4 ms·

It's because Facebook, Google, and some others run generous bug bounties / white-hat programs. Without committing a crime, people can make a lot for disclosing

by gfosco 11y ago

It's because Facebook, Google, and some others run generous bug bounties / white-hat programs. Without committing a crime, people can make a lot for disclosing it directly and confidentially. Vulnerabilities can pay 5-15k and there have been 30-40k payouts. Occasionally, you'll see a blog post explaining the process from detection to payment, like: http://homakov.blogspot.com/2013/02/hacking-facebook-with-oauth2-and-chrome.html http://homakov.blogspot.com/2013/02/hacking-facebook-with-oa... FB paid out 1.3m in 2014. http://www.zdnet.com/article/facebook-bug-bounty-program-paid-out-1-3-million-in-2014/ http://www.zdnet.com/article/facebook-bug-bounty-program-pai...

tptacek 11y ago
No. Facebook is probably not outbidding the black market for their vulnerabilities. I think 'grugq is exactly right: the market for serverside vulnerabilities with hours-long half lives is very thin. Facebook could pay $500 for RCE, and so long as they do everything else they currently do for security, a thriving black market would not emerge for their vulnerabilities. It's interesting to me that there's a real market price for an Adobe Reader flaw, but that Facebook flaws have (generous) fiat prices set by Facebook.
- gfosco 11y ago
  I didn't say they're outbidding the black market, but they are quite generous and it is a legal action at that point. Makes sense to me, because they actually care about security and it's worth paying out to protect users and the brand. It also serves as a unique recruiting tool.
- FireBeyond 11y ago
  Seems to me you could "quite easily" double dip. Sell your exploit on the black market. A day later, sell it to the vendor. "Sorry, they must have found and patched it"? Just ask Facebook not to disclose your information when highlighting vulnerability payouts.
  - tptacek 11y ago
    If you read this whole post, you'll see that buyers expect this behavior, and payments are escrowed or tranched to account for ti.
x0x0 11y ago
Is selling a vulnerability a crime? Does that depend on whom you sell it to?
- tptacek 11y ago
  1. No. 2. Not currently, unless you know they're using your bug to commit a crime, in which case you can assume liability for that crime by actively helping them.
Ded7xSEoPKYNsDd 11y ago
Google and Mozilla pay bounties for vulnerabilities in their browsers, too. Yet the market for these bugs is striving.

by gfosco 11y ago

tptacek 11y ago

No. Facebook is probably not outbidding the black market for their vulnerabilities. I think 'grugq is exactly right: the market for serverside vulnerabilities with hours-long half lives is very thin. Facebook could pay $500 for RCE, and so long as they do everything else they currently do for security, a thriving black market would not emerge for their vulnerabilities. It's interesting to me that there's a real market price for an Adobe Reader flaw, but that Facebook flaws have (generous) fiat prices set by Facebook.

gfosco 11y ago
I didn't say they're outbidding the black market, but they are quite generous and it is a legal action at that point. Makes sense to me, because they actually care about security and it's worth paying out to protect users and the brand. It also serves as a unique recruiting tool.
FireBeyond 11y ago
Seems to me you could "quite easily" double dip. Sell your exploit on the black market. A day later, sell it to the vendor. "Sorry, they must have found and patched it"? Just ask Facebook not to disclose your information when highlighting vulnerability payouts.
- tptacek 11y ago
  If you read this whole post, you'll see that buyers expect this behavior, and payments are escrowed or tranched to account for ti.

x0x0 11y ago

Is selling a vulnerability a crime? Does that depend on whom you sell it to?

tptacek 11y ago
1. No. 2. Not currently, unless you know they're using your bug to commit a crime, in which case you can assume liability for that crime by actively helping them.

Ded7xSEoPKYNsDd 11y ago

Google and Mozilla pay bounties for vulnerabilities in their browsers, too. Yet the market for these bugs is striving.