Google launches new vulnerability reward platform • Hacker News Board

Re: Google launches new vulnerability reward platform

#21

Post by notatoad » Tue, Jul 27, 2021, 4:28 PM UTC

anonymouswacker wrote: post #14

deckar01 wrote: post #13

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independentl…

Sounds like a full time job vs. a gig.

yeah, these are all features of working on the development team of a project. involving every developer who wants to work on a bounty at that level would be an insane amount of management overhead.

It makes sense if you're vetting people beforehand to make sure that giving them this level of access and communication is worth the effort, but that's what a job interview is.

Re: Google launches new vulnerability reward platform

#22

Post by sirdarckcat » Tue, Jul 27, 2021, 4:29 PM UTC

deckar01 wrote: post #13

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independentl…

about duplicates - google has this thing called grants https://bughunters.google.com/about/rules/5479188746993664 that pay people for doing security research, even if they don't find any bugs. we agree that doing security research is valuable even if no bugs are fixed.

about having access to private bugs, we don't want to share vulnerabilities with others without the researcher's permission, but the original researcher can make bugs public on the new website, you can see some of them here https://bughunters.google.com/report/reports

Re: Google launches new vulnerability reward platform

#23

Post by jackson1442 » Tue, Jul 27, 2021, 4:37 PM UTC

encryptluks2 wrote: post #17

dang wrote: post #2

It's here: https://bughunters.google.com/ . Not sure which is the better top-level URL.

Dang, that is super slow to load on mobile. Seriously takes like 5 seconds.

Yikes, it gets a 19 on Lighthouse for performance on desktop. It gets a 5 for performance on mobile.

Guess it won't be ranked very well on Google Search!

Re: Google launches new vulnerability reward platform

#24

Post by H8crilA » Tue, Jul 27, 2021, 4:40 PM UTC

HenryKissinger wrote: post #18

bostondavidvc wrote: post #11

Whoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards Payouts for security-positive improvements to security-critical OSS projects: * $20,000 for setting up continuous fuzzing with OSS-Fuzz * $10,000 for high-impact improvements that prevent major classes of vulnerabilities but the low end of the scale is kind of neat too: * "$1,337 for submissions of modest com…

They need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.

Not sure why you're downvoted, but the $3M/year total rewards payoff is likely smaller than the corporate administrative and developer time (for review) costs. I.e. if this was a charity it would pay out less than 50 cents on the dollar.

Re: Google launches new vulnerability reward platform

#25

Post by ds » Tue, Jul 27, 2021, 4:43 PM UTC

There must be something I am missing, because I dont understand how underpaid most bug bounty programs are.

If I ran Googles program, I would immediately 10x all payments, unironically. Yes, that means paying 1 million bucks for something you previously paid 100k for. Drop in the bucket. You also get a ton more eyeballs on you, letting you patch everything ASAP.

But they dont do this. I dont know why. Security through obscurity? I suppose that works if you are myspace.com in 2021. Nobody likely gives a shit to try and hack it, but at the end of the day this is still google so that really doesn't apply.

The downside of not paying handsomely is people realize they can make more money selling to third party vendors, (which some do) then every once in a while you get a bad PR story showing that your stuff was hacked and exploited for months/years and it potentially knocks a few points off your stock price.

Money is really the end all be all. If you pay more than third party vendors, I can see almost no reason people would sell to them. At that point, your only adversary's are gov employees of nation states and the staff of companies dedicated to finding vulnerabilities.

Re: Google launches new vulnerability reward platform

#26

Post by bsamuels » Tue, Jul 27, 2021, 4:46 PM UTC

ds wrote: post #25

There must be something I am missing, because I dont understand how underpaid most bug bounty programs are. If I ran Googles program, I would immediately 10x all payments, unironically. Yes, that means paying 1 million bucks for something you previously paid 100k for. Drop in the bucket. You also get a ton more eyeballs on you, letting you patch everything ASAP. But they dont do this. I dont know why. Security throug…

Bug bounty prizes are set to encourage a certain quantity of bugs to be reported.

If you offer 10x as much, your triage channels will get overwhelmed and you'll have to deal with a bunch of hostile researchers and development teams who hate your guts because you just blocked their next 2 sprints.

If a bug bounty program is effective, then the payouts should trend up slowly over time as your security program becomes more efficient and produces more secure code.

It's important to remember that purpose of bug bounty programs is not to reduce the number of bugs in the code base - it is a validation measure to check whether your controls are effective or if additional controls need to be added elsewhere.

Re: Google launches new vulnerability reward platform

#27

Post by deckar01 » Tue, Jul 27, 2021, 4:52 PM UTC

notatoad wrote: post #21

anonymouswacker wrote: post #14

Earlier quoted context omitted.

Sounds like a full time job vs. a gig.

yeah, these are all features of working on the development team of a project. involving every developer who wants to work on a bounty at that level would be an insane amount of management overhead. It makes sense if you're vetting people beforehand to make sure that giving them this level of access and communication is worth the effort, but that's what a job interview is.

Not work on the bug, just be kept in the loop like the initial reporter. Putting in the same effort as the first reporter should earn you the same trust that is afforded to the first reporter.

Re: Google launches new vulnerability reward platform

#28

Post by biryani_chicken » Tue, Jul 27, 2021, 4:52 PM UTC

Trias11 wrote: post #16

bostondavidvc wrote: post #11

Whoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards Payouts for security-positive improvements to security-critical OSS projects: * $20,000 for setting up continuous fuzzing with OSS-Fuzz * $10,000 for high-impact improvements that prevent major classes of vulnerabilities but the low end of the scale is kind of neat too: * "$1,337 for submissions of modest com…

1. Press [Submit] 2. Thank you for your submission, that was already known issue.

Will project maintainers avoid writing issue tickets before sending the patch to this platform?

Re: Google launches new vulnerability reward platform

#29

Post by mrRandomGuy » Tue, Jul 27, 2021, 5:18 PM UTC

With rewards this low it's no surprise that people sell bugs and exploits to often shady third party entities.

Re: Google launches new vulnerability reward platform

#30

Post by stingraycharles » Tue, Jul 27, 2021, 5:39 PM UTC

jcims wrote: post #19

deckar01 wrote: post #13

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independentl…

*Not a Google employee but have worked for a bug bounty* I agree everything you've stated would be desirable, and if there was a strong culture and policy of supporting bounty programs from the CEO on down, this could potentially be achievable. However: dupes - On the bounty side dupes are extremely common and buddies telling buddies about their finds is going to drive fraud up quite a bit. In my triage work I saw ve…

Sounds like the conclusion is that the bounty programs needs to work closer together with the product teams if it wants to be more effective.

Phrased differently, internal organizational challenges should never be a valid reason why a bug is disqualified. It’s completely irrelevant from an outsider’s perspective.