Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing the Windows Bounty Program

blogs.technet.microsoft.com

Post reply on HN
Print view View original

61–70 of 121 posts

Re: Announcing the Windows Bounty Program

#61

Post by dsacco »

cperciva wrote: post #36
tptacek wrote: post #22

Earlier quoted context omitted.

It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.

I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn t…

As those tools become more widely used and more easy to use, you'll be able to lower the mean bug bounty reward payment as well.

Re: Announcing the Windows Bounty Program

#62

Post by big_youth »

daddyo wrote: post #57
dsl wrote: post #55

Earlier quoted context omitted.

> In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.

How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?

Plenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium

Re: Announcing the Windows Bounty Program

#63

Post by mindingdata »

cperciva wrote: post #36
tptacek wrote: post #22

Earlier quoted context omitted.

It's doable, but if you're good enough to somewhat routinely find bounty-worthy bugs but not spooky good at it, it's not the most lucrative way to put bug-hunting skills to work.

I've noticed a spike recently in bug bounties going to people who using a combination of fuzzing and code analysis tools. It may be that we're moving to a point where bug-hunters' ability to use sophisticated tools will be what earns them the most money, rather than their ability to eyeball code and see the bugs. Speaking just for myself: A few years ago I was saying "I should really set aside a few months to learn t…

There was this thing called "Hostile Subdomain Takeover" where a company would point a subdomain to a particular SaaS product (Say Zendesk), sometime later, they would cancel their subscription but not change the A record.

Someone could then go and register a new Zendesk account (If the service doesn't require proof of ownership of domain), and say that they want to use the same subdomain. Now they have a Zendesk account with the URL of http://help.somedomain.com as an example. And they can phish people quite easily.

Anyway, the reason I bring it up is because for a while, I saw people spamming the shit out of bug bounties with this stuff. Because it's super simple to do.

So I'm not sure what is more lucrative for an average joe, actually learning proper techniques or trying to piggy back on some low hanging fruit that may be easy to automate.

Re: Announcing the Windows Bounty Program

#64

Post by dsacco »

daddyo wrote: post #57
dsl wrote: post #55

Earlier quoted context omitted.

> In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.

How would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?

The nature of the work is such that:

1. If you have to ask this question, you are quite far from being able to do it any time soon (and that's assuming you can find the vulnerabilities!),

2. You will predominantly sell your vulnerabilities, preferably weaponized as complete exploits, to firms that specialize in "vulnerability research" and "exploitation development" with close ties to government agencies.

It's much easier to find a firm that can act as a broker between you and the government agency than it is to knock on the right doors to sell it on your own, with no background or prior contact.

Re: Announcing the Windows Bounty Program

#65

Post by Someone1234 »

43gg43g32g wrote: post #41
v4n4d1s wrote: post #7

Dear Microsoft >Any critical or important class remote code execution, elevation of privilege, or design flaws that compromises a customer’s privacy and security will receive a bounty Windows 10 has a major design flaw which compromises your customers privacy and security. You call it Telemetry and it can't be disabled completely(definitely a bug! Nobody would make such a stupid decision, amiright?). Please send me f…

Don't know why you got downvoted for this on a hacker forum.

It is off-topic.

There are threads where it would be relevant, in this case they're just using this thread as a sounding board because the title contains the word Microsoft. Plus we have all read near identical posts and the corresponding discussion hundreds of times already, because they appear in every thread that brings up Microsoft.

It is kind of like Godwin's law, except instead of Hitler it is telemetry and Microsoft. If there is new information or new things to discuss, absolutely let's talk about it, but repeating the same complaint gets old after the nth time.

Re: Announcing the Windows Bounty Program

#66

Post by legulere »

ourmandave wrote: post #4

That max hyper-v payout of $250,000 reminds me of the TV Trope Just Cut Lex Luthor a Check http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorAChec...

Usually you can get more money for exploits on the black market, than from bug-bounties. Governments from all around the world have a lot of money to spend to buy exploits.

Re: Announcing the Windows Bounty Program

#67

Post by computerex »

tiffanyh wrote: post #23

I wonder what impact this will have on open source software (OSS). OSS can't afford to pay people to look for bugs and improve the overall software. But commercial companies can. I wonder if there will exist a date/time in the future where closed-source software, because of these bug bounties, will yield better (less buggy) software vs OSS.

I think that is already the case to some extent.

Re: Announcing the Windows Bounty Program

#69

Post by ocdtrekkie »

jumpkickhit wrote: post #60

Bounties for Edge? Isn't it less than 5% in browser market share? I like the fact they're offering a bounty program, I'm just surprised Edge was included I guess.

Edge is the recommended primary web browser of Windows going forward... so yeah, it kinda makes sense for them to include it.

Re: Announcing the Windows Bounty Program

#70

Post by groby_b »

efdee wrote: post #40
jklein11 wrote: post #34

Earlier quoted context omitted.

Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes. In the case of OSS, the pool o…

That's how the theory goes, but how often does this really happen though? See: OpenSSL

See: BoringSSL
Post reply on HN