Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

91–100 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#91
post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

Sure, people thought of it -- Google even sells it as a product, Cloud Security Scanner[1]. The internal version has been running on internal sites for a long time now.

[1] - https://cloud.google.com/security-scanner/

Re: Google Bug Bounty – The $5k Error Page

#92

Earlier quoted context omitted.

You said "There's nothing to index," as if Google is making web requests to every domain in existence, parsing the document responses, and seeing which sites have these words on them, all at runtime when you type a search query. Google obviously indexes the web in the sense that they store their own cached versions of web pages "locally," on top of which they then build an insanely complicated, web-facing, search arc…

we're talking past each other. sova referred to this meaning - https://en.wikipedia.org/wiki/Database_index when they said "clever indexing." the sense you mean is a different sense of the word index - meaning, to crawl. Yes, of course it does that too.

I was not referring to database indexes. That is not pertinent here. I was thinking about the index that Google creates, its locally cached version, that it queries. If you have a locally cached version, you are not going to rifle through them one by one until you find matches, nor are you going to rifle through them and find partial matches and then intersect them all to see if any overlap in your final product. Among other weird assumptions, that final method assumes there is a solution for every query.

Google, no doubt, has a very sophisticated way of querying against their cache of the WWW and it has probably evolved over time. However, it is inappropriate to say Google does a join over the entire internet for one query. It is much more reasonable to say that Google checked your query string against their gigantic index of terms, and it took a while to dig that deep into the pile. The performance hit such a complex query takes is more like unzipping a large archive to get a specific megabyte's worth of info, rather than saying it smashed all the files together and then searched for the exact term like notepad.

Anyway, think about it for a while, it's clearly a cool issue in search, and programs and algorithms do not have to visually search things as humans must.

Re: Google Bug Bounty – The $5k Error Page

#93
post #84

Earlier quoted context omitted.

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could…

I think it indexes the entire string, no? or would that be too many combinatorics, idk.

Yes, it must, let's be exhaustive because we can and because the problem is solvable and because someone must do it.

Have you accidentally searched Google for a long URL and seen it come up? It is actively caching stuff all the time, and that cache just grows and grows, and it must be a pretty beautiful megastructure that you can run queries against.

Re: Google Bug Bounty – The $5k Error Page

#95
post #37
post #35

Earlier quoted context omitted.

What's the general signal to noise ratio for bug reports?

About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports…

~10% valid submissions still sounds like a fantastic number to me. Sure you have to sort out the bad ones, but it's still a solid stream of valid reports.

Re: Google Bug Bounty – The $5k Error Page

#96

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

>and he/she came into the thread to kindly ask us to stop messing up their statistics. Shouldn't someone with a job in statistics know how to account for outliers?

And also, wouldn't they be interested in getting those queries so they could either fix their performance or block them?

Re: Google Bug Bounty – The $5k Error Page

#97
post #37

Earlier quoted context omitted.

About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports…

My favorite bug bounty report so far read, in its entirety, "try it ASAP".

I've received reports for things like "source code disclosure" where they link to our jQuery.

Re: Google Bug Bounty – The $5k Error Page

#98

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

>and he/she came into the thread to kindly ask us to stop messing up their statistics. Shouldn't someone with a job in statistics know how to account for outliers?

This particular issue was posted on Quora, where anyone could pick it up and participate in what is essentially a denial of service attack (whether or not performed intentionally). It wasn't submitted as a private bug report to Google so they could fix the issue. It was spread in a public forum. I think it's fair for Google to politely ask "a few of your own tests to validate an issue you will submit as a bug report is fine, but please don't disclose to the public until we patch it."

When you operate at the scale of Google, everything is expected to be airtight; outliers should not be possible. It wouldn't surprise me if their monitoring systems are built without the ability to "massage" (ie: manipulate) statistics, as it is a terrible practice. I don't think a statistician who relies on ignoring outliers would last long working for Google. They're not doing their job if the only thing they care about is silencing warnings to make pretty graphs that falsely show everything is running smoothly. Their job is to work with the truth - not manufacture little white lies to appease management.

Re: Google Bug Bounty – The $5k Error Page

#99

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...

You should also publish it. Not out of revenge, but to alert customers of the quality of the software they are using and to put additional pressure on Wickr to fix it. Project Zero does that too (as do most of other security researchers). Of course, you should give them enough time (90 days?) but after that it's publish time...

Re: Google Bug Bounty – The $5k Error Page

#100
post #28
post #23

Earlier quoted context omitted.

Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D. I guess it's as much mindset as it's skill.

I got a bug bounty once because I reported a bug in Chrome that someone else was complaining about in the comments section of a tech blog. If instead of just complaining that commenter had taken the time to fill out a bug report they could have easily gotten the bounty instead. Sometimes it just takes a tiny bit of extra effort to go from noticing something's amiss to actually doing something to get it fixed.

Good idea. Imagine if you can do one bug report a month. 5K is nice income.
Post reply on HN