Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

101–110 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#101

Post by developer2 »

idonotknowwhy wrote: post #32

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...

That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" instead of the correct "WHERE id = :id AND deleted = false".

Managing soft-deletes on a database table requires an attention to detail, with every single query ever touching that table, that many developers lack the discipline to handle. Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary. Finally, ORM abstractions often automate soft-delete in such a way that makes it exhausting for developers to validate every query. I've seen this bug over and over again at every company I've worked for. Happens so often it's impossible to keep count.

Re: Google Bug Bounty – The $5k Error Page

#102

Post by hoschicz »

carvalho wrote: post #58
ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

This is his answer: "I work on search at Google, and I have to say, very clever answers! Now, please stop. :-p"

I don't think that he did it because it's his job to stop random people on the Internet from running slow queries. I think she was just surprised how creative people are and found it funny.

Re: Google Bug Bounty – The $5k Error Page

#103

Post by Macuyiko »

xyzzyz wrote: post #91
Macuyiko wrote: post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

Sure, people thought of it -- Google even sells it as a product, Cloud Security Scanner[1]. The internal version has been running on internal sites for a long time now. [1] - https://cloud.google.com/security-scanner/

Very interesting. Does this really implement some intelligence/learning, however? Or is it just going over a list of known vulns like most scanners do?

Re: Google Bug Bounty – The $5k Error Page

#104

Post by martenmickos »

daddyo wrote: post #35
jcims wrote: post #33

Earlier quoted context omitted.

Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporte…

What's the general signal to noise ratio for bug reports?

Generally in the world of bug bounty programs, the signal-to-noise ratio (SNR) is around 10-20%.

Even at this low rate, it is not too bad. Let's say you receive 10 reports. You can relatively quickly identify the 8-9 noisy reports to find the 1-2 valid ones. Of course, a higher SNR is always better. It saves you time and effort.

On HackerOne, the average SNR across all programs is over 30%. The platform can automatically filter out certain reports that are duplicates or out of scope.

The platform maintains an average signal rating for each hacker (aka security researcher). Companies can limit access to their programs to hackers with a certain signal or higher. This will significantly increase SNR for the program.

Companies can also opt for a HackerOne program with triage included, in which case the SNR rises close to 100%.

Re: Google Bug Bounty – The $5k Error Page

#105

Post by dingaling »

jcims wrote: post #33
ArlenBales wrote: post #24

> 10/02/2017 – Google already fixed the issue but forgot to tell me … I contacted them asking for an update > 19/02/2017 – Got a response, they implemented a short-term fix and forgot to sent my report to the VRP panel … I hope Google forgetting to follow up on bug bounties and needing to be reminded isn't a common occurrence.

Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporte…

I'll don my corporate hat and say: those are completely unacceptable excuses for poor client communication.

I'd perhaps accept 'I was so deep in the code!' once from a very junior developer, as a learning experience.

To the person that reported a bug, that one report makes or breaks their entire opinion of your organisation. We lost customers because of poor communication, and on the other hand made some very happy repeat-customers even when we had to say 'we can't fix that yet' - but they were in the loop for the whole process and understood why.

Re: Google Bug Bounty – The $5k Error Page

#106

Post by developer2 »

annnnd wrote: post #96
ClassyJacket wrote: post #78

Earlier quoted context omitted.

>and he/she came into the thread to kindly ask us to stop messing up their statistics. Shouldn't someone with a job in statistics know how to account for outliers?

And also, wouldn't they be interested in getting those queries so they could either fix their performance or block them?

The query was already published on Quora. I assume that Google did patch the issue. They were simply requesting that it not be posted in a public forum, resulting in the potential for denial of service attacks. It wouldn't have been a statistician making a fuss about their pretty graphs being ruined. The problem was the very real performance impact the queries were having on the service, as thousands of visitors copy/pasted from Quora to see for themselves.

This is why companies like Google have bounties for such things. "Please submit bugs and performance issues privately so we can patch them before you disclose the details publicly and hurt our services - we'll even pay you for your discretion!"

Re: Google Bug Bounty – The $5k Error Page

#107

Post by Confusion »

ClassyJacket wrote: post #78
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

>and he/she came into the thread to kindly ask us to stop messing up their statistics. Shouldn't someone with a job in statistics know how to account for outliers?

When it's tried often enough by enough readers of the question, it's not an outlier any more.

Re: Google Bug Bounty – The $5k Error Page

#108

Post by RandomBK »

developer2 wrote: post #101
idonotknowwhy wrote: post #32

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...

That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" ins…

It's issues like this that really highlight the benefits of shuffling deleted data to a separate archive table through triggers, or leveraging temporal tables. It may not necessarily be as efficient as maintaining a flag, but it dryastically reduces the mental overhead placed on users of the database.

Re: Google Bug Bounty – The $5k Error Page

#109

Post by elmigranto »

developer2 wrote: post #101
idonotknowwhy wrote: post #32

I found a bug in wickr where I can re-read "deleted" messages. I submitted it, answered their teams questions about reproducing it. A couple of weeks later, they said they can't fix it and didn't pay me :( I got all my wickr contacts to switch to signal, which is much less buggy...

That bug is extremely common, and the source is always the use of soft-deletes in the database. When you view the list of items (ex: inbox), the database query includes a "WHERE deleted = false" to exclude rows which have been soft-deleted. When viewing a single item (ex: message) the URL contains a unique identifier, whether an auto-increment integer, UID, etc. The query used to load one item is "WHERE id = :id" ins…

> Managing soft-deletes on a database table requires an attention to detail.

> Discipline aside, it's difficult for every developer on a team to remember which tables use soft-delete, and when checking that flag is or is not necessary.

That's the case where instead of "try harder not to make mistakes", you design a system so it is not possible to make them. One way would be to rename original table `raw_messages` and `create view messages as select * from raw_messages where not deleted`.

Re: Google Bug Bounty – The $5k Error Page

#110

Post by frenchie14 »

lucb1e wrote: post #88
netheril96 wrote: post #54

Such a refreshing story after countless of security researchers get threatened or sued when they report security vulnerabilities to the company that should have thanked them instead.

Haven't read one of those in years. Did one come by on HN recently?

This one comes to mind: https://news.ycombinator.com/item?id=14166966

> Raneri questioned my motivation and I said that I want to give the vendor ample time to resolve the issue and then I want to publish academically. He was very threatened by this and made thinly veiled threats that the FBI or other institutions would "protect him". Then he continued with statements including "we want to hire you but you must sign this NDA first." He also recommended that I only make disclosure through FINRA, SDI, NCTFA and other private fraud threat sharing organizations for financial institutions.

Post reply on HN