Hacker News Reader

Comment by xwdv | Hacker News Reader

Now if only they could get decent payouts.

It seems like many people disagree. But it's true.

Microsoft used to pay 20k for exploit primitives that could potentially lead privilege escalation. These days the bounty program seem to require a demonstration (read: working exploit).

Zerodium offers up to 80k for a working local privilege escalation exploit. Depending on the workings, if that exploit can be used to break out of a browser sandbox you might earn a bonus.

The whitehat bounties are not market rate, if you only look at the monetary rewards.

The other thing to keep in mind here is that serious vulnerabilities can also be sold on the dark web for ~50K+ IIRC. They can also be sold to multiple different entities looking to build bot nets or whatever it is that people who are always wearing Guy Fawkes masks while sitting in dark rooms do. If you're paying just 5-20K, you're kind of counting on the people who find the exploit being nice and doing the right thing.

Maybe that's mitigated because people with the know-how to find exploits like that are usually well-educated and not desperately in need of money, but people can be greedy.

Also mitigated by the concern researchers should probably have for selling exploits to "bad guys", and the associated liabilities, criminal and otherwise

Exactly. Only one of these paths does not have a hidden/probabilistic cost. Hard to say what's the market rate for exposing yourself to criminal prosecution, it's not like there's a hedging market for such things.

Though if as a corp you cover the black market rate fully then there's really no reason for a researcher to ever sell on the black market.

What's criminal about selling to Zerodium though? I guess a case could be made that selling on the darknet is 'not in good faith'. That is an important criteria for determining if you're aiding and abetting where I'm from.

But this problem is not there with all avenues for grey market transactions.

Well, this author states he got a $5000 payout, I'd consider that pretty decent.

It's not when you consider it in context of the unpaid work one has to do to find payout bugs like this.

For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours.

Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.

Security researchers can easily get $500 per hour on consult.

The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.

More importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told.

As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.

After winning a $5k payout I bet you can get a decent consultancy going. These payouts are foot-in-the-door or for hobbyists, like Kaggle is for ML.

"Do it for the exposure" is a nasty thing to say to people, even if you couch it in disguising terms.

disagree, especially when the "exposure" is not the entire compensation package.

> Isn't the entire pen-test/security industry based on exposure (of your "brand") though? What you can bill depends directly on how well known you are & your past work, in lieu of an objective measure of how good at it a person is. Geohot could bill thousands (or tens of thousands) per hour of his time and no one would bat an eye, but if some guy named Blake tried that, he'd be laughed out of the room.

Why? I wish it paid a salary too but it isn't worthless. At the end of the day the businesses that best allocate their dollars for internal vs. outsourced talent are going to come out on top.

I certainly don't see room for adding regulatory requirements here. And, about public pressure, this type of work is in its infancy, relatively speaking. Going straight for the throat is too much.

"The free market will solve it" is sadly no longer a uniquely US-based view, but it is still wrong. There are so many examples of this I don't even know where to begin telling you how wrong it is.

That's too general of a statement. Everything is governed so there is a mix of free market and regulation. Having everything state-owned isn't a solution either and I know you're not suggesting that.

Then you are pitting nascent white hat hackers against seasoned black hats and how do you expect that’s going to turn out?

Sounds like a good argument at first but you're talking about running afoul of the law. You can't make a career of that. The better you get, the more people are after you.

I don't mean that the US would chase you in Russia but you are digging yourself a hole and limiting options as you go.

Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google.

Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.

Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?

Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.

My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.

If a video used to be public, but was turned private, there could be references to it in other places.

That still leaves vanishingly small odds for a user to actually be exploited, in addition to the very small resolution and total lack of audio... both of which would be overcome by somebody simply downloading the video while it was public. As soon as the video was public _and_ shared/discovered by other people, it was already owned to begin with.

One suggestion upthread was that videos that start public or unlisted can be made private without changing the ID. I haven't verified this myself, but if true it could be a way to get around someone sharing a video, then making it private to hide the contents. Obviously this is less severe than if, say, all private video IDs were well known, or a one-up integer, but it's still a leak and could be exploited in real-world scenarios.

This sounds like a good way to go to jail.

Well the market disagrees with security researchers.

5000 dollars is akin to to a very healthy contractor rate of $200 an hour at 25 hours of work, which is a conservative estimate of how much time OP spent discovering this. That to me feels pretty fair pay, based on things in reality, not some future value of potential costs savings that require some pretty hand-wavy maths to quantify.

