Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

271–280 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#271

Post by bravesoul2 »

drdec wrote: post #222
bravesoul2 wrote: post #173

Earlier quoted context omitted.

Lol. HN the famously "confidently incorrect" forum especially on-coding topics is not my lawyer. And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

The reason you do money laundering is because the source of the funds is illegal. If the source of the funds is legal, just claim it. There are plenty of occupations that get paid in cash and are expected to report it. The IRS isn't referring suspicious (whatever that means) tax returns to the authorities. What happens if you are a criminal is that the authorities have there attention on you because you are doing ill…

Maybe the reason is the other way around. To convincingly wash money you need a legitimate looking shell business. And it needs to pay tax for the reason any other bsmusiness does.

Re: The Chrome VRP Panel has decided to award $250k for this report

#272

Post by gosub100 »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

I can't answer your question, but one of the ways trust works is you share the vuln with an escrow person, which I think is someone on the forum with very high rep. They take the vuln from you, confirm it works, and ensure that you get paid from the end buyer.

Re: The Chrome VRP Panel has decided to award $250k for this report

#273

Post by gosub100 »

tantalor wrote: post #229
jacquesm wrote: post #200

Earlier quoted context omitted.

Up to here you weren't committing any crimes. > but you'll also have to come up with a fake but auditable story of where it came from And now you did.

Sorry, do you mean the comment was describing hypothetical crimes, or literally the comment itself was criminal?

Lying to government officials is a crime. Including saying you mined the crypto instead of getting paid for selling a vuln

Re: The Chrome VRP Panel has decided to award $250k for this report

#274

Post by hu3 »

lesuorac wrote: post #263
mavhc wrote: post #233

Earlier quoted context omitted.

But you're then left with owning something probably worth more than you paid in total

It's not. Buy-vs-rent is nearly always monetarily in favor of rent. 250k down payment is ~20% of 1.3 million which at ~6.5% comes out to you paying ~2.4 million. This doesn't include maintenance, insurance, or taxes. I have a bunch of calculators in this post ( https://news.ycombinator.com/item?id=44794529 ) but that thread also has a lot of other people explaining the same thing.

Exactly. Buy is more of a peace-of-mind than financial decision.

Re: The Chrome VRP Panel has decided to award $250k for this report

#275

Post by yodabo »

matsemann wrote: post #34

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this? I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

It looks like the bug is that there is a way for the renderer (sandboxed) process to trigger the browser (unsandboxed) process to duplicate an arbitrary windows kernel object handle. When you duplicate a handle, you can restrict access, or allow the duplicate to have full access as the original - unfortunately this one is duplicating preserving all the capabilities/access of the original handle.

Now for the POC exploit - it so happens that 0x108 is typically a thread handle for a thread in the browser process. What can you do with a thread handle? You can pause execution of that thread, set its register values (including instruction pointer), resume execution.

If kernel32.dll loads at the same address in each process, we can find some set of instructions in it that write a register's value to another register's address. If we set the instruction pointer to that instruction, we've unlocked the ability to write arbitrary memory in the unsandboxed process.

Finally, we can call other Windows APIs (by finding the address of the function to call and setting instruction pointer to it)- in the POC, they write "calc.exe" to a string, then call the system api to launch calculator.

Re: The Chrome VRP Panel has decided to award $250k for this report

#276

Post by gambiting »

socalgal2 wrote: post #267
gambiting wrote: post #100

Earlier quoted context omitted.

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

You live in Poland? Country or City? Google estimated a 60 square meter 2br condo in Warsaw costs an average of $260k. So a $240k bonus, after paying taxes, leaves you with $145 in Poland, so no, you could not likely get a condo in Warsaw with a $240k bonus. I'm sure if you live well outside a major city that changes. And, the bigger point is, even if you could afford a house, is that life changing? Would your life s…

Why pick Warsaw? It's like using London as an example when someone lives in the UK - it's not representative of a country. I'm from the South of Poland, 145k after taxes gets you a big house with plenty of land, not a condo.

>>Buying an apartment but having my life remain the same, same job, same hours, same activities, is not "life changing" to me.

That's a weird definition,most people would consider not having to worry about housing pretty life changing. But you know, you're free to have any definition you want. "Having enough money to retire and not work" isn't the goal for all of us. I'd rather keep working and making more money, but not having to worry about a mortgage would be pretty life changing(for me).

Re: The Chrome VRP Panel has decided to award $250k for this report

#277

Post by barkingcat »

edent wrote: post #106
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…

The black market is "if you have to ask then you are already not qualified"

unless you are an agent posing questions to get people to sink themselves.

Re: The Chrome VRP Panel has decided to award $250k for this report

#278

Post by socalgal2 »

gambiting wrote: post #276
socalgal2 wrote: post #267

Earlier quoted context omitted.

You live in Poland? Country or City? Google estimated a 60 square meter 2br condo in Warsaw costs an average of $260k. So a $240k bonus, after paying taxes, leaves you with $145 in Poland, so no, you could not likely get a condo in Warsaw with a $240k bonus. I'm sure if you live well outside a major city that changes. And, the bigger point is, even if you could afford a house, is that life changing? Would your life s…

Why pick Warsaw? It's like using London as an example when someone lives in the UK - it's not representative of a country. I'm from the South of Poland, 145k after taxes gets you a big house with plenty of land, not a condo. >>Buying an apartment but having my life remain the same, same job, same hours, same activities, is not "life changing" to me. That's a weird definition,most people would consider not having to w…

Owning a house does not mean you stop worrying about housing. Property taxes, maintenance, insurance, HOA fees etc add up to rent.

Re: The Chrome VRP Panel has decided to award $250k for this report

#279

Post by gambiting »

socalgal2 wrote: post #278
gambiting wrote: post #276

Earlier quoted context omitted.

Why pick Warsaw? It's like using London as an example when someone lives in the UK - it's not representative of a country. I'm from the South of Poland, 145k after taxes gets you a big house with plenty of land, not a condo. >>Buying an apartment but having my life remain the same, same job, same hours, same activities, is not "life changing" to me. That's a weird definition,most people would consider not having to w…

Owning a house does not mean you stop worrying about housing. Property taxes, maintenance, insurance, HOA fees etc add up to rent.

I feel like we're just going to keep moving goalposts further and further and further. Home ownership is the dream of a lot of people - being able to buy a house outright or just put a deposit down is life changing for some people. I assume for a lot of people on HN it really is that 150k is nice but not life changing - I appreciate that there are a lot of very well paid people here.

As for worry about housing - when renting the landlord can kick you out almost at any time - you live in a constant fear that due to someone's whim you might have to move. If you own a house(even with a mortgage) that is generally lot less likely to happen. But honestly, I don't know why I'm explaining this.

Re: The Chrome VRP Panel has decided to award $250k for this report

#280

Post by rvz »

perching_aix wrote: post #60
rvz wrote: post #42

Earlier quoted context omitted.

Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.

Really doesn't tell me piss all, as I'm not privy to their respective overall cash flow. Are you, considering you say it does for you? Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously, by the way? Sounds a bit backwards to me.

What I call backwards is Mozilla paying their executives multi-millions of dollars for failure and the decline of Firefox.

Maybe had they ran the company competently, they could to afford to pay their engineers and offer larger bounties instead.

> Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously.

Many such researchers would rather sell their 0day to the black market if the effort + price offered is too low and not worth it. It is up to the vendor (Mozilla) to set a fair price to prevent that exploit from reaching the black market for a much higher price.

So given all the above, Mozilla is not serious.

Post reply on HN