4 ms·

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k

by blagie 2y ago

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation: 1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time. 2) Working out something like this is much more than 0.25-3 weeks. More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting. The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously? Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.

tptacek 2y ago
It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.
- ianhawes 2y ago
  You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset. It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched. Oh, and if they had no ethics.
  - tptacek 2y ago
    Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.
    - blagie 2y ago
      > not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
      - tptacek 2y ago
        If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
        blagie 2y ago
        Please read my posts more carefully. Virtually every response is non-responsive to what I wrote: I wrote: "unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal" You wrote: "If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking" That's the exact same thing. You, likewise, didn't notice I was advocating for new statutes in a post above.
- iinnPP 2y ago
  Just because companies are paying X doesn't mean that X isn't a low sum. Calling 10k an "extraordinarily high sum" is accurate to some and inaccurate to others. I would bet the groups would differ by perceived personal cost more than the opinion of Google, Apple, and the like. These groups would also probably show distinction where people have been victimized by "identity theft." The opinions of those bearing the cost are more important here, in my opinion.
- blagie 2y ago
  My commentary was precisely about the state-of-the-practice. That $10k is "an extraordinarily high sum for" what was likely weeks of work on this bug, and probably months of work poking in other places, reflects the very, very low focus on security industry-wide. This is why we need significant civil -- or possibly occasionally criminal -- liability. Civil if it's simple negligence, and criminal if it's gross negligence leading to harm. If Google were to pay me $200 if it leaked my data, that would: - Be worth much less than my privacy - Amount to damages of $400B worldwide if there were a compromise impacting all $2B users (although, realistically, damages would be lower in middle and low income countries) This would represent a 20% fall in Google's market cap, which feels about right. At that point, I expect the bug bounties would be set many orders of magnitude higher. Security bugs should be rare. They're common. This is a problem, and one created by our market incentive structures. You are correct that Apple is an exception, and seems to mind security.
  - tptacek 2y ago
    Google pays a piece rate. They pay the rate the market will bear, unless you impress them, like these people did, and then they pay a bit more. They do not compensate you for your working hours. Google is not going to pay you $200 if they leak your email address. Google pays as much attention to security as Apple does. If you want a world in which these kinds of security bugs create multimillion-dollar liabilities, you can advocate for the new statutes that will create that world; just be aware that only companies like Google will be able to afford to operate in that world.
    - blagie 2y ago
      I am very much advocating for new statutes. That's precisely what my post was doing. Companies should not be allowed to externalize costs of bad security on users. I disagree with the claim that "only companies like Google will be able to afford to operate in that world." That's not how markets work. 1) The impact would be that frameworks would develop with better security. This would result in a slowdown of software engineering. Perhaps it would start to look like any other engineering discipline, where things are analyzed for safety. 2) Every other industry shows that in situations like this, big players are disadvantaged. The analysis here is pretty basic: - If I'm running a small $10M startup making a little iPhone app for some obscure task, the risk of legal liability from this is among the smallest of my risks of going under, so I'm incentivized to ignore it. If I were faced with a $400B liability, I declare bankruptcy, so in effect, that's a $10M liability. The expected cost is 5% times 10M = $500k, so it makes sense to spend up to $500k to mitigate a 5% risk. - If Google has a team working on that same app, and doesn't manage security properly, the $400B liability stays a $400B liability. There is no ROI analysis where it makes sense to build a little app which has a 5% chance of leaking data. Do it right, or don't do it at all. The expected cost to Google here is 5% times $400B = $20B. This is why, in virtually every other industry, big players are (1) more trusted (2) more expensive, and phrases like "small, fly-by-night operation" exist (and make business sense to run).
- jorvi 2y ago
  Interestingly enough there is already a brute-force way exploiters have been doxxing YouTubers: bots comment random name combinations to a channel, check if it is posted, then immediately delete the comment. If the comment didn't appear, either of those names is on the blocklist and is probably the YouTuber's name or related to it. Same goes for addresses.
kccqzy 2y ago
Bug bounty payouts are not effort based. It does not matter how much time it took the discoverer to find the vulnerability. So discussing the amount of work involved is irrelevant; it's not like the kindergarten level "oh you tried so there's a consolation prize for effort". Comparing it against the fixed rate salary of a SWE is even more wrong, except that your argument shows it is more profitable for a hypothetical person relying on bug bounty income to instead join Google as an internal red teamer. The other comment has already addressed the market value question.
- blagie 2y ago
  Unless you can stumble on Google vulnerabilities casually, it's showing quite the opposite -- how unprofitable it is to work from bug bounties.
  - kccqzy 2y ago
    It's not the opposite. We are in fact not disagreeing. It's unprofitable to work from bug bounties. It is better off for the person to become an internal red teamer.
yieldcrv 2y ago
salary and compensation are not synonyms, you used them interchangeably
ant6n 2y ago
I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡
sgjohnson 2y ago
> Zero-click kernel code execution with persistence and kernel PAC bypass This is what baffles me about Apple's bug bounty program. > $1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device. This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.

