[deleted]
Shopify has paid over $300k in security exploit bounties
21–30 of 80 posts
Re: Shopify has paid over $300k in security exploit bounties
#22This wasn't unexpected outside of the extend of the bounties. What you have to realize is how important Security is to Shopify. We are a trust based business to an extreme extend. We host the livelihoods of hundreds of thousands of other businesses. If we are down or compromised all of them can't make money ( as some of you saw during Black Friday, to the tune of $300k+ a minute at times ). One of the best ways for u…
So I'd be interested to know your thoughts on bug bounties as against "traditional" security reviews.
Have these areas of your application been through external reviews before being opened up to bug bounty or did you decide to start there?
I was thinking that for the amount you've paid out in bounties you could've engaged a reasonable team for several man-months, so was interested in what led you more down the bug bounty line for this.
Re: Shopify has paid over $300k in security exploit bounties
#23"It looks like your JavaScript is disabled. To use Hacker One, enable JavaScript in your browser and refresh this page." Kinda ironic that a site that is supposedly for hackers wants you to expose yourself to zillion browser vulnerabilities before you can see its content.
Paranoid much?
Re: Shopify has paid over $300k in security exploit bounties
#24Re: Shopify has paid over $300k in security exploit bounties
#25I'm surprised it's so little. 300k is very little compared to the financial burden that a security breach would bring. Talk to Target and Yahoo about cost. If anything they might start looking into way of increasing it.
Re: Shopify has paid over $300k in security exploit bounties
#26about a year's salary for a security-focused engineer. Did they get more or less bang for their buck? I guess we need to ask haquaman how many hours he spent in collecting that $49k (by my count)
Re: Shopify has paid over $300k in security exploit bounties
#27I'm surprised it's so little. 300k is very little compared to the financial burden that a security breach would bring. Talk to Target and Yahoo about cost. If anything they might start looking into way of increasing it.
It's very delicate to talk about financial burden, given the following references:
"Two months after damaging data breach, Target stock has its best day in 5 years" http://blogs.marketwatch.com/behindthestorefront/2014/02/26/...
"Sad reality: It's cheaper to get hacked than build strong IT defenses" http://www.theregister.co.uk/2016/09/23/if_your_company_has_...
"The Cost of Cyberattacks Is Less than You Might Think" https://www.schneier.com/blog/archives/2016/09/the_cost_of_c...
And my take on this topic
"Is it really cheaper to get hacked?" https://dadario.com.br/is-it-really-cheaper-to-get-hacked/
Re: Shopify has paid over $300k in security exploit bounties
#28Earlier quoted context omitted.
With those lower 'underlying project' bugs there are multiple actors who can compensate for vulnerability research, so the market rate goes down. It makes sense to either: lower the payout to reflect market rate or start a seperate scheme for those projects that others can buy into. Unfortunately if you use a seperate scheme you end up paying for bugs that don't affect you. Personally I'd have split my own payouts in…
or send the signal to other less well intentioned parties who see the value of owning vulns to popular underlying libs
I don't know how strong that argument is, yet I suspect not very.
The problem with selling to 'less well intentioned parties' is that they are hard to get a hold of, hard to trust, and time consuming to work with. I very much doubt that many people who sell to them are not already close to them and their ilk. I also see this much like the arms trade, where illegal trading is an intrinsic property of the trader, not a function of the market.
Re: Shopify has paid over $300k in security exploit bounties
#29Shopify seems to basically have given up on application-level sandboxing, and now relies on process-level sandboxing (e.g. seccomp). This is probably wise; the track record of in-language sandboxing is pretty bad (see also: Java applets.)
I was under the impression that JVM, CLR and probably e.g. V8 are reasonably secure. I'd like to learn more about recent sandbox-escaping vulnerabilities in these runtimes. Got any resources?
For JVM, consider this update which happened in 2016:
"Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610)"
Re: Shopify has paid over $300k in security exploit bounties
#30and about $150k is made of only 3 people being rewarded interestingly enough.