Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking the email of any YouTube user for $10k

brutecat.com

Post reply on HN
Print view View original

201–210 of 487 posts

Re: Leaking the email of any YouTube user for $10k

#201

Post by sgjohnson »

blagie wrote: post #49
fnordian_slip wrote: post #13

Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.

$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation:…

> Zero-click kernel code execution with persistence and kernel PAC bypass

This is what baffles me about Apple's bug bounty program.

> $1,000,000: Zero-click remote chain with full kernel execution and persistence, including kernel PAC bypass, on latest shipping hardware. As an example, you demonstrated a zero-click remote chain with full kernel execution and a PAC/PPL bypass with persistence on the latest iOS device.

This is easily worth significantly more. You don't even need to sell it to the black market, sell it to all the 3 letter agencies in the world.

Re: Leaking the email of any YouTube user for $10k

#202

Post by reaperducer »

Cpoll wrote: post #190
tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

> because $10,000 feels extraordinarily high for a server-side web bug. Am I misunderstanding the bug? In my reading, this bug translates to "a list of the top 1,000 Youtube accounts' email addresses (or as many as you can get until Google detects it and shuts it down)." Why isn't that conceivably worth more than $10,000?

Why isn't that conceivably worth more than $10,000?

As explained by the parent comment, because there isn't a market for it. It's a novelty. Who are you going to sell that exploit to? At this time, nobody. Since Google doesn't have to compete against others for the bug, it pays low.

Re: Leaking the email of any YouTube user for $10k

#203

Post by jeffbee »

aleksiy123 wrote: post #38
ForHackernews wrote: post #30

> That params is nothing more than just base64 encoded protobuf, which is a common encoding format used throughout Google. Pour one out for the google dev in charge of b64 encoding their fancy binary message format so it can be jammed inside a JSON blob. If you want a vision of the future, imagine a boot with "worse is better" imprinted on the sole stomping on an engineer's face, forever.

Internally, it would be a b64 protobuf in a protobuf field. The json part is an automatic conversion.

Why would it be b64 encoded? There's nothing that prevents you from putting an encoded protobuf into a protobuf as `bytes` type. `bytes nestedMessage = 42;` Only delimited message formats like JSON or XML need to encapsulate messages before nesting.

Re: Leaking the email of any YouTube user for $10k

#204

Post by sbarre »

mmsc wrote: post #171
lolinder wrote: post #146

Earlier quoted context omitted.

> This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created. Massive email databases are extremely cheap, often free. For this vulnerability to be worth more than $10k there would have to be something about it being a near-complete library of Google accounts (rather than just another massive mailing list). And that's assuming t…

>Massive email databases are extremely cheap, often free There are different qualities of email databases. "Known real email by Youtube account holders" would be a high value database. Definitely not free. This type of vulnerability is extremely valuable for private investigators, too. "Who uploaded this video which my client is extremely interested in?"

Sure but did you read the rest of the post you're replying to?

That database only exists in theory, based on extrapolation of this vulnerability to billions of individual exploits, and I think we can all agree that Google would detect this activity and shut it down.

Hence, that database might fetch a decent price if it existed, but it doesn't.

Re: Leaking the email of any YouTube user for $10k

#205

Post by iinnPP »

kccqzy wrote: post #189
tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

I hate how this HN thread is mostly about discussing the amount of bounty, but I'm afraid it's only natural. Most commenters here are working in the software industry and they want to normalize extremely high bounties. It's an extra income source for them. They want higher bug bounties much like they want SWEs to be a highly compensated profession. It's only natural for workers to demand higher pay for their own prof…

It isn't always about money, even when that is the stated problem.

The dollar value of a responsible report going up means more responsibility overall and less problem leaks, exploits, etc.

I would be equally happy to see any solution where the end result is increased security and privacy for everyone, even at zero bounty.

The problem being overlooked is that the actual cost of these exploits and bugs is paid by the people who had no say whatsoever in any matter regarding the issue. Any time a company is being "cheap" at the expense of regular people is a bad time, from my perspective.

