After reading the article top to bottom I still had to come to the comments to find out what the "for $10,000" was about. It's the payout for a bug bounty.
Same. Oddly worded title.
Leaking the email of any YouTube user for $10k
161–170 of 487 posts
Re: Leaking the email of any YouTube user for $10k
#162Earlier quoted context omitted.
Day-Month-Year is the standard everywhere in the world apart from the US. Big and little endian dates are the only way that makes sense I think. Doing it the US way where day is inexplicably between year and month just feels corrupted to my mind.
> Day-Month-Year is the standard everywhere in the world apart from the US Nope, the standards are day.month.year, year-month-day, or month/day/year. The problem happens when the delimiter doesn't match the ordering.
Using / as the delimiter with day/month/year is also very common. Here in Brazil, dd/mm/yyyy (or sometimes dd/mm/yy, which used to be more common before year 2000) is the standard.
Re: Leaking the email of any YouTube user for $10k
#163Earlier quoted context omitted.
The back of an envelope can get you making silly claims quickly (ex. 26 ^ 8 is 208 billion)
I think you might be off by a factor of 10. Alphanumeric would be at least 36 characters, which would imply 2.8 trillion combininations (36 ^ 8).
yeah, I was doing the charitable as possible version
Re: Leaking the email of any YouTube user for $10k
#164Earlier quoted context omitted.
$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation:…
It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; no…
Interestingly enough there is already a brute-force way exploiters have been doxxing YouTubers: bots comment random name combinations to a channel, check if it is posted, then immediately delete the comment. If the comment didn't appear, either of those names is on the blocklist and is probably the YouTuber's name or related to it. Same goes for addresses.
Re: Leaking the email of any YouTube user for $10k
#165Earlier quoted context omitted.
> Exploits need to plug into a business plan Or, you know, develop a new "business plan" around an exploit.
Nobody does this. It would be an insane proposition. The vulnerability is going to die very shortly into your attempt to capitalize on it. Businesses have startup costs they have to pay off.
Wouldn't that require, if true, that new revenue streams around exploits aren't generally pursued? It seems like new scams, and variations on old ones around new methods, come about on a somewhat regular basis. And as with any business, there is going to be some speculative work around new "product offerings", so to speak. I'm with you on the idea that they are less valuable, as 'spec work, than something that enhances existing revenue streams in a more predictable way.
Re: Leaking the email of any YouTube user for $10k
#166Earlier quoted context omitted.
>Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no. Absolutely, yes. Spam and targeted phishing attacks are in high demand. My understanding is that it is possible to retrieve every public youtube channel ID, if not also Google Maps/Play reviewers, quite easily. This exploit could have been used to create a massive near-complete database of every Google accou…
And then what? Exploits need to plug into a business plan. Like any business plan there has to be somewhere that money gets extracted and that money needs to be more than the exploit cost & infrastructure costs & a risk premium. If you can’t trivially say how the exploit explicitly gets turned into cash you probably are on the wrong track. Doubly so if it’s not a known standard and commoditized way that’s happened be…
It can get turned into cash by the EU when Google gets a massive fine for leaking private data.
Re: Leaking the email of any YouTube user for $10k
#167Earlier quoted context omitted.
> Exploits need to plug into a business plan Or, you know, develop a new "business plan" around an exploit.
Nobody does this. It would be an insane proposition. The vulnerability is going to die very shortly into your attempt to capitalize on it. Businesses have startup costs they have to pay off.
>Nobody does that.
Sure: https://www.abc.net.au/news/2016-07-01/league-of-legends-que...
Re: Leaking the email of any YouTube user for $10k
#168Earlier quoted context omitted.
They're right: I was talking about the business models at the buyers that these vulnerabilities have to slot into. The point I'm making is: there already has to be an operating business that's doing this for a vulnerability to be salable at all. If there isn't one, you're not selling a vulnerability, you're helping plan a heist.
Right, I'm only responding to the last part where they imply to these researchers are not well paid. I'm saying that on an hourly basis or monthly basis $10k a vulnerability is actually quite a good payout when you have a surface area as large as Google's to explore and know what you're doing. Their last paragraph shows that they didn't understand your paragraph here: > For people who make their nut finding these kin…
> Their last paragraph shows that they didn't understand
I think I understood. The last paragraph of mine that you cite was speaking of the creator of the bugs, not the discoverer.
The liable party should be investing reasonably towards non-negligence. (Especially in the context of spending billions of dollars each year on oft-misaligned headcount that's creating many of these liabilities.)
I'm not talking about the company optimizing for the minimal amount they think they can get away with paying to try to cover their butt. Nor am I talking about how white/gray-hat researchers adapt viable small businesses to that reality.
Re: Leaking the email of any YouTube user for $10k
#169Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…
[flagged]
Re: Leaking the email of any YouTube user for $10k
#170Earlier quoted context omitted.
>Unmasking Google accounts? Could there be a business there? Sure, maybe. Is there one already? Presumably no. Absolutely, yes. Spam and targeted phishing attacks are in high demand. My understanding is that it is possible to retrieve every public youtube channel ID, if not also Google Maps/Play reviewers, quite easily. This exploit could have been used to create a massive near-complete database of every Google accou…
But then what? Given the number of accounts Google has, odds are that nearly every alphanumeric combo less than 8 or 10 characters plus “@gmail.com” is a google account. This vulnerability gets you other domains, but still not seeing it. Massive databases of email addresses are a dime a dozen. The only angle I can imagine is phishing for high profile creators, and at most this is a “makes it easier” and not a “create…
You could target accounts of users likely to be younger & more susceptible to phishing for passwords-- kids subscribed to channels with younger content. Or other interest-based targeting. It's not quite spear phishing, but still more targeted.