Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shopify has paid over $300k in security exploit bounties

hackerone.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Shopify has paid over $300k in security exploit bounties

#71

Post by innoying »

FBSecuritySux wrote: post #68

What's funny is Facebook -> has a publically faced image server that has NO authentication required to see even private messages. When FB Security was contacted ... they say it was not a "guessable" URL, ergo security through obscurity was their "security method" of choice. This was two days ago. If anyone wants to test this theory - setup 2 FB accounts, message an image one FB account to the other. Click on the imag…

Hi "FBSecuritySux",

I'm not a member of the Facebook security team, but I work in the industry and your comment frustrates me. I can understand criticizing companies for poor security decisions if they are legitimately bad decisions, but I don't think that's the case here...

I just tested this between two Facebook accounts, and got a URL like this: https://scontent.fsnc1-1.fna.fbcdn.net/v/t35.0-12/12628848_1...

Let's imagine, for the sake of argument, that all those numbers in the URL are predictable and 100% the security relies on the "oh" and "oe" parameters. Taking a rather naive approach both of these appear to be exclusively hex strings. Therefor "oh" is 16 bytes and "oe" is 4 bytes making the total 8*(16+4) = 160 bits

In other words, assuming both parameters are truly random, an attacker would have to try (worst-case) this many combinations to view a victim's image: 2,135,987,035,920,910,082,395,021,706,169,552,114,602,704,522,356,652,769,947,041,607,822,219,725,780,640,550,022,962,086,936,576

Re: Shopify has paid over $300k in security exploit bounties

#73

Post by gsam »

andersonmvd wrote: post #27
WheelsAtLarge wrote: post #25

I'm surprised it's so little. 300k is very little compared to the financial burden that a security breach would bring. Talk to Target and Yahoo about cost. If anything they might start looking into way of increasing it.

It's very delicate to talk about financial burden, given the following references: "Two months after damaging data breach, Target stock has its best day in 5 years" http://blogs.marketwatch.com/behindthestorefront/2014/02/26/... "Sad reality: It's cheaper to get hacked than build strong IT defenses" http://www.theregister.co.uk/2016/09/23/if_your_company_has_... "The Cost of Cyberattacks Is Less than You Might Think"…

In the end, it's really the consumer's fault for not caring. But then again, there's really nowhere to run to anyways. The companies are beginning to cover their asses with cyberinsurance so that they can cover their legal fees and obligations. The only loser is the consumer.

Re: Shopify has paid over $300k in security exploit bounties

#74

Post by wglb »

firloop wrote: post #57
tptacek wrote: post #49

Earlier quoted context omitted.

I strongly urge you to find security management people at existing startups to talk to before starting a bug bounty program at your own startup. There are things about them that are good, but those things can be counterintuitive. I haven't had to manage one (yet), but because we'll no doubt be doing that for several startups this year I've been talking to friends about what their bounty programs have been like, and I…

> Frankly, bounties are something I might push back on for a lot of startups. Care to elaborate why?

Alex Stamos gave a great talk a while back at https://www.youtube.com/watch?v=2OTRU--HtLM while he was at yahoo. Among the things he covered were the risks of bug bounties.

[Edited to add following]

Another article http://searchsecurity.techtarget.com/opinion/Is-the- bug-bounty-program-concept-flawed "There can be a lot of noise in these systems, and the quality isn’t always there, nor are the findings always significant."

And from the same article Google says "Approximately 90% of the submissions we receive through our vulnerability reporting form are ultimately deemed to have little or no practical significance to product security,"

Re: Shopify has paid over $300k in security exploit bounties

#76

Post by saturdayplace »

firloop wrote: post #57
tptacek wrote: post #49

Earlier quoted context omitted.

I strongly urge you to find security management people at existing startups to talk to before starting a bug bounty program at your own startup. There are things about them that are good, but those things can be counterintuitive. I haven't had to manage one (yet), but because we'll no doubt be doing that for several startups this year I've been talking to friends about what their bounty programs have been like, and I…

> Frankly, bounties are something I might push back on for a lot of startups. Care to elaborate why?

