4 ms·

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty. You've b

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty. You've been handed a golden opportunity to set the right course.

deleted 2y ago
[deleted]
JumpCrisscross 2y ago
> $2,000 is a tiny fraction of what this bug is worth The Browser Company raises $50mm at a $550mm post-money valuation in March [1]. They’ve raised $125mm altogether. Unless they’re absolute asshats, they’ll increase the bug payout. But people act truly when they don’t think they’re being watched—a vulnerability of this magnitude was worth $2k to this company. That’s…eyebrow raising. [1] https://techcrunch.com/2024/03/21/the-browser-company-raises-50-million-at-550-million-valuation/?guccounter=1 https://techcrunch.com/2024/03/21/the-browser-company-raises...
- shuckles 2y ago
  "We will let anyone run arbitrary JavaScript on all your web pages if you send them a referral link" is surely a 6-7 figure vulnerability for a web browser. That this vulnerability was discoverable using about two steps of analysis tools suggests many more issues are in the product.
  - rafram 2y ago
    Not just that - seems like it allowed running privileged JavaScript (full access to your system) on the preferences page as well.
    - voiceblue 2y ago
      It is very strange to me that their attitude is "no one was impacted" and this is "hypothetical". Any serious company would immediately consider this to be a case where everyone was impacted! This is like coming home to the worst neighborhood on the planet to find your door wide open, and immediately putting on a blindfold so you can continue to pretend nothing's changed.
      - DecoySalamander 2y ago
        Since everything is stored in their DB, they supposedly can audit logs and sources for boosts themselves to confirm if anyone was actually impacted.
        voiceblue 2y ago
        Can you explain? How are they able to check whether someone did a quick “in and out” keylogger or cookie extraction? I doubt they can, because I doubt they store every request (that would go against what they claim for privacy) and I also doubt their DB backup happens on such a high frequency that they could catch this (e.g. minute-to-minute). So…how? Are you claiming they have oodles of logs and a perfect dork* to find suspicious JavaScript? If they had the latter wouldn’t they already be using it for security? If you have some method that works do tell. * https://www.alibabacloud.com/blog/what-is-dork_600025 https://www.alibabacloud.com/blog/what-is-dork_600025
        Cpoll 2y ago
        I don't think you're using "dorking" correctly here, since web crawlers aren't anywhere in the picture. Server log queries aren't "dorks." Besides, if you can reproduce the issue and _if_ it's somehow logged in the database, it's usually not too hard to figure out how to query for other occurrences. With that said, I think you're probably right. I doubt Firebase audit logs contain update contents, and based on the bug report, your "in and out" proposal is as simple as: firebase.collection("boosts").where("creatorID", "==", "attackers_user_id").update({"creatorId": "victims_user_id" }); sleep(time); firebase.collection("boosts").where("creatorID", "==", "victims_user_id").update({"creatorId": "attackers_user_id" }); (okay, not exactly, because this would also set the ownership of the victim's legitimate Boosts, but the actual code isn't much more difficult).
- cutemonster 2y ago
  They have more users than what I could have guessed: > As of July 2023, The Browser Company has 100,000+ users https://www.boringbusinessnerd.com/startups/the-browser-company#:~:text=Company%20Traction&text=As%20of%20July%202023%2C%20The,from%20751%20in%20June%202022 https://www.boringbusinessnerd.com/startups/the-browser-comp....
- behringer 2y ago
  It doesn't matter what bug bounty pay pay. If it was 200k people would say it's not enough.
Laaas 2y ago
Any new vulnerability will be sold to the highest bidder and/or exploited instead of being reported for the bug bounty because of this.
- poincaredisk 2y ago
  Most of the vulnerabilities I've disclosed, and I've seen disclosed, were disclosed for free, with no expectation of getting anything. Why do you think every researcher is an amoral penny pincher who will just sell exploits without caring for the consequences?
  - Novosell 2y ago
    Wanting money to live = penny pinching. Very cool.
  - lukan 2y ago
    Projecting?
- UncleMeat 2y ago
  I know a lot of different people who do independent security research and have submitted vulns to bounty programs. Not a single one would even come close to saying "well, the bounty is low so I'll sell this on the black market." Low bounties might mean that somebody doesn't bother to look at a product or doesn't bother to disclose beyond firing off an email or maybe even just publishes details on their blog on their own. Bounties aren't really meant to compete with black markets. This is true even for the major tech companies that have large bounties.
rattray 2y ago
Hursh responded elsewhere on the thread: https://news.ycombinator.com/item?id=41606219 https://news.ycombinator.com/item?id=41606219

deleted 2y ago

[deleted]

