Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

121–130 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#121

Post by vaultcool »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

What a shitty move. Bug bounty sites should ban companies engage in this exploitative behavior repeatedly.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#122

Post by baxtr »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

Blockchain technology will solve this trust issue automagically!

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#123

Post by glomph »

Moodles wrote: post #114
lisper wrote: post #93

Earlier quoted context omitted.

There is actually a very simple solution to this: publish a Merkel tree of submitted bug reports.

How would that work? Surely the company could make a fake duplicate and show it to you in a Merkle tree as "proof"? They literally make up every node in the Merkle tree after all.

They could publish a hash of the whole existing tree regularly.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#124

Post by debatem1 »

tptacek wrote: post #36
shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

I don't doubt your lived experience, but for real companies, the economics of ruthlessly withdrawing bounties don't make sense; bounties just don't cost enough money to be worth picking fights over. There are some patterns where I've seen people not get paid just on general principle; for instance, people find systemic issues and, rather than disclosing the root cause, try to claim bounties for every instance of the…

I've had this happen for pretty large companies. In one case their security team later gave a talk about bugs they'd discovered that included a diagram I'd sent in my description of an issue, which I found annoying.

These days I generally just sit on issues. The work involved in putting together a bulletproof report that can be understood by whoever reads the security alias (could be a security engineer, could be a PHB, could be /dev/null...) is just too high to do for free.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#125

Post by ryanlol »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

>Edit: pardon the tone, I understand that these types of problems are very very hard to solve because they aren't purely technical and involve humans.

Vuln escrow is a trivial problem to solve, just publish timestamped hashes of reports. Anything else is simply inexcusable.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#126

Post by armamut »

badfrog wrote: post #22
armamut wrote: post #8

I definitely do have respect to this guy named Santiago Lopez, while I'm literally twice as old as him.

What does the second part of that sentence have to do with the first?

Yes =) both @tom_ and @mattigames are right. I'm not a native English speaker, pardon my English usage. What I mean is, this guys achivement shows his self-motivation, dedication and knowledge level at a relatively younger age. (Maybe for some, he is old enough.)

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#127

Post by lisper »

glomph wrote: post #123
Moodles wrote: post #114

Earlier quoted context omitted.

How would that work? Surely the company could make a fake duplicate and show it to you in a Merkle tree as "proof"? They literally make up every node in the Merkle tree after all.

They could publish a hash of the whole existing tree regularly.

Exactly. After every submission in fact.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#128

Post by chime »

lucb1e wrote: post #68
mattigames wrote: post #48

Earlier quoted context omitted.

People don't even conceive the difference, in Buenos Aires you can rent a great house in a great neighborhood for 800 USD per month, in San Fran you get a shared room where other 3 people live for that much -IF even that-. In SF you spend at least 5 dollars going anywhere and going back using public transport, in Buenos aires $2 is more than enough to go the the opposite side of the city and back.

I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…

It's related to Purchasing Power Parity [1] and a good example of that is the Big Mac Index [2]. Basically, even if you adjust for exchange rate, the same amount of currency can buy 2 apples in one country and 4 in another. This should not be possible in a globalized market because of the Law Of One Price [3]. However, that only really applies in the long term, for buyers with perfect information (i.e. full knowledge of all price/quantity options), and for goods that are tradable. Land is not tradable internationally. You can't just move 1000 sq ft. from Argentina to US. Same with labor e.g. people who speak a specific language or perform a specific skill. Add to that local taxes, transportation, and energy costs and you can see why the same apple costs more in a different place.

Gas stations next to each other but divided by a state line in the US have different prices. Taco Bell sells the same burrito for different prices. The same factors apply internationally too, nothing to do with exchange rate.

Hope this was as ELI5 as necessary for HN-level discussion.

https://en.wikipedia.org/wiki/Purchasing_power_parity https://en.wikipedia.org/wiki/Big_Mac_Index https://en.wikipedia.org/wiki/Law_of_one_price

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#129

Post by danschumann »

satellitec4t wrote: post #82
danschumann wrote: post #73

I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.

Obligatory Dilbert https://dilbert.com/strip/1995-11-13

How did you find such a specific reference lol

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#130

Post by ancarda »

technion wrote: post #81
thrwawy0001 wrote: post #66

Earlier quoted context omitted.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for: - nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list Responding to this sort of…

If you were to do some of these (like removing the nginx version), do you think they'd start demanding payment?
Post reply on HN