Hacker News Reader

Comment by tptacek | Hacker News Reader

Why? Who else is going to outbid Google for this serverside URL parsing bug?

The "competition" that Google is bidding against is all the other ways that people capable of finding this sort of bug might choose to spend their free time.

If this were Android drive-by RCE, I'd agree with you. But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs. $6k is a strong bounty for that kind of work.

(The work is important! But people who find web bugs like this tend to make their money on volume, not on a couple major hits a year, like the RCE researchers do.)

> But they're bidding for the attention of the kinds of researchers who find URL whitelist validation bugs.

No they’re not. Just because this happened to be a URL whitelist bug doesn’t mean that this is the primary work that the researcher who found the bug does. Did a URL whitelist validation researcher find this, or did someone researching user auth access find this bug? If Google knew exactly who they wanted to find this bug, then Google would have already found it themselves.

Yes, it does. Vulnerability research is a big field and it is specialized. There are different kinds of vulnerability researchers and, as an imperfect but generally useful rule, the ones doing RCE work aren't looking for web bugs. And the people running the Google bounty program are generally well plugged into the vulnerability research community; they are way, way, way, way, way, way more credible than the median HN comment.

It also just doesn't make sense as an objection, because it's not like the bounty rates on reliable clientside RCEs in browsers and mobile devices is capped at $6k, and everyone doing this work knows it.

As we’ve seen in the smartphone world: the competitors are people who would rather the bug stay secret so that they can exploit it.

Who else is going to outbid Google for this serverside URL parsing bug?

The black hats. $6,000 from Google, or $600,000 from some shadowy company in UTC+02. Google makes these choices too easy.

Shadowy companies in UTC+02 don't even pay $600k for Android RCE. They pay zero for this stuff.

Ey man, Africa is also in UTC+02 and we are not known to be as shady as that one UTC+02 country

Wouldn't this be considered clientside?

Technically yes, but in a practical sense the distinction is between bugs that can be fixed globally and instantaneously by pushing a server fix and those that can't.

Why not offer only a dollar then?

You joke, but lots of places that don't offer cash bounties still get good bounty submissions. Google offers bounties because they can, and to attract more submissions. Like I said below: for this kind of work, $6k is a strong bounty. Not a lot of places will pay you thousands of dollars for a URL whitelist bypass bug.

Depends.

Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not.

Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.

No. People who find drive-by RCE vulnerabilities are in a market with "grayweb exploit dealers". People who find URL whitelist validation bugs are not. The distinction is important and directly reflected in the bounty rates for the different kinds of bugs.

And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.

Reply on news.ycombinator.com