by blagie 2y ago

tptacek 2y ago

It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.

ianhawes 2y ago
You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset. It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched. Oh, and if they had no ethics.
- tptacek 2y ago
  Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.
  - blagie 2y ago
    > not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
    - tptacek 2y ago
      If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
      - blagie 2y ago
        Please read my posts more carefully. Virtually every response is non-responsive to what I wrote: I wrote: "unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal" You wrote: "If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking" That's the exact same thing. You, likewise, didn't notice I was advocating for new statutes in a post above.
iinnPP 2y ago
Just because companies are paying X doesn't mean that X isn't a low sum. Calling 10k an "extraordinarily high sum" is accurate to some and inaccurate to others. I would bet the groups would differ by perceived personal cost more than the opinion of Google, Apple, and the like. These groups would also probably show distinction where people have been victimized by "identity theft." The opinions of those bearing the cost are more important here, in my opinion.
blagie 2y ago
My commentary was precisely about the state-of-the-practice. That $10k is "an extraordinarily high sum for" what was likely weeks of work on this bug, and probably months of work poking in other places, reflects the very, very low focus on security industry-wide. This is why we need significant civil -- or possibly occasionally criminal -- liability. Civil if it's simple negligence, and criminal if it's gross negligence leading to harm. If Google were to pay me $200 if it leaked my data, that would: - Be worth much less than my privacy - Amount to damages of $400B worldwide if there were a compromise impacting all $2B users (although, realistically, damages would be lower in middle and low income countries) This would represent a 20% fall in Google's market cap, which feels about right. At that point, I expect the bug bounties would be set many orders of magnitude higher. Security bugs should be rare. They're common. This is a problem, and one created by our market incentive structures. You are correct that Apple is an exception, and seems to mind security.
- tptacek 2y ago
  Google pays a piece rate. They pay the rate the market will bear, unless you impress them, like these people did, and then they pay a bit more. They do not compensate you for your working hours. Google is not going to pay you $200 if they leak your email address. Google pays as much attention to security as Apple does. If you want a world in which these kinds of security bugs create multimillion-dollar liabilities, you can advocate for the new statutes that will create that world; just be aware that only companies like Google will be able to afford to operate in that world.
  - blagie 2y ago
    I am very much advocating for new statutes. That's precisely what my post was doing. Companies should not be allowed to externalize costs of bad security on users. I disagree with the claim that "only companies like Google will be able to afford to operate in that world." That's not how markets work. 1) The impact would be that frameworks would develop with better security. This would result in a slowdown of software engineering. Perhaps it would start to look like any other engineering discipline, where things are analyzed for safety. 2) Every other industry shows that in situations like this, big players are disadvantaged. The analysis here is pretty basic: - If I'm running a small $10M startup making a little iPhone app for some obscure task, the risk of legal liability from this is among the smallest of my risks of going under, so I'm incentivized to ignore it. If I were faced with a $400B liability, I declare bankruptcy, so in effect, that's a $10M liability. The expected cost is 5% times 10M = $500k, so it makes sense to spend up to $500k to mitigate a 5% risk. - If Google has a team working on that same app, and doesn't manage security properly, the $400B liability stays a $400B liability. There is no ROI analysis where it makes sense to build a little app which has a 5% chance of leaking data. Do it right, or don't do it at all. The expected cost to Google here is 5% times $400B = $20B. This is why, in virtually every other industry, big players are (1) more trusted (2) more expensive, and phrases like "small, fly-by-night operation" exist (and make business sense to run).
jorvi 2y ago
Interestingly enough there is already a brute-force way exploiters have been doxxing YouTubers: bots comment random name combinations to a channel, check if it is posted, then immediately delete the comment. If the comment didn't appear, either of those names is on the blocklist and is probably the YouTuber's name or related to it. Same goes for addresses.

kccqzy 2y ago

Bug bounty payouts are not effort based. It does not matter how much time it took the discoverer to find the vulnerability. So discussing the amount of work involved is irrelevant; it's not like the kindergarten level "oh you tried so there's a consolation prize for effort". Comparing it against the fixed rate salary of a SWE is even more wrong, except that your argument shows it is more profitable for a hypothetical person relying on bug bounty income to instead join Google as an internal red teamer. The other comment has already addressed the market value question.

blagie 2y ago
Unless you can stumble on Google vulnerabilities casually, it's showing quite the opposite -- how unprofitable it is to work from bug bounties.
- kccqzy 2y ago
  It's not the opposite. We are in fact not disagreeing. It's unprofitable to work from bug bounties. It is better off for the person to become an internal red teamer.

yieldcrv 2y ago

salary and compensation are not synonyms, you used them interchangeably

ant6n 2y ago

I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡

sgjohnson 2y ago

> Zero-click kernel code execution with persistence and kernel PAC bypass This is what baffles me about Apple's bug bounty program. > $1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device. This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.