' trust. That's what Bill Gates and Microsoft realized 20 years ago[1][2] after lots of Microsoft's users and their devices got wrecked by Windows worms. [1] https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing [2] https://www.microsoft.com/en-us/security/blog/2022/01/21/celebrating-20-years-of-trustworthy-computing/ https://www.microsoft.com/en-us/security/blog/2022/01/21/cel...
- readyplayernull 3y agoThe question is how much they saved not employing more infosec/research staff?
- missedthecue 3y ago$10m is only about 20-30 engineers so probably quite a lot of money as saved
- tptacek 3y agoGoogle has one of the best staffed and best regarded security teams in the entire world; that consideration is not limited simply to the technology industry, but to all organizations globally. They are outgunned by the US Government, of course, but they in turn probably outgun the security teams of many other significant countries.
- JamesBarney 3y agoI had assumed Google/Microsoft/Apple had better security teams than the US Government because they could pay so much more. I wouldn't be surprised if maybe the NSA had better red teams than Google, but I'm honestly surprised the US Government outguns Google outside of that.
- Veserv 3y agoExploit development is more about effort and focus than difficulty. Any halfway-competent team can completely compromise any commercial IT security system. It is a competition to see who can crack the most eggs. Anybody can do it, but the winner is who is willing to spend the most time doing it. Google, and any commercial non-hacking organization, just has very little incentive to really waste a lot of money on that task. Where as basically every military and law enforcement arm of the US government has a ton of incentive and boatloads of money to spend cracking eggs. The military arms certainly spend billions a year and it would be quite unexpected if the law enforcement arms are not each, individually, spending hundreds of millions to billions per year. Is the quality lower? Maybe. But exploit development is so easy that hardly matters. If you want to hack somebody then good enough is enough.
- sigma5 3y agoseeing these number makes me wonder if bounty hunting these days is more profitable that working on a side project
- blitzar 3y agoGoogle also spent $10M for in flight catering on their private jets last year.
- wfh 3y agoOriginal blog post that the article was seemingly based on https://security.googleblog.com/2024/03/vulnerability-reward-program-2023-year.html https://security.googleblog.com/2024/03/vulnerability-reward...