Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

131–140 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#131

Post by lixtra »

debaserab2 wrote: post #115
throwawayjava wrote: post #78

Earlier quoted context omitted.

Examples of "vulnerability" reports I've received: - Dump of CVEs for "Web App X" or "Server X", even though literally zero of them apply to the version that I'm currently running. - Dumps of port scans with warnings like "Running SSH on port 22 is not recommended" and "Server accepts HTTP. Always use HTTPS". I assume there are tools that generate these reports because the reports use decent English but the accompany…

What's the justification for running a host that responds to HTTP and doesn't immediately upgrade to HTTPS? I'm having a hard time imagining a scenario where I manage a web server that is accessible to anonymous people running pen scanners on it that has a justifiable reason for broadcasting port 80.

If you connect remote communities with poor bandwidth http allows a shared cache behind the bandwidth bottleneck. And other caching scenarios.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#132

Post by zulln »

tyingq wrote: post #90
dooglius wrote: post #24

I wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.

I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.

Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done.

It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper site.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#133

Post by lordnacho »

mettamage wrote: post #102
HeavenBanned wrote: post #25

Earlier quoted context omitted.

What's a way to learn security work? Genuinely curious.

I followed a couple of courses at the VU University Amsterdam. I'll tell you what I've learned about security, it gives you a couple of terms to type into a search engine at least. There are 3 courses they give for it: 1) Computer & Network Security 2) Binary and Malware Analysis 3) Hardware Security The lower level it gets, the better they are at it. Each course costs 1200 euro's for non-EU students. I recommend it.…

Is it remote and in English?

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#134

Post by HenryBemis »

thrwawy0001 wrote: post #66
hartator wrote: post #54

Earlier quoted context omitted.

To be on the other side of this, we do received unsolicited but welcomed bug and security reports. Some are legit and we pay bounties even if we don't have an official policy and we are an early startup. Others are just automated reports that people copy and paste. These ones are uninteresting, but these people still think they deserve money. Often more aggressively than the legitimate ones.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

I remember https://sectools.org/tag/vuln-scanners/ for one. There are other software tools that run from your PC and can 'target'/scan a single IP or a range of IPs and they return some generic results. I won't get to the metaspoil discussion/area.

Imho (and sorry to intervene) it is uninsteresting because each of us can and DO run these tools and get the same reports, and since we do care enough, these are low hanging fruits that we have all assessed on day1, and either addressed, or ignored for a valid reason (e.g. on a client site, someone was making noise for a vuln on a system that was a standalone server, disconnected from any network. I understand that security requires that all layers are secure, but we need to use sense and logic before we start yelling 'fire!! fire!!'.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#135

Post by lordnacho »

staticassertion wrote: post #44
crapbone wrote: post #38

Earlier quoted context omitted.

But no one is going to pay $330k to a 17 year old with no experience

Well, they did, right? So that doesn't seem true.

They did because he found a niche where you get paid for results, and there's no pre-vetting.

There's basically no job like this. Any form of pre-vetting, even just a face-to-face, would have excluded him.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#136

Post by HenryBemis »

kiliankoe wrote: post #106
technion wrote: post #81

Earlier quoted context omitted.

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for: - nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list Responding to this sort of…

If I remember correctly VLC regularly receives bug bounty reports declaring it as a security vulnerability that their source code is available...

And for softwares like VLC that have a special place in our hearts ('K-Lite Codec Pack' [1] was my special friend until the moment I discovered VLC many-many years ago), there is or there should be a firewall rule that says Enabled-Block-Any-Any-In&Out.

[1]: https://www.codecguide.com/download_kl.htm

Ps: remember those days that we were looking for codecs for our Windows Players back in the Win95-98-2000-XP days???

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#137

Post by shaftoe »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

When this actually happens, we link the duplicate reports together as proof.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#138

Post by jypepin »

pszndr wrote: post #47
tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

330K USD in San Francisco is much, much less than 300K USD in Buenos Aires

you could probably still make that money working remotely with a sfba company tho

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#139

Post by dooglius »

zulln wrote: post #132
tyingq wrote: post #90

Earlier quoted context omitted.

I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.

Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done. It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper si…

Would it have to understand the difference? You could do pretty well with a crawler that detects such fields (by checking a simple increment, say) that then spits out URL/field combinations. Then you just need to scan through those and follow up on the ones that look like security holes.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#140

Post by Drdrdrq »

WrtCdEvrydy wrote: post #80
kerng wrote: post #71

Earlier quoted context omitted.

It's not, I still have the email exchange from a couple years back - I thought of posting it somewhere because it was so odd, but I dont have a blog and I am not interested in publicity. Amazon still doesn't offer a bug bounty program to my knowledge. Also, it's the only cloud provider my active security researcher friends tell me that attempts to regulate them by some weird pen test authorization requirements which…

> pen test authorization requirements Yes, we don't want people to publicize when we fuck up so we'd rather just NDA them to death when they tell us about bugs. Edit: If you don't accept, we just use the hacking laws in the US to silence you.

This sounds.. awful. I'm sure there are reasons, but hiding information this way makes you seem incompetent and unsure of yourself (you as Amazon, not you personally) in my eyes.

Edit: I assume you are speaking as employee of Amazon of course, which is not necessarily true.

Post reply on HN