3 ms·

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initi

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.

blagie 2y ago
$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation: 1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time. 2) Working out something like this is much more than 0.25-3 weeks. More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting. The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously? Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.
- tptacek 2y ago
  It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.
  - ianhawes 2y ago
    You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset. It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched. Oh, and if they had no ethics.
    - tptacek 2y ago
      Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.
      - blagie 2y ago
        > not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
        tptacek 2y ago
        If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
- kccqzy 2y ago
  Bug bounty payouts are not effort based. It does not matter how much time it took the discoverer to find the vulnerability. So discussing the amount of work involved is irrelevant; it's not like the kindergarten level "oh you tried so there's a consolation prize for effort". Comparing it against the fixed rate salary of a SWE is even more wrong, except that your argument shows it is more profitable for a hypothetical person relying on bug bounty income to instead join Google as an internal red teamer. The other comment has already addressed the market value question.
  - blagie 2y ago
    Unless you can stumble on Google vulnerabilities casually, it's showing quite the opposite -- how unprofitable it is to work from bug bounties.
    - kccqzy 2y ago
      It's not the opposite. We are in fact not disagreeing. It's unprofitable to work from bug bounties. It is better off for the person to become an internal red teamer.
- yieldcrv 2y ago
  salary and compensation are not synonyms, you used them interchangeably
- ant6n 2y ago
  I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡
- sgjohnson 2y ago
  > Zero-click kernel code execution with persistence and kernel PAC bypass This is what baffles me about Apple's bug bounty program. > $1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device. This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.
Frieren 2y ago
Bounties make sense for open source projects where the main reward is to contribute to the community. For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort. Underpaid is an understatement.

blagie 2y ago

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation: 1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time. 2) Working out something like this is much more than 0.25-3 weeks. More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting. The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously? Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.

tptacek 2y ago
It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.
- ianhawes 2y ago
  You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset. It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched. Oh, and if they had no ethics.
  - tptacek 2y ago
    Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.
    - blagie 2y ago
      > not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
      - tptacek 2y ago
        If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
kccqzy 2y ago
Bug bounty payouts are not effort based. It does not matter how much time it took the discoverer to find the vulnerability. So discussing the amount of work involved is irrelevant; it's not like the kindergarten level "oh you tried so there's a consolation prize for effort". Comparing it against the fixed rate salary of a SWE is even more wrong, except that your argument shows it is more profitable for a hypothetical person relying on bug bounty income to instead join Google as an internal red teamer. The other comment has already addressed the market value question.
- blagie 2y ago
  Unless you can stumble on Google vulnerabilities casually, it's showing quite the opposite -- how unprofitable it is to work from bug bounties.
  - kccqzy 2y ago
    It's not the opposite. We are in fact not disagreeing. It's unprofitable to work from bug bounties. It is better off for the person to become an internal red teamer.
yieldcrv 2y ago
salary and compensation are not synonyms, you used them interchangeably
ant6n 2y ago
I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡
sgjohnson 2y ago
> Zero-click kernel code execution with persistence and kernel PAC bypass This is what baffles me about Apple's bug bounty program. > $1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device. This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.

Frieren 2y ago

Bounties make sense for open source projects where the main reward is to contribute to the community. For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort. Underpaid is an understatement.