Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

61–70 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#61

Post by tetha »

matsemann wrote: post #41
Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

Ah, so it's like a two stage rocket, this turns a small exploit into a humongous one?

Or an escape room, indeed.

Once you're thinking along the lines of "Alright, if I had some order of flags, I could solve that thing over there. If I knew some kind of weights, I could solve that over there. And if I could find a light bulb I could deal with that over there", you're kinda in the mindset of finding an exploitation chain.

It's just that in the security world, it's more about bad memory accesses, confusing programs into doing the right actions with wrong files, file permissions being weird and such.

Re: The Chrome VRP Panel has decided to award $250k for this report

#62

Post by postflopclarity »

MrGilbert wrote: post #26
bapak wrote: post #15

Earlier quoted context omitted.

What's your suggestion exactly? Making anyone who can find a bug a millionaire? That's ridiculous. 250k is already insanely high. You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

> You make a bunch money too, should you pay $100 for that taco? It's nothing to you. Looking at my yearly net income, paying 100$ for a single taco in a year would mean that 0.26% of my net income would go into a taco. Paying 0.1$ for a single taco would make it 0.00026%. According to the consensus in this comment section, that would be pretty gracious. Yes, that's where I'm going with this. //Edit: Thanks at postfl…

so you make $5 million / year but you're still incredulous at

> It's wild how much money big corporations have. ?

Re: The Chrome VRP Panel has decided to award $250k for this report

#63

Post by bravesoul2 »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Not really tax free lol! In both cases you arent getting withholding so you need to declare it.

Re: The Chrome VRP Panel has decided to award $250k for this report

#64

Post by bravesoul2 »

andersa wrote: post #59
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.

That is why money laundering exists.

Re: The Chrome VRP Panel has decided to award $250k for this report

#65

Post by camdroidw »

dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

* Compare income * Compare market share * Compare market share normalised by likelihood of attack yielding benefit, in short-- fx users would be power users probably more likely to have other ways to mitigate an attack

* Or basically just compare black market prices which already taken the above 3 into account

Re: The Chrome VRP Panel has decided to award $250k for this report

#66

Post by mrheosuper »

andersa wrote: post #59
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.

not if millions of dollars is bitcoin

Re: The Chrome VRP Panel has decided to award $250k for this report

#67

Post by mike_hearn »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax twice.

Getting paid in cryptocurrency isn't necessarily a dodge either because even if you claim you mined it or something, the authorities have got wise to this a while ago IIUC and will expect to see evidence to back that claim up too.

Re: The Chrome VRP Panel has decided to award $250k for this report

#68

Post by ang_cire »

MrGilbert wrote: post #23
brabel wrote: post #9

Earlier quoted context omitted.

How much Alphabet makes is almost irrelevant. The incentive here should be for security researchers. As long as there's enough incentive for security researchers to continue to report the bugs they find (which must be balanced against the potential payment a criminal could get if exploiting the bug, which is not directly correlated to the company's income either, at least not necessarily), the payment is appropriate.

> How much Alphabet makes is almost irrelevant. While I embrace the downvotes, I disagree. From my pov, the amount of money paid should factor in the anticipated risk for your business. If a privilege escalation means that Google takes a massive hit in Ad Revenue, than this should be factored in.

> the amount of money paid should factor in the anticipated risk for your business. If a privilege escalation means that Google takes a massive hit in Ad Revenue, than this should be factored in.

Given this exploit, that would probably lower the payout. There are absolutely tons more sandbox escapes in Chromium engine right now (here's a fun list of previous ones, none of which cost them ad rev[1]), and they're not adversely affecting Google's ad revenue. No company is pulling ads because Chrome has a vuln.

This wouldn't even be the kind of reputational hit that something like SolarWinds was.

[1]: https://github.com/allpaca/chrome-sbx-db

Re: The Chrome VRP Panel has decided to award $250k for this report

#69

Post by camdroidw »

OutOfHere wrote: post #30

It is unfortunate that there is no web browser in a memory safe language. As I understand, both Chromium and Firefox use C++, although Firefox partly uses Rust. This has put billions of people at risk.

Servo project is active and probably usable in a year or two (but as others have said this bug is different)

Re: The Chrome VRP Panel has decided to award $250k for this report

#70

Post by TheDong »

bapak wrote: post #15
MrGilbert wrote: post #8

"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…

What's your suggestion exactly? Making anyone who can find a bug a millionaire? That's ridiculous. 250k is already insanely high. You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

Yeah, assuming the people working at the taco shop aren't very well off the taco should cost $100 for a software engineer, $80M for Jeffrey Bezos, and $4 for someone down on their luck.

If we wanted, we could make this more efficient by giving out free healthcare and housing to people, proportional to their need, and tax $95 from the software engineer, $80M from Bezos, and $0 from someone down on their luck.

Progressive Tacos does sound better than Progressive taxation, and it would probably work better because rich people dodge taxes all the time, but come on, who doesn't want to eat tacos?

We (software engineers) won't have proper empathy for the poor until we go into an apple store and the price tag on the iPhone is "20% of your net worth".

Post reply on HN