111–120 of 164 posts
Earlier quoted context omitted.
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
Nothing, but to make a complete argument you have to provide a hypothetical buyer, their price, and why they'd pay it.
Known security person buys this in order to turn it in themselves for a higher bounty and increased rep.
He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...
Earlier quoted context omitted.
Sorry, I'm interested in anyone's response to this, since the HN community reaction to any price paid in a bug bounty by a big company always seems to be "people can make more money on the black market". Rather than recapitulating all the previous debates about why that's not true, I'm interested in seeing someone --- doesn't have to be you --- work their way to an educated guess at a black market price for a bug lik…
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
I guess Zerodium has enough reputation that you can be reasonably sure they'll fork over the cash after you show them your bug. Building that kind of reputation on the darknet with cryptocurrency isn't going to be easy. If there was anyone like that out there, we'd already know about them.
Earlier quoted context omitted.
Nothing, but to make a complete argument you have to provide a hypothetical buyer, their price, and why they'd pay it.
Here is an angle that could work. Known security person buys this in order to turn it in themselves for a higher bounty and increased rep.
Earlier quoted context omitted.
You don't have to think about it too hard, there's companies that will help you with the transaction. https://www.zerodium.com/
First, you can just go look at Zerodium's website and see what they'll buy. Notice that one-off vulnerabilities aren't there at all: there are no vulnerability types on their rate sheet that a single vendor can instantaneously fix worldwide with a single patch. Notice also that with just a couple exceptions, RCEs in extremely widespread serverside web components are valued at $10k (if you believe their price list; I'…
BTW -- not to fan out too hard, but I put together the pieces recently and realized in addition to Latacora you worked on Cryptopals and Microcorruption. As someone interested in exactly those areas with little knowledge of how to break in, thank you! I've found both great learning resources (although I'm embarrassingly early in the crypto challenges still..)
He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...
What is "Google3"? Incidentally, Google isn't helpful in finding out - all I get as results is garbage and some node.js package placeholders.
Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.
Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it?…
If the NSA failed to pay, I would disclose it and try to collect that way. I doubt the NSA would reveal I went to them first as that would reveal that they didn't pay for exploits.
Government organizations should have the money and an incentive to pay.
He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...
Source? Is there really no authentication around it?
I'm not sure what access that actually gives, but that email thread showing people getting +cc'd on the ticket speaks pretty obviously to the severity and magnitude of the problem.
(Am Googler.)
Earlier quoted context omitted.
Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
XXXX == what types of things? I’m curious why there was no auth required for his calls.
Earlier quoted context omitted.
> That's a great way to never be able to hire him. Why's that? It's not retirement money. 400k (salary+stock) is one year of compensation for some Google engineers.
Dude has cashed out a $10k and $30k bug bounty at the age of 18. Either he's lucky or he's very good. If he's the latter that $400k turns into an annual bounty. And very, very few Google engineers make that kind of money.
You'd be surprised. In Mountain View, everyone level 6 or above makes at least that amount, and most level 5s probably do as well. I'd guess that probably 20% of engineers are T5 or above, which is a ton of people when you multiply by tens of thousands of engineers.