Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

151–160 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#151

Post by SirSavary »

lixtra wrote: post #131
debaserab2 wrote: post #115

Earlier quoted context omitted.

What's the justification for running a host that responds to HTTP and doesn't immediately upgrade to HTTPS? I'm having a hard time imagining a scenario where I manage a web server that is accessible to anonymous people running pen scanners on it that has a justifiable reason for broadcasting port 80.

If you connect remote communities with poor bandwidth http allows a shared cache behind the bandwidth bottleneck. And other caching scenarios.

Could you elaborate on this? I'm curious as to how a setup like this would work in practice. Many people in my family live in rural areas so the topic of restricted bandwidth/poor connection quality is of great interest to me.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#152

Post by [deleted] »

chime wrote: post #128
lucb1e wrote: post #68

Earlier quoted context omitted.

I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…

It's related to Purchasing Power Parity [1] and a good example of that is the Big Mac Index [2]. Basically, even if you adjust for exchange rate, the same amount of currency can buy 2 apples in one country and 4 in another. This should not be possible in a globalized market because of the Law Of One Price [3]. However, that only really applies in the long term, for buyers with perfect information (i.e. full knowledge…

[deleted]

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#153

Post by javagram »

SirSavary wrote: post #151
lixtra wrote: post #131

Earlier quoted context omitted.

If you connect remote communities with poor bandwidth http allows a shared cache behind the bandwidth bottleneck. And other caching scenarios.

Could you elaborate on this? I'm curious as to how a setup like this would work in practice. Many people in my family live in rural areas so the topic of restricted bandwidth/poor connection quality is of great interest to me.

https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites...

“But there I stood anyway, hoping my requests to load simple web pages would bear fruit, and I could continue teaching basic web principles to a group of vocational students. Because Wikipedia wouldn’t cache. Google wouldn’t cache. Meyerweb wouldn’t cache. Almost nothing would cache. Why? HTTPS.”

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#154

Post by ddebernardy »

joshuakcockrell wrote: post #56
HeavenBanned wrote: post #25

Earlier quoted context omitted.

What's a way to learn security work? Genuinely curious.

One of the best introductions to the field is going through overthewire’s bandit vulnerability games. https://overthewire.org/wargames/bandit/ They have 30+ levels where you ssh into a server and attempt to find some type of vulnerability. They start out very easy and get tough quick. It’s very eye opening to see the types of exploits that exist. They also have a set of challenges aimed at serverside web security. ht…

> One of the best introductions to the field is going through overthewire’s bandit vulnerability games.

Out of curiosity I visited your first link and played the first dozen+ levels. It's just been bash-fu and occasional man reading/googling. Judging by the subsequent level instructions I went through, there didn't seem to be much more in there. I'm like, if you really want to learn more about shell commands, there are man pages. Admittedly, a game is arguably a good way to tutor a lazy reader. Still, did I miss anything else in there by not finishing the game?

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#157

Post by idontpost »

chime wrote: post #128
lucb1e wrote: post #68

Earlier quoted context omitted.

I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…

It's related to Purchasing Power Parity [1] and a good example of that is the Big Mac Index [2]. Basically, even if you adjust for exchange rate, the same amount of currency can buy 2 apples in one country and 4 in another. This should not be possible in a globalized market because of the Law Of One Price [3]. However, that only really applies in the long term, for buyers with perfect information (i.e. full knowledge…

> Gas stations next to each other but divided by a state line in the US have different prices

Hell, gas stations divided by a street have different prices. In one case I saw, the one you could see from the freeway was +$0.50 per gallon compared to the one you couldn't see from the freeway.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#158

Post by deytempo »

technion wrote: post #81
thrwawy0001 wrote: post #66

Earlier quoted context omitted.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for: - nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list Responding to this sort of…

Just silence the version header advertisement for the web servers. Make them actually test for vulnerabilities not just check the version

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#159

Post by briansmith »

dasil003 wrote: post #147
danschumann wrote: post #73

I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.

I have never once heard of a bug bounty being paid to a former employee let alone to the same person who wrote the code. It strikes me as something that is likely to do damage to ones reputation far out of proportion the few thousands of dollars one might hope to gain.

I received a bug bounty from Mozilla after leaving, in a browser component I previously worked on. I didn't write the vulnerable code though.

On the other hand, Google refused to pay me a bug bounty for a bug I found in the same component, in part because I used to work on it when I was at Mozilla, even though I didn't write the vulnerable code.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#160

Post by debaserab2 »

solatic wrote: post #118
debaserab2 wrote: post #115

Earlier quoted context omitted.

What's the justification for running a host that responds to HTTP and doesn't immediately upgrade to HTTPS? I'm having a hard time imagining a scenario where I manage a web server that is accessible to anonymous people running pen scanners on it that has a justifiable reason for broadcasting port 80.

No that's the point, the generation script recognizes that the server issues an HTTP-compliant response (which 301 Moved Permanently is) on port 80 and dumbly generates that false-positive, not understanding that the only responses on port 80 are to upgrade to HTTPS.

Oh, that makes sense. That does sound annoying.
Post reply on HN