| ▲ | elevation a day ago |
| > Do you have any advice for aspiring bug-bounty hunters? We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens. Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them. |
|
| ▲ | tptacek a day ago | parent | next [-] |
| That's really not why bounties exist, though people on both sides of the bounty systems claim it is. If it were broadly the case that bounties exist to offset black market sales, you wouldn't pay bounties for vulnerabilities with no market value. This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market. In reality, the modal benefit accruing to a company running a bounty program on receipt of a new serious vulnerability is simply engineering prioritization. You get bug reports from users when you have reliability and UX bugs, but you don't get them for security flaws, because attackers generally have to force vulnerabilities into revealing themselves --- normal users almost never run into them. Bug bounty programs fill that gap. |
| |
| ▲ | a_dabbler a day ago | parent | next [-] | | "This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market." Crazy statement. This would easily be worth more to malicious actors | | |
| ▲ | tptacek a day ago | parent [-] | | The only actors who will pay you real money for a serverside RCE bug aren't buying an exploit; they're contracting with you to plan a heist. So the same analysis applies: you yourself could come up with some scheme whereby you yourself use this vulnerability to steal stuff from Google. But that's not what we're talking about when we talk about vulnerability valuations. There is essentially no market for these kinds of serverside vulnerabilities. | | |
| ▲ | irundebian 6 hours ago | parent [-] | | How do you know? You could explain the impact of the vulnerability and let buyers on the black market decide and bid whether they could do something useful with it. | | |
| ▲ | tptacek 6 hours ago | parent [-] | | That's not how the "black market" works. There isn't like some bazaar where people describe vulnerabilities and people bid on them. Only a very specific subset of vulnerabilities, those that slot into existing business practices and CNE stacks, have buyers. |
|
|
| |
| ▲ | ofjcihen a day ago | parent | prev [-] | | I don’t understand your argument here. If you’re saying that bug bounties exist for a reason according to both the program runners and the contributors then how is that not the reason they exist? The people paying and the people working are all in agreement that it exists for that reason. | | |
| ▲ | tptacek a day ago | parent [-] | | What part of my logic do you not follow? The way you've posed this question, the simplest response would require me to write that whole comment over again. | | |
| ▲ | ofjcihen a day ago | parent [-] | | That’s an unnecessarily rude response I think. I detailed my logic above. Additionally, part of my businesses remediation services include helping companies set up bug bounty programs. Giving researchers an incentive to report bugs for payouts instead of selling or exploiting them for profits is always the intended goal. | | |
| ▲ | tptacek a day ago | parent | next [-] | | This is probably my highest-rated comment on HN: https://news.ycombinator.com/item?id=43025038 It's the product of direct interviews with bounty people, FAANG/MAG7 blue teamers, and black market participants. If you want more, there's also an interview online that we did with Mark Dowd, who is one of the best known CNE vendors to the NATO IC. You can just Google [SCW Mark Dowd]. I'm happy to go into more detail, but, like I said, you didn't really respond to my comment in any way that I could expand on. Feel free to disagree with me in some kind of specific way. This really is simple: if you work in this space, you already know that there's essentially no black market at all for serverside web bugs. But there's a $90k bounty for this one, and 5-figure bounties for others. Reconcile those two facts. | | |
| ▲ | ofjcihen a day ago | parent [-] | | Well thats nice and Im happy for you but internet points don’t really mean much here… What a vulnerability sells for and how much damage someone could do exploiting it are two different things. Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer. A company paying big bucks isn’t a contradiction. Its incentivizing disclosure over exploitation which could cost them considerably more. Engineering prioritization is… a minor part of it informed by the ease of exploitation, damage it could do (in the case of an RCE or publicly available keys as in this case quite a bit) etc. I don’t see why you think these things are mutualy exclusive. | | |
| ▲ | tptacek a day ago | parent | next [-] | | Having given up on the original argument ("Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.") you've now transitioned to a new one: that vulnerabilities can be used by the hackers who find them to plan heists. And that is true. It doesn't set any kind of market-clearing price, and selects for actors who are comfortable ending up in prison, but it is indeed a statement that aligns with reality. | | |
| ▲ | ofjcihen 21 hours ago | parent [-] | | My original comment explicitly said “selling or exploiting them for profits.” You are just ignoring the second half for some reason. I think you need to breathe a bit and then re-read my comment. I’m not coming at you, I’m saying that what an exploit sells for and what it could cost a company if exploited are entirely different things. That’s where you’re hung up. Companies have an obvious financial incentive to encourage discovery and disclosure before exploitation. | | |
| ▲ | tptacek 21 hours ago | parent [-] | | I just don't care at this point. We're talking past each other. I quoted the argument that I was responding to, in the comment you just replied to. |
|
| |
| ▲ | kasey_junk a day ago | parent | prev [-] | | You think that most security researchers that can find an exploit are all willing to commit a heist with that exploit? I’m not in the security industry but that strains credulity. | | |
| ▲ | ofjcihen a day ago | parent [-] | | Where did I say that? Being capable of exploiting something and willing to are two different things. The point is that bounties create an incentive to find and disclose vulns. That doesn’t require a black market for the exploits. | | |
| ▲ | kasey_junk a day ago | parent [-] | | “Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.” I’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it. | | |
| ▲ | ofjcihen a day ago | parent [-] | | What you’re responding to and what you’re saying it says are two different things. | | |
|
|
|
|
| |
| ▲ | dontwastrutime 21 hours ago | parent | prev [-] | | [dead] |
|
|
|
|
|
| ▲ | Gander5739 a day ago | parent | prev | next [-] |
| > Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them. Is this really true? After all, reselling the exploit would be illegal, and most people don't want to break the law to earn income. |
| |
| ▲ | jack_pp a day ago | parent | next [-] | | most people who care about legality don't work in that field either. whoever gets into this probably starts by being ok with doing shady stuff, I imagine. | | |
| ▲ | mapontosevenths a day ago | parent | next [-] | | Many start in the military and eventually move to private sector. However, an ever growing percentage just straight up go to college to learn the skills. Cyber companies are in the fortune 100 now, and it's not like it used to be back when you actually had to be interested in it and dedicate your life to learning the skillz from shady forums. Now it's just a job to most practitioners. | | |
| ▲ | jack_pp a day ago | parent [-] | | what use are 0-days to private cybersecurity companies? | | |
| ▲ | IrishTechie a day ago | parent | next [-] | | Huge marketing/PR benefit. | | |
| ▲ | mapontosevenths a day ago | parent [-] | | Yes, but also there is also a huge value to individual contributors and their careers. I broke into the field after landing a few relatively high profile CVE acknowledgements for big companies. Responsible disclosure is good for your career. On the other hand, if the value of that drops you can expect to see some folks start taking the wrong path. |
| |
| ▲ | shimman 20 hours ago | parent | prev [-] | | Probably extremely useful for the companies that can sell exploits to state governments. |
|
| |
| ▲ | saagarjha a day ago | parent | prev [-] | | Plenty of people in this space who work on entirely legal things |
| |
| ▲ | graemep a day ago | parent | prev | next [-] | | Most people do not, but it needs only some people who do so for it to be a problem. Most people do not steal, but I still lock my front door. | |
| ▲ | micromacrofoot a day ago | parent | prev [-] | | there are enough people operating in countries that would not charge them for hacking an American company for it to matter, $90k can be a life-changing sum |
|
|
| ▲ | nicce a day ago | parent | prev [-] |
| And before it ends, people with existing reputation can milk the last drops, as mostly their reports gets processed from the thousands of others. Unfortunate status quo. |
