Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking the email of any YouTube user for $10k

brutecat.com

Post reply on HN
Print view View original

131–140 of 487 posts

Re: Leaking the email of any YouTube user for $10k

#131

Post by tptacek »

dan-robertson wrote: post #101
asah wrote: post #95

Earlier quoted context omitted.

Also, Google can monitor the grey/black market and buy these exploits under false identities. For less urgent vulnerabilities (such as the YT email hack), this severely caps the bounty size.

My guess was that people selling vulnerabilities generally know who they’re selling to. Is there a big market for people selling exploits to unknown/anonymous customers?

People talk about "people selling vulnerabilities" as if there's an established pattern for selling arbitrary vulnerabilities. There is not. There's an established pattern for selling exploits for RCE vulnerabilities on a subset of popular client-side platforms. It's not an especially easy market to break into (as with consulting, people starting out here tend to end up subcontracting, and taking a huge income hit).

For any other kind of vulnerability, you're not so much "selling a product" as you are "helping plan a heist".

Re: Leaking the email of any YouTube user for $10k

#132

Post by tptacek »

jeffwask wrote: post #127
mmsc wrote: post #97

Earlier quoted context omitted.

>Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no. Absolutely, yes. Spam and targeted phishing attacks are in high demand. My understanding is that it is possible to retrieve every public youtube channel ID, if not also Google Maps/Play reviewers, quite easily. This exploit could have been used to create a massive near-complete database of every Google accou…

Honestly, that leaves straight up harassment of YouTubers by other YouTubers and fans off the table which by itself would motivate a few of them. Some of the same people who play in the black and grey hat worlds are the same people buying DDOS attacks and swatting streamers. They would have a party with their emails.

Draw up a straw-man business plan for this, with SWAG numbers.

Re: Leaking the email of any YouTube user for $10k

#133

Post by blagie »

tptacek wrote: post #118
blagie wrote: post #110

Earlier quoted context omitted.

My commentary was precisely about the state-of-the-practice. That $10k is "an extraordinarily high sum for" what was likely weeks of work on this bug, and probably months of work poking in other places, reflects the very, very low focus on security industry-wide. This is why we need significant civil -- or possibly occasionally criminal -- liability. Civil if it's simple negligence, and criminal if it's gross neglige…

Google pays a piece rate. They pay the rate the market will bear, unless you impress them, like these people did, and then they pay a bit more. They do not compensate you for your working hours. Google is not going to pay you $200 if they leak your email address. Google pays as much attention to security as Apple does. If you want a world in which these kinds of security bugs create multimillion-dollar liabilities, y…

I am very much advocating for new statutes. That's precisely what my post was doing. Companies should not be allowed to externalize costs of bad security on users.

I disagree with the claim that "only companies like Google will be able to afford to operate in that world." That's not how markets work.

1) The impact would be that frameworks would develop with better security. This would result in a slowdown of software engineering. Perhaps it would start to look like any other engineering discipline, where things are analyzed for safety.

2) Every other industry shows that in situations like this, big players are disadvantaged.

The analysis here is pretty basic:

- If I'm running a small $10M startup making a little iPhone app for some obscure task, the risk of legal liability from this is among the smallest of my risks of going under, so I'm incentivized to ignore it. If I were faced with a $400B liability, I declare bankruptcy, so in effect, that's a $10M liability. The expected cost is 5% times 10M = $500k, so it makes sense to spend up to $500k to mitigate a 5% risk.

- If Google has a team working on that same app, and doesn't manage security properly, the $400B liability stays a $400B liability. There is no ROI analysis where it makes sense to build a little app which has a 5% chance of leaking data. Do it right, or don't do it at all. The expected cost to Google here is 5% times $400B = $20B.

This is why, in virtually every other industry, big players are (1) more trusted (2) more expensive, and phrases like "small, fly-by-night operation" exist (and make business sense to run).

Re: Leaking the email of any YouTube user for $10k

#134

Post by edanm »

tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

I don't remember if I've ever thanked you for the dose or reality you bring to these discussions, but if not - thank you! Before I started reading your comments on bug bounty payouts I'd probably have made the typical thoughtless (in my case) remark that the bounties are tiny, without actually thinking through the realistic dollar value of bugs found.

Not to mention not really thinking through how obviously stupid it is to immediately compare a legal activity to a highly illegal one, as if they're real alternatives for most people.

Re: Leaking the email of any YouTube user for $10k

#135

Post by jeffwask »

tptacek wrote: post #132
jeffwask wrote: post #127

Earlier quoted context omitted.

Honestly, that leaves straight up harassment of YouTubers by other YouTubers and fans off the table which by itself would motivate a few of them. Some of the same people who play in the black and grey hat worlds are the same people buying DDOS attacks and swatting streamers. They would have a party with their emails.

Draw up a straw-man business plan for this, with SWAG numbers.

The motivation isn't financial but the impact to some of Google's biggest earners would be significant. Never mind the PR when Mr Beast and SSSniperwolf's personal details leak online.

Re: Leaking the email of any YouTube user for $10k

#136

Post by tptacek »

jeffwask wrote: post #135
tptacek wrote: post #132

Earlier quoted context omitted.

Draw up a straw-man business plan for this, with SWAG numbers.

The motivation isn't financial but the impact to some of Google's biggest earners would be significant. Never mind the PR when Mr Beast and SSSniperwolf's personal details leak online.

You mean, "mrbeastcompanyofficial@gmail.com"?

Re: Leaking the email of any YouTube user for $10k

#137

Post by thomassmith65 »

andy81 wrote: post #39
doctorhandshake wrote: post #16

Is it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast? EDIT: oh I see .. DD/MM/YY is a new one to me

Exactly the reason that you should always use yyyy-mm-dd.

yyyy-mm-dd is the most sensible, yes. For one thing, it sorts properly.

Re: Leaking the email of any YouTube user for $10k

#138

Post by blagie »

tptacek wrote: post #121
blagie wrote: post #113

Earlier quoted context omitted.

> not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey mark…

If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.

Please read my posts more carefully. Virtually every response is non-responsive to what I wrote:

I wrote: "unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal"

You wrote: "If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking"

That's the exact same thing.

You, likewise, didn't notice I was advocating for new statutes in a post above.

Re: Leaking the email of any YouTube user for $10k

#139

Post by tptacek »

blagie wrote: post #133
tptacek wrote: post #118

Earlier quoted context omitted.

Google pays a piece rate. They pay the rate the market will bear, unless you impress them, like these people did, and then they pay a bit more. They do not compensate you for your working hours. Google is not going to pay you $200 if they leak your email address. Google pays as much attention to security as Apple does. If you want a world in which these kinds of security bugs create multimillion-dollar liabilities, y…

I am very much advocating for new statutes. That's precisely what my post was doing. Companies should not be allowed to externalize costs of bad security on users. I disagree with the claim that "only companies like Google will be able to afford to operate in that world." That's not how markets work. 1) The impact would be that frameworks would develop with better security. This would result in a slowdown of software…

Well, as long as we agree that none of this is how the world works right now, I don't think we have to litigate this.

Re: Leaking the email of any YouTube user for $10k

#140

Post by ant6n »

blagie wrote: post #49
fnordian_slip wrote: post #13

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation:…

I wonder where I could get 10K for a week of work. That'd be a nice a vacation supplement. ㋡
Post reply on HN