5 ms·

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pus

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward answer: no, I don’t think $20k is underpaid. The severity of a bug isn't based on how it could theoretically affect people but on how it actually does. There's no evidence this is even in the wild, and based on the description, it seems complicated to exploit for attacks.

n2d4 2y ago
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
- thrdbndndn 2y ago
  I actually don't believe so. Not everything is priced on demand and supply -- at least not strictly. Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.
  - n2d4 2y ago
    I assure you that when Google set those bounties, they thought about how much they would have to pay white hats to make them do the right thing. Of course, it's a highly illiquid market (usually there's just one seller and only a handful of buyers), and so the pricing is super inefficient (hence based on guidelines and not surveying on every individual bug), but the logic remains.
- luismedel 2y ago
  I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market
  - graemep 2y ago
    I think many people have internalised a purely profit driven world view, and it is what they expect to be the main motivator or themselves and others.
    - TeMPOraL 2y ago
      TL;DR: a random stranger is most likely a nice and honest and principled human being. A sufficiently large population of random strangers behaves approximately like a population of amoral(ish), rational(ish) economic actors. If your process involves continuously drawing a stranger at random from a population, then you can't avoid taking the economic view, because you eventually will draw a crazy or malevolent or economically-rational stranger. -- GP wouldn't sell their discoveries to the criminals. But would they consider selling them to a third party as an intermediary, perhaps one that looks very much above board, and specializes in getting rewards from bug bounties in exchange for a percentage of payout? I don't know if such companies exist, but I suspect they might - they exist for approximately everything else, it's a natural consequence of specialization and free markets. Say GP would say yes; how much work would they put into vetting the third party doesn't double-dip selling the exploit on the black market? How can they be sure? Maybe there is a principled company out there, but we all know principled actors self-select out of the market over time. Or, maybe GP wouldn't sell them unless starving, but what if agents of their government come and politely ask them to share, for the Good of their Country/People/Flag/Queen/Uniform/whatever? Or, maybe GP wouldn't sell them unless starving, but what is their threshold of "starving"? For many, that wouldn't be literally starving, but some point on a spectrum between that and moderate quality-of-life drop. Like, idk, potentially losing their home, or (more US-specific I guess) random event leaving them with a stupidly high medical bill to pay, etc. With all that in mind, the main question is: how do you know? How does Google know? The reason people take an economic view of the world is because it's the only tool that lets you do useful analysis - but unlike with the proverbial hammer that makes everything look like a nail, at large enough scale, approximately everything behaves like a nail. Plus, most of the time, it only takes one. GP may be principled, but there's likely[0] more than one person making the same discovery at the same time, and some of those people may not be as principled as GP. You can't rely on only ever dealing with principled people - like with a game of Russian roulette, if you pull the trigger enough times, you'll have a bad day. -- [0] - Arguably, always. Real breakthrough leaps almost never happen, discoveries are usually very incremental - when all the pieces are there, many people end up noticing it and working on the next increment in parallel. The first one to publish is usually the only one to get the credit, though.
