Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Increasing Google and Alphabet VRP rewards

bughunters.google.com

Post reply on HN
Print view View original

11–20 of 102 posts

Re: Increasing Google and Alphabet VRP rewards

#11

Post by 0cf8612b2e1e »

byearthithatius wrote: post #4
laweijfmvo wrote: post #3

> A logic flaw leading to an accounts.google.com @gmail.com account takeover ($50,000 * 1.5) = $75,000 Should be $10m honestly.

Right, with something that powerful I would just sell the 0-day to highest bidder. Or even use it to commit some fraud. Taking over any @gmail account is a pretty powerful exploit that could lead to a lot of monetary compensation if used correctly. Scary Google only see's that is being worth 75k (way less than one year engineering salary) Not actually, I am not a law breaker;)

What is the legality of selling an exploit? Are you free and clear, or can you be tagged with enabling a future crime? Would they need to be able to trace a specific incident back to your exploit or get you on a catch-all law?

Bugs are found all the time. Sharing a bug you found is not a crime, but I imagine they can always get you on tax fraud.

Re: Increasing Google and Alphabet VRP rewards

#12

Post by borski »

lallysingh wrote: post #10
borski wrote: post #6

Earlier quoted context omitted.

They pay much less than selling the equivalent vulnerabilities to unnamed entities (there are brokers for it). But, and this is the important part, in this case there is zero moral quandary, whereas when selling an 0day there is a significant moral question depending on who you’re selling to. Some people do make it their full time gig, but it’s fairly unpredictable is the issue; much like “gig work,” you’re not guara…

Fair enough, but do people claim them after finding them by accident? Or do people see a bounty and then put in up to X hours of effort (before either succeeding or giving up)? Does that model end up with a reasonable hourly rate? I'm trying to figure out the labor-side economics of this. Generally the supply side is getting a massive discount on these vulnerabilities compared to their potential costs. Although perha…

Both. And the issue about trying to relate it to an hourly rate is the immense unpredictability. Some months (and some companies) may have a lot of vulns in a new product and it’s open season for a bit, but then it slows down, and you’re constantly hunting for new bounties.

It’s not entirely unlike a proper consulting gig, where half your time is spent doing the job, and half your time is spent building a pipeline of future work.

Re: Increasing Google and Alphabet VRP rewards

#13

Post by 0cf8612b2e1e »

lallysingh wrote: post #10
borski wrote: post #6

Earlier quoted context omitted.

They pay much less than selling the equivalent vulnerabilities to unnamed entities (there are brokers for it). But, and this is the important part, in this case there is zero moral quandary, whereas when selling an 0day there is a significant moral question depending on who you’re selling to. Some people do make it their full time gig, but it’s fairly unpredictable is the issue; much like “gig work,” you’re not guara…

Fair enough, but do people claim them after finding them by accident? Or do people see a bounty and then put in up to X hours of effort (before either succeeding or giving up)? Does that model end up with a reasonable hourly rate? I'm trying to figure out the labor-side economics of this. Generally the supply side is getting a massive discount on these vulnerabilities compared to their potential costs. Although perha…

Only economical way is to collect a salary from the NSA while hunting for the exploits. Otherwise seems too much of a lottery on both discovering a valuable exploit and getting a sufficient payout.

Re: Increasing Google and Alphabet VRP rewards

#14

Post by doe_eyes »

borski wrote: post #6
lallysingh wrote: post #2

Question for the hackers: how much effort goes into solving these bounties, and are they monetarily worth the time? I'm wondering if bounty programs effectively form a low-paid gig economy for programmers.

They pay much less than selling the equivalent vulnerabilities to unnamed entities (there are brokers for it). But, and this is the important part, in this case there is zero moral quandary, whereas when selling an 0day there is a significant moral question depending on who you’re selling to. Some people do make it their full time gig, but it’s fairly unpredictable is the issue; much like “gig work,” you’re not guara…

It's also easier than "gray market" sales. Bug bounties pay for a wider variety of bugs, including plenty of stuff that's of no interest to your perhaps-Saudi buyers; and they don't require you to develop a weaponized exploit - "hey, I noticed this crashes" is often enough.

Plus, less risk of waking up and finding out you've been sanctioned by OFAC or something like that.

Re: Increasing Google and Alphabet VRP rewards

#15

Post by doe_eyes »

byearthithatius wrote: post #5
lallysingh wrote: post #2

Question for the hackers: how much effort goes into solving these bounties, and are they monetarily worth the time? I'm wondering if bounty programs effectively form a low-paid gig economy for programmers.

