I like the picture at the beginning of some CLI novice trying to git push his home directory
The double `ls` hits home :D (more like `git s` nowadays, also :w on repeat).
Teen Becomes First Hacker to Earn $1M Through Bug Bounties
91–100 of 178 posts
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#92Earlier quoted context omitted.
To be on the other side of this, we do received unsolicited but welcomed bug and security reports. Some are legit and we pay bounties even if we don't have an official policy and we are an early startup. Others are just automated reports that people copy and paste. These ones are uninteresting, but these people still think they deserve money. Often more aggressively than the legitimate ones.
Can you elaborate on the automated reports a bit more? What makes them uninteresting?
[deleted]
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#93Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…
There is actually a very simple solution to this: publish a Merkel tree of submitted bug reports.
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#94Impressive!
This one 19 year old has earned 2.5% of all cash paid out by HackerOne...
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#95Earlier quoted context omitted.
It's not, I still have the email exchange from a couple years back - I thought of posting it somewhere because it was so odd, but I dont have a blog and I am not interested in publicity. Amazon still doesn't offer a bug bounty program to my knowledge. Also, it's the only cloud provider my active security researcher friends tell me that attempts to regulate them by some weird pen test authorization requirements which…
Pretty sure they do: https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-... And: https://aws.amazon.com/security/vulnerability-reporting/
It's just reporting, no payouts.
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#96I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.
I feel like there are probably a lot of easy targets available. Look at the network requests between the client and server and see if there is anything that looks like its not validated. If you see ids try changing them and see what happens. Quite often it seems that the back end just trusts whatever the client sends. Especially if its a mobile app or a SPA because new devs seem to think the api is only visible to them.
From reading some of these hacks on peoples blogs it seems like quite often they just man in the middle a mobile app and find out the api provides way more info than should be shown to the user and the ui hides it.
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#97Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…
I don't think paying bug bounties is a good model in long run.
We should instead pass laws to make disclosing bug to the company/users affected mandatory without any payment for the same for greater societal good.
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#98Earlier quoted context omitted.
Can you elaborate on the automated reports a bit more? What makes them uninteresting?
Examples of "vulnerability" reports I've received: - Dump of CVEs for "Web App X" or "Server X", even though literally zero of them apply to the version that I'm currently running. - Dumps of port scans with warnings like "Running SSH on port 22 is not recommended" and "Server accepts HTTP. Always use HTTPS". I assume there are tools that generate these reports because the reports use decent English but the accompany…
So you just determine the value of reports/the person reporting based on his English?
Do you know there are many researcher who don't have very good English? It's specially true in countries like Germany and China where you rarely need any other language for your work.
I am sorry but you just make it sound like anyone who doesn't have very good English is low IQ, dumb person.
Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties
#99I'm still waiting on YC to set up a bug bounty program after having two verified reports :-)