- wslh 2y ago
  > it's priced on demand and supply like anything else You should complete the sentence: “It’s priced based on demand and supply in legal markets like anything else.” There are, of course, other markets where things like this are traded, but that’s a different story. That said, I think the author is free to negotiate further with Google if they believe it’s worth it.
  - deleted 2y ago
    [deleted]
- throwaway48476 2y ago
  This assumes efficient markets which doesn't exist when there is a monopoly on legitimate buyers. The value any one individual puts on a thing does not a market make.
  - swexbe 2y ago
    Is it really a amonopoly though if there are multiple companies offering bug bounties? If the whitehat feels he is underpaid he could just go look for bugs for another product.
    - throwaway48476 2y ago
      The market or lack thereof is for a product. That researchers can work on a different product is a market for labor.
- skriticos2 2y ago
  Yea, legitimate with illegitimate is a weird kind of calculation, as the risk with illegitimate market is to end up in jail, and few people want to calculate the monetary value of lost time due to incareration and all the fallout that comes with it. The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But.. The bug bounty itself is only a drop in the bucket for security companies, as it's a, unsteady and b, not enough to cover even trivial research environment cost. Pratcially it's a nice monetary and reputation bonus (for having the name associated with the detection) in addition to the regular bussiness of providing baseline security intelligence, solutions and services to enterprises, which is what earns the regular paycheck. Living from quests and bonties is more the realm of fantasy.
  - ballenf 2y ago
    Is it actually illegal to sell an exploit to the highest bidder? Obviously deploying or using the exploit violates any number of laws. From a speech perspective, if I discovered an exploit and wrote a paper explaining it, what law prevents me from selling that research?
    - kevindamm 2y ago
      (I'm not a lawyer but) I think that would involve you in the conspiracy to commit the cybercrime, if you developed the exploit and sold it to an entity that used it with wrongful intent. https://www.law.cornell.edu/uscode/text/18/1029 https://www.law.cornell.edu/uscode/text/18/1029 gives the definition and penalties for committing fraud and/or unauthorized access, and it includes the development of such tools. A lot of it includes the phrasing "with intent to defraud" so it may depend on whether the court can show you knew your highest bidder was going to use it in this way. (apologies for citing US-centric law, I figured it was most relevant to the current discussion but things may vary by jurisdiction, though probably not by much)
  - z3phyr 2y ago
    You only risk prison if you sell it to the "bad guys" on the black market. Sell it to people who can jail the bad guys instead; that is, our governments.
- deleted 2y ago
  [deleted]
- magic_hamster 2y ago
  There's a clear cut between selling it to Google and selling it to black hats. White hats mostly have a career in cyber security and they will not disclose a vulnerability to a compromised party regardless of the price. Cyber security researchers will like having their name attached to a CVE or a fix in a well known open source project which is arguably worth more than 20K to them. If someone finds out you sold a vulnerability, or exploit, to a hostile party, your career is over.
7thpower 2y ago
I suspect the fact there is potentially a wider addressable market via the black market probably has more to do with the price setting mechanism than an immorality premium. Although, maybe there is something to the immorality/illegality tax in this case. The author is in high school (how cool is that!?) and the article would probably hit differently to perspective employers if they were detailing the exploit they had sold to NK (which is to say nothing of how NK would feel about the sunlight).