Google has the power to limit the exposure of the people who use there products (and this isn't always voluntary exposure mind you) and is choosing to profit a teeny tiny bit more instead. At no immediately obvious cost to them, why not?

Re: Leaking the email of any YouTube user for $10k

#206

Post by alt227 »

Cpoll wrote: post #190
tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

> because $10,000 feels extraordinarily high for a server-side web bug. Am I misunderstanding the bug? In my reading, this bug translates to "a list of the top 1,000 Youtube accounts' email addresses (or as many as you can get until Google detects it and shuts it down)." Why isn't that conceivably worth more than $10,000?

> Why isn't that conceivably worth more than $10,000?

If it exposed passwords as well then that would be worth a lot more, but a list of email addresses is not the most valuable of things on its own.

Re: Leaking the email of any YouTube user for $10k

#207

Post by 0xDEAFBEAD »

mmsc wrote: post #171
lolinder wrote: post #146

Earlier quoted context omitted.

> This exploit could have been used to create a massive near-complete database of every Google account has automatically had a Youtube account created. Massive email databases are extremely cheap, often free. For this vulnerability to be worth more than $10k there would have to be something about it being a near-complete library of Google accounts (rather than just another massive mailing list). And that's assuming t…

>Massive email databases are extremely cheap, often free There are different qualities of email databases. "Known real email by Youtube account holders" would be a high value database. Definitely not free. This type of vulnerability is extremely valuable for private investigators, too. "Who uploaded this video which my client is extremely interested in?"

>This type of vulnerability is extremely valuable for private investigators, too. "Who uploaded this video which my client is extremely interested in?"

Would exploiting this vulnerability violate the Computer Fraud and Abuse Act? If so, would a private investigator really want to do that?

Re: Leaking the email of any YouTube user for $10k

#208

Post by rectang »

kccqzy wrote: post #189
tptacek wrote: post #73

Since every 3rd message on this thread (at the time I wrote this) is about how Google underpaid for this bug, some quick basic things about vulnerability valuations: * Valuations for server-side vulnerabilities are low, because vendors don't compete for them. There is effectively no grey market for a server-side vulnerability. It is difficult for a third party to put a price on a bug that Google can kill instantaneou…

I hate how this HN thread is mostly about discussing the amount of bounty, but I'm afraid it's only natural. Most commenters here are working in the software industry and they want to normalize extremely high bounties. It's an extra income source for them. They want higher bug bounties much like they want SWEs to be a highly compensated profession. It's only natural for workers to demand higher pay for their own prof…

When bug bounties are priced low, it also irks those among us who care about security — for the sake of the organizations we work for, for the sake of our end users, and for the sake of the world at large.

Re: Leaking the email of any YouTube user for $10k

#209

Post by 0xDEAFBEAD »

wepple wrote: post #188
portaouflop wrote: post #159

Earlier quoted context omitted.

You are imagining a market that doesn’t exist. First there are only very few gobs/companies that are sketchy enough to do this - and for those a huge number of non-anonymous people exist with huge reach that are very critical for years. If such a market would exist they would assassinate all those first - you don’t need the email if you have the face, voice, and name - since that is not happening they just don’t care…

There’s 100% an active market for this, and I think tptacek is simply wrong on this point (the others are valid) The likes of Cambridge Analytica didn’t go away, they exist and absolutely go hunting for data like this. The ability to map between different identifiers and pieces of content on the internet is central to so many things - why do you think adtech tries to join so many datapoints? Let alone things like inf…

Sure, but do adtech companies buy vulnerabilities in web services to advance their mission? Wouldn't that risk running foul of e.g. the Computer Fraud and Abuse Act?

Re: Leaking the email of any YouTube user for $10k

#210

Post by alt227 »

tsunamifury wrote: post #193
wepple wrote: post #183

Earlier quoted context omitted.

> Threat actors buy vulnerabilities that fit into existing business processes Selling crazy stories to the media is as old as time. This vuln would give you a lookup table from email->YT SELECT * FROM table WHERE email LIKE “%.gov”

And? So what. You can spam them? Come on.

Or spear-phish, with a high degree of accuracy knowing the target.
Post reply on HN