3 ms·

They should be getting at last 20x this. Until we get value based pricing for zero days, we will never be safe from the real threats. We really should be fundi

They should be getting at last 20x this. Until we get value based pricing for zero days, we will never be safe from the real threats. We really should be funding exploit teams to break everything they can so that we have secure infrastructure. > Two months later, during the Pwn2Own Vancouver 2024 competition, ZDI awarded another $1,132,500 for 29 zero-day bugs. Synacktiv went home with $200,000 and a Tesla Model 3 after hacking its ECU with Vehicle (VEH) CAN BUS Control in under 30 seconds.

rocqua 2y ago
It feels like there's a legitimate 'cobras problem' risk with this. Though I guess it's more like hiring and training mercenaries. Because you are training people with dangerous skills, promising them money in return. If the money dries up, they will start looking for other ways to employ their skills to make a living. Not that all, or even most, people with those skills would abuse them. But it doesn't take that many, and things might be worse if you start attracting people with insanely big sums.
- colechristensen 2y ago
  Black markets for exploits have been thriving for a long time. There are plenty of security consultants and penetration testing houses out there getting paid already. Turns out people put a lot of value on not having to launder black market earnings or deal with opsec of hiding their participation.
- sitkack 2y ago
  Cobra is already out of the bag, we see corporations loosing billions over dumb mistakes. The contest showed what some skilled individuals or someone else could eventually do. We can't hide behind access. The threats are too big.
  - ben_w 2y ago
    The cobra effect is another phrase for "perverse incentives", named after the time the British paid people to kill cobras without realising this meant they were paying people to breed cobras, and when they realised and stopped all the bread cobras were released into the wild leaving the area with more cobras than when they started: https://en.wikipedia.org/wiki/Perverse_incentive https://en.wikipedia.org/wiki/Perverse_incentive I think this analogy would only fit if the hackers could somehow "breed" bugs, but as they don't work at the corporations making the buggy software I don't see how that would be possible — but then, I'm British by birth, so perhaps I have a blind spot for creating perverse incentives ;)
- no_time 2y ago
  The cobra analogy doesn't work because there is a finite amount of use after frees and buffer overflows to be exploited in any given codebase. Companies could choose to outbid the black market on every single one of them if they wanted to, they just don't.
  - jeffreygoesto 2y ago
    There will be plenty. A"I" is going to copy them from the past to the future in unreviewable speed.
- boxed 2y ago
  What would be the analogy? That programmers plant exploits in their code, only to quit their job and collect money from the exploits? That seems pretty far fetched. It also seems like something that could be easily fixed by companies suing anyone who does this into the ground for planting backdoors. Or just prosecuting them in a normal court.
  - blueflow 2y ago
    No need to implant new bugs. Having access to the source code is enough to spot bugs. Instead of reporting them to your internal Jira, you sell it on $website. The buyer can fetch the bounty and will be left with a margin.
  - datavirtue 2y ago
    Then again exposing weaknesses in your development processes.
- belter 2y ago
  Most likely these were introduced in the code maliciously, then leaked to the teams to get the money....
Veserv 2y ago
It is just supply and demand. The systems are so riddled with security defects that the offered prices are enough to incentivize more reported defects than they can fix (though to be fair, the Pwn2Own bounties are on the low side due to payment in “fame”). If they offered 20x the price there would likely be so many reported defects that they would go out of business. You can not “patch and fix” your way to a materially higher level of security “quality” or buy your way to zero defects. Offering prices significantly higher than your security “quality” just gets you a endless stream of reports for real defects. To put it another way, a bug bounty program is not a mechanism for achieving higher quality, it is a mechanism for public security auditing. It is set at a level where it should almost never trip and should be viewed, publicly, as a initial estimate of security “quality”. A company offering a bounty of X should be viewed as saying: “We are confident that our security is no better than X worth of effort”. That should tell you everything you need to know about the “quality” of these systems.
- unaindz 2y ago
  I would have agreed with your logic until a few years ago when we started seeing companies advertising inflated max bounties that they do not uphold when a critical vulnerability gets discovered.
  - datavirtue 2y ago
    Great way to get pwned.
    - dr-detroit 2y ago
      [dead]

rocqua 2y ago

It feels like there's a legitimate 'cobras problem' risk with this. Though I guess it's more like hiring and training mercenaries. Because you are training people with dangerous skills, promising them money in return. If the money dries up, they will start looking for other ways to employ their skills to make a living. Not that all, or even most, people with those skills would abuse them. But it doesn't take that many, and things might be worse if you start attracting people with insanely big sums.

colechristensen 2y ago
Black markets for exploits have been thriving for a long time. There are plenty of security consultants and penetration testing houses out there getting paid already. Turns out people put a lot of value on not having to launder black market earnings or deal with opsec of hiding their participation.
sitkack 2y ago
Cobra is already out of the bag, we see corporations loosing billions over dumb mistakes. The contest showed what some skilled individuals or someone else could eventually do. We can't hide behind access. The threats are too big.
- ben_w 2y ago
  The cobra effect is another phrase for "perverse incentives", named after the time the British paid people to kill cobras without realising this meant they were paying people to breed cobras, and when they realised and stopped all the bread cobras were released into the wild leaving the area with more cobras than when they started: https://en.wikipedia.org/wiki/Perverse_incentive https://en.wikipedia.org/wiki/Perverse_incentive I think this analogy would only fit if the hackers could somehow "breed" bugs, but as they don't work at the corporations making the buggy software I don't see how that would be possible — but then, I'm British by birth, so perhaps I have a blind spot for creating perverse incentives ;)
no_time 2y ago
The cobra analogy doesn't work because there is a finite amount of use after frees and buffer overflows to be exploited in any given codebase. Companies could choose to outbid the black market on every single one of them if they wanted to, they just don't.
- jeffreygoesto 2y ago
  There will be plenty. A"I" is going to copy them from the past to the future in unreviewable speed.
boxed 2y ago
What would be the analogy? That programmers plant exploits in their code, only to quit their job and collect money from the exploits? That seems pretty far fetched. It also seems like something that could be easily fixed by companies suing anyone who does this into the ground for planting backdoors. Or just prosecuting them in a normal court.
- blueflow 2y ago
  No need to implant new bugs. Having access to the source code is enough to spot bugs. Instead of reporting them to your internal Jira, you sell it on $website. The buyer can fetch the bounty and will be left with a margin.
- datavirtue 2y ago
  Then again exposing weaknesses in your development processes.
belter 2y ago
Most likely these were introduced in the code maliciously, then leaked to the teams to get the money....

Veserv 2y ago

It is just supply and demand. The systems are so riddled with security defects that the offered prices are enough to incentivize more reported defects than they can fix (though to be fair, the Pwn2Own bounties are on the low side due to payment in “fame”). If they offered 20x the price there would likely be so many reported defects that they would go out of business. You can not “patch and fix” your way to a materially higher level of security “quality” or buy your way to zero defects. Offering prices significantly higher than your security “quality” just gets you a endless stream of reports for real defects. To put it another way, a bug bounty program is not a mechanism for achieving higher quality, it is a mechanism for public security auditing. It is set at a level where it should almost never trip and should be viewed, publicly, as a initial estimate of security “quality”. A company offering a bounty of X should be viewed as saying: “We are confident that our security is no better than X worth of effort”. That should tell you everything you need to know about the “quality” of these systems.

unaindz 2y ago
I would have agreed with your logic until a few years ago when we started seeing companies advertising inflated max bounties that they do not uphold when a critical vulnerability gets discovered.
- datavirtue 2y ago
  Great way to get pwned.
  - dr-detroit 2y ago
    [dead]