JumpCrisscross 2y ago

> $2,000 is a tiny fraction of what this bug is worth The Browser Company raises $50mm at a $550mm post-money valuation in March [1]. They’ve raised $125mm altogether. Unless they’re absolute asshats, they’ll increase the bug payout. But people act truly when they don’t think they’re being watched—a vulnerability of this magnitude was worth $2k to this company. That’s…eyebrow raising. [1] https://techcrunch.com/2024/03/21/the-browser-company-raises-50-million-at-550-million-valuation/?guccounter=1 https://techcrunch.com/2024/03/21/the-browser-company-raises...

shuckles 2y ago
"We will let anyone run arbitrary JavaScript on all your web pages if you send them a referral link" is surely a 6-7 figure vulnerability for a web browser. That this vulnerability was discoverable using about two steps of analysis tools suggests many more issues are in the product.
- rafram 2y ago
  Not just that - seems like it allowed running privileged JavaScript (full access to your system) on the preferences page as well.
  - voiceblue 2y ago
    It is very strange to me that their attitude is "no one was impacted" and this is "hypothetical". Any serious company would immediately consider this to be a case where everyone was impacted! This is like coming home to the worst neighborhood on the planet to find your door wide open, and immediately putting on a blindfold so you can continue to pretend nothing's changed.
    - DecoySalamander 2y ago
      Since everything is stored in their DB, they supposedly can audit logs and sources for boosts themselves to confirm if anyone was actually impacted.
      - voiceblue 2y ago
        Can you explain? How are they able to check whether someone did a quick “in and out” keylogger or cookie extraction? I doubt they can, because I doubt they store every request (that would go against what they claim for privacy) and I also doubt their DB backup happens on such a high frequency that they could catch this (e.g. minute-to-minute). So…how? Are you claiming they have oodles of logs and a perfect dork* to find suspicious JavaScript? If they had the latter wouldn’t they already be using it for security? If you have some method that works do tell. * https://www.alibabacloud.com/blog/what-is-dork_600025 https://www.alibabacloud.com/blog/what-is-dork_600025
        Cpoll 2y ago
        I don't think you're using "dorking" correctly here, since web crawlers aren't anywhere in the picture. Server log queries aren't "dorks." Besides, if you can reproduce the issue and _if_ it's somehow logged in the database, it's usually not too hard to figure out how to query for other occurrences. With that said, I think you're probably right. I doubt Firebase audit logs contain update contents, and based on the bug report, your "in and out" proposal is as simple as: firebase.collection("boosts").where("creatorID", "==", "attackers_user_id").update({"creatorId": "victims_user_id" }); sleep(time); firebase.collection("boosts").where("creatorID", "==", "victims_user_id").update({"creatorId": "attackers_user_id" }); (okay, not exactly, because this would also set the ownership of the victim's legitimate Boosts, but the actual code isn't much more difficult).
cutemonster 2y ago
They have more users than what I could have guessed: > As of July 2023, The Browser Company has 100,000+ users https://www.boringbusinessnerd.com/startups/the-browser-company#:~:text=Company%20Traction&text=As%20of%20July%202023%2C%20The,from%20751%20in%20June%202022 https://www.boringbusinessnerd.com/startups/the-browser-comp....
behringer 2y ago
It doesn't matter what bug bounty pay pay. If it was 200k people would say it's not enough.

Laaas 2y ago

Any new vulnerability will be sold to the highest bidder and/or exploited instead of being reported for the bug bounty because of this.

poincaredisk 2y ago
Most of the vulnerabilities I've disclosed, and I've seen disclosed, were disclosed for free, with no expectation of getting anything. Why do you think every researcher is an amoral penny pincher who will just sell exploits without caring for the consequences?
- Novosell 2y ago
  Wanting money to live = penny pinching. Very cool.
- lukan 2y ago
  Projecting?
UncleMeat 2y ago
I know a lot of different people who do independent security research and have submitted vulns to bounty programs. Not a single one would even come close to saying "well, the bounty is low so I'll sell this on the black market." Low bounties might mean that somebody doesn't bother to look at a product or doesn't bother to disclose beyond firing off an email or maybe even just publishes details on their blog on their own. Bounties aren't really meant to compete with black markets. This is true even for the major tech companies that have large bounties.

rattray 2y ago

Hursh responded elsewhere on the thread: https://news.ycombinator.com/item?id=41606219 https://news.ycombinator.com/item?id=41606219