4 ms·

Google now pays $250k for KVM zero-day vulnerabilities

38 points by kungfudoi 2y ago

teruakohatu 2y ago
On one hand it sounds a lot, on the other hand ... probably less than a year's salary* for a SV software engineer with enough skill to find and fix a zero-day KVM. * I am not an American, just a wild guess.
- Onavo 2y ago
  KVM is the foundation of almost every major cloud hosting system, from tiny VPS shared hosting to serverless firecracker powered lambdas. There are security tech like gvisor but once you peel back the covers, it's still a virtual machine/hypervisor underneath at the lowest layer.
- DaiPlusPlus 2y ago
  > probably less than a year's salary TC, not salary; about on-par for a senior-level position on the west-coast.
xyst 2y ago
I wonder if people “double dip” by first offloading vulnerabilities to black market. Then claim the bug bounty later on. - find vuln (0day to you) - sell sploit on black market (0day for black market - months later, confirm if vulnerability has not been patched - if not patched, submit bug report and claim as new 0-day. “0day” for company. But it’s really been in the wild for 180-days - google sends $250K check but “researcher” also received $750K on the black market In addition to double dipping, can these high bounties also act as a way for employees to pad their salaries? - “accidentally” introduce bug in patch. Very easy to do an “xz/jia tan” like attack. Maybe slip it in a massive change request - let buddy know this vulnerability exists. Then have them claim the bounty. - months later have accomplice send cryto/nft/cash Probably can’t do this too often though.
- XorNot 2y ago
  No, they don't. HN posters are unreasonably confident that it's quick and easy to sell things on the dark net for huge profits.
  - altcognito 2y ago
    Shocker, people who take advantage of other people aren’t usually trustworthy or particularly generous - now I realize the counter example here is going to be malware companies that allegedly release keys after receiving the bounty payment but this is hardly a counter example.
- WatchDog 2y ago
  Apparently when you sell a vulnerability to a broker, the payment will be a structured settlement spread out over some period of time. I'm not sure what the valuation for a KVM bug would be, or over what period it would be paid, but I guess you could wait long enough for the majority of the payment to be received before submitting it for a bounty.
deleted 2y ago
[deleted]

38 points by kungfudoi 2y ago

On one hand it sounds a lot, on the other hand ... probably less than a year's salary* for a SV software engineer with enough skill to find and fix a zero-day KVM. * I am not an American, just a wild guess.

Onavo 2y ago
KVM is the foundation of almost every major cloud hosting system, from tiny VPS shared hosting to serverless firecracker powered lambdas. There are security tech like gvisor but once you peel back the covers, it's still a virtual machine/hypervisor underneath at the lowest layer.
DaiPlusPlus 2y ago
> probably less than a year's salary TC, not salary; about on-par for a senior-level position on the west-coast.

xyst 2y ago

I wonder if people “double dip” by first offloading vulnerabilities to black market. Then claim the bug bounty later on. - find vuln (0day to you) - sell sploit on black market (0day for black market - months later, confirm if vulnerability has not been patched - if not patched, submit bug report and claim as new 0-day. “0day” for company. But it’s really been in the wild for 180-days - google sends $250K check but “researcher” also received $750K on the black market In addition to double dipping, can these high bounties also act as a way for employees to pad their salaries? - “accidentally” introduce bug in patch. Very easy to do an “xz/jia tan” like attack. Maybe slip it in a massive change request - let buddy know this vulnerability exists. Then have them claim the bounty. - months later have accomplice send cryto/nft/cash Probably can’t do this too often though.

XorNot 2y ago
No, they don't. HN posters are unreasonably confident that it's quick and easy to sell things on the dark net for huge profits.
- altcognito 2y ago
  Shocker, people who take advantage of other people aren’t usually trustworthy or particularly generous - now I realize the counter example here is going to be malware companies that allegedly release keys after receiving the bounty payment but this is hardly a counter example.
WatchDog 2y ago
Apparently when you sell a vulnerability to a broker, the payment will be a structured settlement spread out over some period of time. I'm not sure what the valuation for a KVM bug would be, or over what period it would be paid, but I guess you could wait long enough for the majority of the payment to be received before submitting it for a bounty.

deleted 2y ago

[deleted]