3 ms·
“Applied 1 downgrade from the base amount due to complexity of attack chain required” <— is this common? I’ve only participated in a few vulnerability programs
by AznHisoka 2y ago
“Applied 1 downgrade from the base amount due to complexity of attack chain required” <— is this common?
I’ve only participated in a few vulnerability programs, and most of them reward less if the security flaw is stupidly simple (but serious) such as revealing user emails in the page source.
- tptacek 2y agoI had the opposite impression, that it got dinged for being relatively complex for a web finding.
- kevincox 2y agoYeah, this seems backwards. It should be upgraded from the base amount because they effectively found 2 bugs!
- swyx 2y agomade sense from the pov that if its harder to exploit, it's less damaging of a bug, so worth less
- kevincox 2y agoBut it's not really harder to exploit. It is an API call that any Google account can make. It's not like the second call has complex requirements or only probabilisticly succeeds.
- lolinder 2y agoIt's harder to find, so it's less likely to be noticed and exploited by a bad actor than a glaring issue. My experience has been that this is typical of these programs—you're trying to reward researchers for finding things that are likely to be exploited, so the more arcane bugs are less valuable. I'm not sure I'd apply that logic if I were Google, though. Smaller companies it makes sense because the threat actors that they are most likely to face are mostly script kiddies who give you at most a day before they get bored and try someone else. Google is another matter, since they're always a target for much more sophisticated attackers.