> I'm wondering if bounty programs effectively form a low-paid gig economy for programmers. Most certainly, or those who can't get jobs because of their record but know how to code.

There's a lot of participation from India and other lower-income countries. Not a bad thing - it keeps a fair number of talented school-age kids gainfully employed, and it's a lot more dignified than being paid peanuts for solving captchas.

Re: Increasing Google and Alphabet VRP rewards

#16

Post by bkallus »

lallysingh wrote: post #2

Question for the hackers: how much effort goes into solving these bounties, and are they monetarily worth the time? I'm wondering if bounty programs effectively form a low-paid gig economy for programmers.

My experience participating in Google's program has been pretty good. The reward money is a nice supplement to my grad student stipend. I got a free trip to DEFCON out of it, too.

Re: Increasing Google and Alphabet VRP rewards

#17

Post by edent »

lallysingh wrote: post #10
borski wrote: post #6

Earlier quoted context omitted.

They pay much less than selling the equivalent vulnerabilities to unnamed entities (there are brokers for it). But, and this is the important part, in this case there is zero moral quandary, whereas when selling an 0day there is a significant moral question depending on who you’re selling to. Some people do make it their full time gig, but it’s fairly unpredictable is the issue; much like “gig work,” you’re not guara…

Fair enough, but do people claim them after finding them by accident? Or do people see a bounty and then put in up to X hours of effort (before either succeeding or giving up)? Does that model end up with a reasonable hourly rate? I'm trying to figure out the labor-side economics of this. Generally the supply side is getting a massive discount on these vulnerabilities compared to their potential costs. Although perha…

Yes. I've claimed a few Bug Bounties after accidentally discovering them. For example https://shkspr.mobi/blog/2021/12/responsible-disclosure-chro...

It is uncertain work. As well as finding the exploit, you've got to write it up in such a way that it is convincing to the people reading it. Then you have to argue with them if they don't accept it. You have to pay currency conversion fees and, depending on where you live, tax on income.

That's a lot of work. But it is significantly easier (I imagine) than selling to the mafia. The bad guys don't have a publicly available schedule of payments. And if they don't pay, you can't complain publicly.

Re: Increasing Google and Alphabet VRP rewards

#18

Post by c4wrd »

zeroCalories wrote: post #8
byearthithatius wrote: post #4

Earlier quoted context omitted.

Right, with something that powerful I would just sell the 0-day to highest bidder. Or even use it to commit some fraud. Taking over any @gmail account is a pretty powerful exploit that could lead to a lot of monetary compensation if used correctly. Scary Google only see's that is being worth 75k (way less than one year engineering salary) Not actually, I am not a law breaker;)

You're both missing the point. Consider this: you're a big tech engineer, would you risk your career and many years in jail for 75k? Of course not. How about 5 million? Maybe you would... Big tech already has a massive problem with insider threats, they don't need to offer some of the most clever programmers in the world(their employees) a massive incentive to screw them over.

The point you are missing is that many of us do not have big tech careers. I am very fortunate to have a big tech career, but before I was hit by a stroke of luck, I was doing gig work paycheck to paycheck barely making ends meet. When you can’t see more than two weeks ahead in time, which you cannot do living paycheck to paycheck, you don’t think about the long term consequences because you are not capable of it. The incentive structure is too strong to sell zero days to any external party for those who have nothing to do all day but try to find exploits.

Re: Increasing Google and Alphabet VRP rewards

#20

Post by doe_eyes »

0cf8612b2e1e wrote: post #11
byearthithatius wrote: post #4

Earlier quoted context omitted.

Right, with something that powerful I would just sell the 0-day to highest bidder. Or even use it to commit some fraud. Taking over any @gmail account is a pretty powerful exploit that could lead to a lot of monetary compensation if used correctly. Scary Google only see's that is being worth 75k (way less than one year engineering salary) Not actually, I am not a law breaker;)

What is the legality of selling an exploit? Are you free and clear, or can you be tagged with enabling a future crime? Would they need to be able to trace a specific incident back to your exploit or get you on a catch-all law? Bugs are found all the time. Sharing a bug you found is not a crime, but I imagine they can always get you on tax fraud.

There's no specific law against selling exploits. The problem is the subsequent crime - and if someone wants to pay you a lot of money for a 0-day in Google, it's hard to come up with an explanation other than that they're about to commit a crime.

So, if you knew or should have known, then feigning ignorance won't save you and you won't ba having a good time.

Post reply on HN