Could this type of vunerability be found using some clever fuzzer?
Finding a $5,000 Google Maps XSS by fiddling with Protobuf
11–20 of 21 posts
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#12Just wondering if anybody from Google asked you to apply for positions there after this?
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#13[deleted]
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#14Could this type of vunerability be found using some clever fuzzer?
A lot of vulnerabilities like this are found with fuzzing. Same with poor encryption schemes. Depends what your definition of clever is but normally fuzzing is an intermediate research step to just see what response you get as you change input to ascertain information of what's going on behind the scenes so you can use a more directed attack later.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#15Just wondering if anybody from Google asked you to apply for positions there after this?
@mar1, I've forwarded your interest in finding a job to our security recruiting lead. We don't have a relevant office in the desired location, but happy to discuss. Feel free to reach out, my email is dierks@google.com.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#16I still think $5,000 is ridiculously low. Lots of research like this fails and it happens you do the work just to be told someone already filled a similar bug before.
It seems to be the market clearing price. Lots of companies think "hey, we offer peanuts and people do all this expensive work for us."
This guy did it to land a job. Hopefully he's done with spec-work like this and his new employer makes sure to negotiate rates ahead of time for security reviews.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#17Very cool! I didn't know that chrome's debug tools were so powerful.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#18Do you always get the bounty ? Or do they sometimes fix the bug and ignore you ?
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#19Well done and well explained.
Great thing to share your thoughts in open-source as well.
I wish you the best with your job research, companies like Advance or Octo would be great places for you in France, based on the skills you showed.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#20I still think $5,000 is ridiculously low. Lots of research like this fails and it happens you do the work just to be told someone already filled a similar bug before.
It seems to be the market clearing price. Lots of companies think "hey, we offer peanuts and people do all this expensive work for us." This guy did it to land a job. Hopefully he's done with spec-work like this and his new employer makes sure to negotiate rates ahead of time for security reviews.
Small bounties may not be extremely effective at getting expensive people to work for peanuts but they are very effective at destroying the underground economy where these bugs used to be shared, traded or sold.
Since there is no honor among thieves every buyer has to assume that any bug they buy will also be sold to other buyers. With even a moderate bug bounty in place it becomes a prisoners dilemma for all parties who know of the bug. The first person to disclose the bug captures the bounty and the remaining parties get shut out.
Since everyone in the market has to assume that everyone else is cheating the market collapses. Microsoft has a paper on the economic incentives of the underground economy that covers the topic nicely:
https://www.microsoft.com/en-us/research/publication/nobody-...