4 ms·

Google spending $10M is roughly equivalent to their share price moving 1/10 of 1 penny. Compare this to the cost of an exploit making into the wild and causing

Google spending $10M is roughly equivalent to their share price moving 1/10 of 1 penny. Compare this to the cost of an exploit making into the wild and causing potentially hundreds of billions in value being lost. From this perspective one could make a reasonable argument that the bounty should be far higher.

tptacek 3y ago
Exploits have a market clearing price, and for most vulnerabilities, that price is drastically lower (often asymptotically approaching zero) than technologists not i the field assume. Exploits can also cause damage, and the scale of damage inflicted doesn't have to connect to the market clearing price; that's a valid point to make. But it doesn't necessarily follow from it that researchers should get a bigger cut of the hypothetical damages. The most essential thing to understand about FAANG/hyperscaler bug bounty programs is: the people running these programs are incentivized to pay out more money. Google (or at least, the people running the bounty programs) would be happier i they were paying $20MM instead of $10MM. But they modulate prices to attract more and better submissions, and they can't raise prices "just because".
mrkramer 3y ago
>Compare this to the cost of an exploit making into the wild and causing potentially hundreds of billions in value being lost. Hundreds of billions?! What software vulnerability ever caused financial loss even close to that? Although you are right, that if your products are used on millions of devices you want to earn and keep users' trust. That's what Bill Gates and Microsoft realized 20 years ago[1][2] after lots of Microsoft's users and their devices got wrecked by Windows worms. [1] https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing [2] https://www.microsoft.com/en-us/security/blog/2022/01/21/celebrating-20-years-of-trustworthy-computing/ https://www.microsoft.com/en-us/security/blog/2022/01/21/cel...
- rKarpinski 3y ago
  > Hundreds of billions?! What software vulnerability ever caused financial loss even close to that? Does seem high but Cambridge Analytica Facebook scandal comes close if were talking about market cap they (it-least temporarily) lost over 100B [1] [1] https://www.theguardian.com/technology/2018/jul/26/facebook-market-cap-falls-109bn-dollars-after-growth-shock https://www.theguardian.com/technology/2018/jul/26/facebook-...
  - mrkramer 3y ago
    Cambridge Analytica was Facebook's screw-up on their users' data usage policy; basically Facebook enabled developers through Facebook's API and Social Graph integration siphoning of people's data for nefarious reasons. Could this be caught by public crowdsourced bug hunting project? Probably not or perhaps, if you would think about ways on how you can use people's social signals and connections to create some sort of privacy invading or flat out criminal products. I remember that after Cambridge Analytica, Google started limiting their API scope as well. I wouldn't classify Cambridge Analytica scandal as a software vulnerability but as a reckless data usage policy on the Facebook's part.
    - rKarpinski 3y ago
      > I wouldn't classify Cambridge Analytica scandal as a software vulnerability but as a reckless data usage policy on the Facebook's part. In addition to the reckless policy (and oversight), I assumed they were also violating the TOS & SLA's etc of the FB api's they used.
Veserv 3y ago
Critical exploits make it into the wild all the time. At worst they cause a tiny, temporary dip in stock price and frequently they cause the stock price to go up long term due to publicity. That is why they only spend 10 M$ on bounties, there is literally no point to spending more because the ROI is garbage. The only reason to run a bug bounty program is optics. You run a program paying out paltry amounts so that when your security is routinely completely compromised you can say you were a upstanding company who tried to work with upstanding offensive researchers. It is those evil, dastardly criminals funded by insert government here using "advanced", "unique" techniques and who can stop that? Therefore it is not our fault, now go keep buying our products and stock even though we have made no changes to our incompetent security process. Works every time.
- hollerith 3y ago
  OK, but governments operates computers, too, and don't want other governments to be able to break into those computers, so do they just not spend a lot on making it hard for the attackers from foreign governments or is defense different from offense here in that a government's inability (the US gov at least) to pay sky-high salaries does limit its ability to create and maintain good defenses?
  - Veserv 3y ago
    Offense is easy because defense is a joke. Nobody in the entire world has network connected commercial IT systems that are even minimally adequate. Yes, that includes Google, Amazon, Crowdstrike, any bank, Microsoft, Apple, Mandiant, and whoever else you care to name. All useless against small professional teams with a most a few million dollars of budget; amounts so small many of those companies have their financials denominated in larger units despite most of them spending hundreds of millions to billions of dollars trying to stop such attackers. If you are actually trying to stop a government with any of that garbage you might as well try to use an egg to stop a steamroller.
    - hollerith 3y ago
      If offense is as heavily favored as you say, then how come Russia hasn't done more damage to computer systems in Ukraine or in Western countries that support Ukraine? Clearly Russia is committed to spending whatever it takes to win the war and clearly Russia is not being held back by Russian worries about how the West will respond to Russian attacks on Western computers nor is it being held back by worries that if they deploy whatever exploits they have now (in attacks on Western computers) then those exploits will not be available for a more serious conflict with the West -- the Kremlin sees the current conflict as already extremely serious and consequential. For example, after Musk gave Starlink terminals to Ukraine (and Musk admitted as much in public) why wasn't Starlink's web site constantly being taken offline by Russian cyber-attacks? Ditto the routers that route traffic to and from Starlink's satellites. Is it your position that Russian spies are constantly breaking into Ukrainian and Western computer systems, but then they are only exfiltrating data because if they take those systems offline then that announces to the enemy the existence of the compromise, which the enemy can then respond effectively to (e.g., by buying new servers)?
baxtr 3y ago
How can one quantify this?

