Reading Uber’s Internal Emails: Bug Bounty report worth $10K • Hacker News Board

Re: Reading Uber’s Internal Emails: Bug Bounty report worth $10K

#51

Post by Hydraulix989 » Mon, Jan 23, 2017, 3:43 AM UTC

arkem wrote: post #49

Hydraulix989 wrote: post #48

Earlier quoted context omitted.

Right, and this one could have easily been monetized because it allows attackers to intercept and read any one of SendGrid's customer's private internal emails!

I don't agree that this could have been easily monetized. This vulnerability only allows you to intercept future incoming emails that are delivered to sendgrid domains. Even if it did allow access to all of their customers internal emails there aren't many buyers (and no obvious marketplaces) out there for that kind of access. The risk is simply too high, if you're Lyft (for example) being caught with that access (ev…

Corporate clients aren't the ones purchasing black market exploits, the marketplaces aren't obvious. Just confirmed with a friend who does not have ties (disclaimer) that this one would be worth ~100k.

Re: Reading Uber’s Internal Emails: Bug Bounty report worth $10K

#52

Post by arkem » Mon, Jan 23, 2017, 4:05 AM UTC

Hydraulix989 wrote: post #51

arkem wrote: post #49

Earlier quoted context omitted.

I don't agree that this could have been easily monetized. This vulnerability only allows you to intercept future incoming emails that are delivered to sendgrid domains. Even if it did allow access to all of their customers internal emails there aren't many buyers (and no obvious marketplaces) out there for that kind of access. The risk is simply too high, if you're Lyft (for example) being caught with that access (ev…

Corporate clients aren't the ones purchasing black market exploits, the marketplaces aren't obvious. Just confirmed with a friend who does not have ties (disclaimer) that this one would be worth ~100k.

Maybe things have changed in recent years but here's some information on what I considered benchmark prices when I was more involved in this kind of thing. I have some background in vulnerability selling and I used to do this for a living (first government, then later tech company bug bounty programs).

The "grey market" prices I've seen (~5 years ago now) from independent researchers, small firms specializing in vulndev for law enforcement / intelligence and the bigger famous security firms go something like this ("black market" criminal markets are similar I hear but I have no first hand knowledge there):

250k would get you a iOS jailbreak (for a recent iOS version)

100k would get you an IE/Firefox/Chrome zero day (though not with a sanbox escape, you'd have to pay separately for a privesc)

~25k for a Linux privesc

For an RCEs in medium popularity services (databases, ftp servers, etc) you'd be looking at something like 10k (or often thrown in free with a bigger purchase or support contract as a good will gesture).

The prices would also change based on the quality of the exploit, how recent the version the exploit targeted was, the amount of exclusivity you want (more for full exclusivity) and whether the research was specially commissioned (if you had asked a firm to look into a specific piece of software the price would be higher). The larger providers also encouraged organizations to sign subscription deals and longer term service contracts that could include free exploits or reduced costs.

That said, there's a lot of information asymmetry in the market so I'd expect a lot of variance in prices.

Re: Reading Uber’s Internal Emails: Bug Bounty report worth $10K

#53

Post by uraniumhacker » Fri, Feb 03, 2017, 3:57 PM UTC

Hi thank you for the post. If anyone has question, feel free to reach out to me here or at uranium@uraniumhacker.tech. As a writer of this blog, I will be able to provide the feedback necessary and clear any misunderstanding/false positives regarding this.

Re: Reading Uber’s Internal Emails: Bug Bounty report worth $10K

#54

Post by uraniumhacker » Fri, Feb 03, 2017, 3:58 PM UTC

zaroth wrote: post #16

I found this write-up a bit confusing and hard to follow. The vulnerability is that any SendGrid user could configure a webhook callback which would POST back all received emails for any domain which had its MX set to 'mx.sendgrid.net'. OP exploited this against Uber to receive copies of their emails. Presumably there was no way to tell from one account that another account is web-hooking your email out from under yo…

At the time of the exploit, there was only one check, the MX record. Also once I claimed the domain, another user cannot claim it from their account. So this could be exploited silently as well because the victimized company won't know about it for a while.

Re: Reading Uber’s Internal Emails: Bug Bounty report worth $10K

#55

Post by uraniumhacker » Fri, Feb 03, 2017, 3:59 PM UTC

beejiu wrote: post #12

tyingq wrote: post #7

Earlier quoted context omitted.

Uber's bug bounty program seems like explicit permission to me. The twist here, as you mention, is that it is sendgrid's infrastructure. Chasing bug bounties does seem a bit risky in this "cloud" era where it's not just one entity running the targeted service.

It is not listed as an in-scope domain on Uber's bug bounty policy. You would have to argue that the access was unintentional - that you believed you had authorization to access the server from Uber and that Uber had the ability to assign that authorization on behalf of SendGrid.

The scope of Uber's bug bounty program was updated after this report was submitted so that does not count.