The issue I've read about (I'm not a security practitioner, more like a hobbyist) is that the sheer mass of bogus bounty submissions take valuable time to evaluate. If you start up a bug bounty program, you're essentially signing up to read hordes of submissions that you'll be obligated to check out, the overwhelming majority of which pan out to be nothing. And many (most?) of those, will contain petulant and arrogant demands that the bounty be paid even though the "finding" presented is no actual vulnerability at all.

Re: Shopify has paid over $300k in security exploit bounties

#77

Post by rvdm »

As someone who has built a company around working closely with the Shopify platform, I'm very happy Shopify is taking these initiatives.

I like that Shopify isn't your typical Silicon Valley tech company. But coming from a background as a tech and security consultant for Fortune 500 companies, Shopify does feel like I'm back in the tech little leagues sometimes.

And this is an unfair image association problem Shopify has. Their tech is quite amazing and a lot of very brilliant people work there.

It’s great to see Xal, the CEO of a publicly traded company with a close to $4bn market cap, this active on HN. I’ve always considered him one of the most brilliant engineers of our generation ever since the Active Merchant days. To me these programs and the way they are being shared on HN really help bringing his company the credit it deserves.

Re: Shopify has paid over $300k in security exploit bounties

#78

Post by SamHoustonCM »

saturdayplace wrote: post #76
firloop wrote: post #57

Earlier quoted context omitted.

> Frankly, bounties are something I might push back on for a lot of startups. Care to elaborate why?

The issue I've read about (I'm not a security practitioner, more like a hobbyist) is that the sheer mass of bogus bounty submissions take valuable time to evaluate. If you start up a bug bounty program, you're essentially signing up to read hordes of submissions that you'll be obligated to check out, the overwhelming majority of which pan out to be nothing. And many (most?) of those, will contain petulant and arrogan…

(Disclosure: I work for Bugcrowd) That's why we suggest going with a 'managed' bounty. That's where Bugcrowd triages all of the incoming bugs and then passes along the valid bugs for you to prioritize and reward. It cuts out all of the noise and only gives you the results.

Re: Shopify has paid over $300k in security exploit bounties

#79

Post by tptacek »

SamHoustonCM wrote: post #78
saturdayplace wrote: post #76

Earlier quoted context omitted.

The issue I've read about (I'm not a security practitioner, more like a hobbyist) is that the sheer mass of bogus bounty submissions take valuable time to evaluate. If you start up a bug bounty program, you're essentially signing up to read hordes of submissions that you'll be obligated to check out, the overwhelming majority of which pan out to be nothing. And many (most?) of those, will contain petulant and arrogan…

(Disclosure: I work for Bugcrowd) That's why we suggest going with a 'managed' bounty. That's where Bugcrowd triages all of the incoming bugs and then passes along the valid bugs for you to prioritize and reward. It cuts out all of the noise and only gives you the results.

Every startup with significant bounty programs I've talked to either staff an internal triage team or outsource triage --- but, either way, they are spending extra money on triage. I haven't talked to any that don't do this.

The concerns I've had raised to me about the value of these programs in practice all assume you're already paying extra to triage.

Re: Shopify has paid over $300k in security exploit bounties

#80

Post by SamHoustonCM »

tptacek wrote: post #79
SamHoustonCM wrote: post #78

Earlier quoted context omitted.

(Disclosure: I work for Bugcrowd) That's why we suggest going with a 'managed' bounty. That's where Bugcrowd triages all of the incoming bugs and then passes along the valid bugs for you to prioritize and reward. It cuts out all of the noise and only gives you the results.

Every startup with significant bounty programs I've talked to either staff an internal triage team or outsource triage --- but, either way, they are spending extra money on triage. I haven't talked to any that don't do this. The concerns I've had raised to me about the value of these programs in practice all assume you're already paying extra to triage.

Right but the cost differential between staffing it yourself and paying someone else to do it is substantial. Doing it yourself will cost you 3-5x more than paying someone else who is able to do it at scale.
Post reply on HN