tptacek 3y ago

Exploits have a market clearing price, and for most vulnerabilities, that price is drastically lower (often asymptotically approaching zero) than technologists not i the field assume. Exploits can also cause damage, and the scale of damage inflicted doesn't have to connect to the market clearing price; that's a valid point to make. But it doesn't necessarily follow from it that researchers should get a bigger cut of the hypothetical damages. The most essential thing to understand about FAANG/hyperscaler bug bounty programs is: the people running these programs are incentivized to pay out more money. Google (or at least, the people running the bounty programs) would be happier i they were paying $20MM instead of $10MM. But they modulate prices to attract more and better submissions, and they can't raise prices "just because".

mrkramer 3y ago

>Compare this to the cost of an exploit making into the wild and causing potentially hundreds of billions in value being lost. Hundreds of billions?! What software vulnerability ever caused financial loss even close to that? Although you are right, that if your products are used on millions of devices you want to earn and keep users' trust. That's what Bill Gates and Microsoft realized 20 years ago[1][2] after lots of Microsoft's users and their devices got wrecked by Windows worms. [1] https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing [2] https://www.microsoft.com/en-us/security/blog/2022/01/21/celebrating-20-years-of-trustworthy-computing/ https://www.microsoft.com/en-us/security/blog/2022/01/21/cel...

rKarpinski 3y ago
> Hundreds of billions?! What software vulnerability ever caused financial loss even close to that? Does seem high but Cambridge Analytica Facebook scandal comes close if were talking about market cap they (it-least temporarily) lost over 100B [1] [1] https://www.theguardian.com/technology/2018/jul/26/facebook-market-cap-falls-109bn-dollars-after-growth-shock https://www.theguardian.com/technology/2018/jul/26/facebook-...
- mrkramer 3y ago
  Cambridge Analytica was Facebook's screw-up on their users' data usage policy; basically Facebook enabled developers through Facebook's API and Social Graph integration siphoning of people's data for nefarious reasons. Could this be caught by public crowdsourced bug hunting project? Probably not or perhaps, if you would think about ways on how you can use people's social signals and connections to create some sort of privacy invading or flat out criminal products. I remember that after Cambridge Analytica, Google started limiting their API scope as well. I wouldn't classify Cambridge Analytica scandal as a software vulnerability but as a reckless data usage policy on the Facebook's part.
  - rKarpinski 3y ago
    > I wouldn't classify Cambridge Analytica scandal as a software vulnerability but as a reckless data usage policy on the Facebook's part. In addition to the reckless policy (and oversight), I assumed they were also violating the TOS & SLA's etc of the FB api's they used.

Veserv 3y ago

Critical exploits make it into the wild all the time. At worst they cause a tiny, temporary dip in stock price and frequently they cause the stock price to go up long term due to publicity. That is why they only spend 10 M$ on bounties, there is literally no point to spending more because the ROI is garbage. The only reason to run a bug bounty program is optics. You run a program paying out paltry amounts so that when your security is routinely completely compromised you can say you were a upstanding company who tried to work with upstanding offensive researchers. It is those evil, dastardly criminals funded by insert government here using "advanced", "unique" techniques and who can stop that? Therefore it is not our fault, now go keep buying our products and stock even though we have made no changes to our incompetent security process. Works every time.

hollerith 3y ago
OK, but governments operates computers, too, and don't want other governments to be able to break into those computers, so do they just not spend a lot on making it hard for the attackers from foreign governments or is defense different from offense here in that a government's inability (the US gov at least) to pay sky-high salaries does limit its ability to create and maintain good defenses?
- Veserv 3y ago
  Offense is easy because defense is a joke. Nobody in the entire world has network connected commercial IT systems that are even minimally adequate. Yes, that includes Google, Amazon, Crowdstrike, any bank, Microsoft, Apple, Mandiant, and whoever else you care to name. All useless against small professional teams with a most a few million dollars of budget; amounts so small many of those companies have their financials denominated in larger units despite most of them spending hundreds of millions to billions of dollars trying to stop such attackers. If you are actually trying to stop a government with any of that garbage you might as well try to use an egg to stop a steamroller.
  - hollerith 3y ago
    If offense is as heavily favored as you say, then how come Russia hasn't done more damage to computer systems in Ukraine or in Western countries that support Ukraine? Clearly Russia is committed to spending whatever it takes to win the war and clearly Russia is not being held back by Russian worries about how the West will respond to Russian attacks on Western computers nor is it being held back by worries that if they deploy whatever exploits they have now (in attacks on Western computers) then those exploits will not be available for a more serious conflict with the West -- the Kremlin sees the current conflict as already extremely serious and consequential. For example, after Musk gave Starlink terminals to Ukraine (and Musk admitted as much in public) why wasn't Starlink's web site constantly being taken offline by Russian cyber-attacks? Ditto the routers that route traffic to and from Starlink's satellites. Is it your position that Russian spies are constantly breaking into Ukrainian and Western computer systems, but then they are only exfiltrating data because if they take those systems offline then that announces to the enemy the existence of the compromise, which the enemy can then respond effectively to (e.g., by buying new servers)?

baxtr 3y ago

How can one quantify this?