Hourly rates are not appropriate.

* experts are paid for applying their knowledge, not their time[1][2]

* A “fair” time based system should also pay for unsuccessful searches e.g. the previous month unsuccessfully searching for a bug in Chrome.

* if person A spends 1 hour finding bug X, and person B spends 1000 hours finding exactly the same bug X, then it is a fallacy that you could pick a fair hourly rate.

Also I’ll mention that you don’t get paid according to how much damage a bug can cause. 1: usually the damages occur to a third party (e.g. users of Microsoft Windows, not Microsoft). 2: imagine you find ten bugs that could wipe out the business Acme - you can’t get paid 10x Acme’s value (not even just 1x Acme’s profits.)

[1] https://quoteinvestigator.com/2018/01/14/time-art/

[2] https://www.snopes.com/fact-check/know-where-man/

For this kind of specialism, I'd expect a company to pay an internal employee that much ($5000) per week of work - and contractors should be charging double.

The fact that a company has undervalued this work and failed to identify it as important, and someone external has identified it, makes it worth even more.

A ransom demand on YouTube might be unbounded in value, e.g.: https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db...

Exactly. If you have the skill set to find exploits like described here or even more complicated ones, would that payout tempt you do this fulltime? If you live in the US then I would say no. It ends up being much lower pay than you could get in other areas.

For brilliant hackers in other parts of the world, then this might be a nice job. But I don't know if these bug bounties are available everywhere.

Factor in how rare it is to find a software defect like this and how many fruitless hours of work go into finding it, the author is hardly breaking even. The only financial advantage I see is bestowed by the credibility gained from the publicity. Considering the monetary damage that a defect like this can do to YT and considering the thriving black market for zero days, $5000 seems irresponsibly low.

The answer is pretty simple, don't participate if you don't like the terms.

I don't think it's as simple as that as you don't know what you're necessarily going to find at the starting line.

Last month on HN someone got £7500 from FB, but, everyone thought he should have got more: https://news.ycombinator.com/item?id=25401294

There is also a darknet diaries episode (can't remember which) but the guy who found a bug had got into instagram s3 buckets and source code, he felt he should have got the $1M bug bounty but instead facebook claimed he did it without permission to go further and got fuck all.

This reply led to a google search for darknet diaries. Thanks!

Np! Enjoy hours of great content!

s/everyone/someone

I've only just seen your comment and cba to re-read every comment but just at a quick glance out of the small amount of top-level comments 3 of them in the thread suggesting the same.

I think that it's a pretty reasonable payout - people running bug bounties are mostly interested in actual security impact and practical exploitability. And the necessity to hit G server thousands of times to extract even a short video reduces that by quite a large proportion; which is definitely not a shot at the researcher, it's a great find, but exploitability is definitely lower than more direct form of IDOR (e.g. input private video ID and get the whole video in response).

By the same logic, blind SQLi will typically be valued 'less' (hence pay out less) than SQLi with output.

My concern here is that, from the perspective of those looking for these, the relevant time spent is not only that spent on identifying this bug, but all the times spent looking for bugs where there were none, or where they didn't see them.

Maybe bug bounty researchers should include this in their writeup that they send with the disclosure. Label it "security" testing, some details on what endpoints/methods where checked. Suggest a market value for this work, and say that an invoice with 50% rebate can be made out to cover it, if they wish. Need to word it carefully to avoid it sounding like a threat or demand. Intention would be to highlight the work put in and the value for the company, and make it as easy as possible to compensate that.

You wouldn't have to hit the server "thousands of times", do a binary search across frames to get the interesting (i.e. incriminating) bits, then flesh out detail. Security cameras often capture single-digit frames per second, but that doesn't make the footage less valuable as evidence.

They get paid so little because there isn't any other legal means to exchange a bug into money. A monopoly on the only legal way to sell goods means that you get bad prices.

But I do wonder if it would be possible to set up a legal alternative. I suspect if you did you would find law makers lobbied to make it illegal and it would already be decided as unethical by the corporate designed ethics systems.

If the payout were too small, nobody would bother researching vulnerabilities and claiming payment while following the rules. The fact that people are doing it suggests the market is working (and perhaps the payment is even high considering how much participation is going on).

Reply on news.ycombinator.com