n2d4 2y ago

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

thrdbndndn 2y ago
I actually don't believe so. Not everything is priced on demand and supply -- at least not strictly. Of course the potential of abuse is part of the equation, but I think Google (or similar large companies) simply has a guideline of how the amount of the bounty is decided, than surveying the market to see what its "actual value" is. It's not exactly a free market, at least not on Google's side.
- n2d4 2y ago
  I assure you that when Google set those bounties, they thought about how much they would have to pay white hats to make them do the right thing. Of course, it's a highly illiquid market (usually there's just one seller and only a handful of buyers), and so the pricing is super inefficient (hence based on guidelines and not surveying on every individual bug), but the logic remains.
luismedel 2y ago
I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market
- graemep 2y ago
  I think many people have internalised a purely profit driven world view, and it is what they expect to be the main motivator or themselves and others.
  - TeMPOraL 2y ago
    TL;DR: a random stranger is most likely a nice and honest and principled human being. A sufficiently large population of random strangers behaves approximately like a population of amoral(ish), rational(ish) economic actors. If your process involves continuously drawing a stranger at random from a population, then you can't avoid taking the economic view, because you eventually will draw a crazy or malevolent or economically-rational stranger. -- GP wouldn't sell their discoveries to the criminals. But would they consider selling them to a third party as an intermediary, perhaps one that looks very much above board, and specializes in getting rewards from bug bounties in exchange for a percentage of payout? I don't know if such companies exist, but I suspect they might - they exist for approximately everything else, it's a natural consequence of specialization and free markets. Say GP would say yes; how much work would they put into vetting the third party doesn't double-dip selling the exploit on the black market? How can they be sure? Maybe there is a principled company out there, but we all know principled actors self-select out of the market over time. Or, maybe GP wouldn't sell them unless starving, but what if agents of their government come and politely ask them to share, for the Good of their Country/People/Flag/Queen/Uniform/whatever? Or, maybe GP wouldn't sell them unless starving, but what is their threshold of "starving"? For many, that wouldn't be literally starving, but some point on a spectrum between that and moderate quality-of-life drop. Like, idk, potentially losing their home, or (more US-specific I guess) random event leaving them with a stupidly high medical bill to pay, etc. With all that in mind, the main question is: how do you know? How does Google know? The reason people take an economic view of the world is because it's the only tool that lets you do useful analysis - but unlike with the proverbial hammer that makes everything look like a nail, at large enough scale, approximately everything behaves like a nail. Plus, most of the time, it only takes one. GP may be principled, but there's likely[0] more than one person making the same discovery at the same time, and some of those people may not be as principled as GP. You can't rely on only ever dealing with principled people - like with a game of Russian roulette, if you pull the trigger enough times, you'll have a bad day. -- [0] - Arguably, always. Real breakthrough leaps almost never happen, discoveries are usually very incremental - when all the pieces are there, many people end up noticing it and working on the next increment in parallel. The first one to publish is usually the only one to get the credit, though.
wslh 2y ago
> it's priced on demand and supply like anything else You should complete the sentence: “It’s priced based on demand and supply in legal markets like anything else.” There are, of course, other markets where things like this are traded, but that’s a different story. That said, I think the author is free to negotiate further with Google if they believe it’s worth it.
- deleted 2y ago
  [deleted]
throwaway48476 2y ago
This assumes efficient markets which doesn't exist when there is a monopoly on legitimate buyers. The value any one individual puts on a thing does not a market make.
- swexbe 2y ago
  Is it really a amonopoly though if there are multiple companies offering bug bounties? If the whitehat feels he is underpaid he could just go look for bugs for another product.
  - throwaway48476 2y ago
    The market or lack thereof is for a product. That researchers can work on a different product is a market for labor.
skriticos2 2y ago
Yea, legitimate with illegitimate is a weird kind of calculation, as the risk with illegitimate market is to end up in jail, and few people want to calculate the monetary value of lost time due to incareration and all the fallout that comes with it. The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But.. The bug bounty itself is only a drop in the bucket for security companies, as it's a, unsteady and b, not enough to cover even trivial research environment cost. Pratcially it's a nice monetary and reputation bonus (for having the name associated with the detection) in addition to the regular bussiness of providing baseline security intelligence, solutions and services to enterprises, which is what earns the regular paycheck. Living from quests and bonties is more the realm of fantasy.
- ballenf 2y ago
  Is it actually illegal to sell an exploit to the highest bidder? Obviously deploying or using the exploit violates any number of laws. From a speech perspective, if I discovered an exploit and wrote a paper explaining it, what law prevents me from selling that research?
  - kevindamm 2y ago
    (I'm not a lawyer but) I think that would involve you in the conspiracy to commit the cybercrime, if you developed the exploit and sold it to an entity that used it with wrongful intent. https://www.law.cornell.edu/uscode/text/18/1029 https://www.law.cornell.edu/uscode/text/18/1029 gives the definition and penalties for committing fraud and/or unauthorized access, and it includes the development of such tools. A lot of it includes the phrasing "with intent to defraud" so it may depend on whether the court can show you knew your highest bidder was going to use it in this way. (apologies for citing US-centric law, I figured it was most relevant to the current discussion but things may vary by jurisdiction, though probably not by much)
- z3phyr 2y ago
  You only risk prison if you sell it to the "bad guys" on the black market. Sell it to people who can jail the bad guys instead; that is, our governments.
deleted 2y ago
[deleted]
magic_hamster 2y ago
There's a clear cut between selling it to Google and selling it to black hats. White hats mostly have a career in cyber security and they will not disclose a vulnerability to a compromised party regardless of the price. Cyber security researchers will like having their name attached to a CVE or a fix in a well known open source project which is arguably worth more than 20K to them. If someone finds out you sold a vulnerability, or exploit, to a hostile party, your career is over.

7thpower 2y ago

I suspect the fact there is potentially a wider addressable market via the black market probably has more to do with the price setting mechanism than an immorality premium. Although, maybe there is something to the immorality/illegality tax in this case. The author is in high school (how cool is that!?) and the article would probably hit differently to perspective employers if they were detailing the exploit they had sold to NK (which is to say nothing of how NK would feel about the sunlight).