41–50 of 85 posts
Earlier quoted context omitted.
This assumes efficient markets which doesn't exist when there is a monopoly on legitimate buyers. The value any one individual puts on a thing does not a market make.
Is it really a amonopoly though if there are multiple companies offering bug bounties? If the whitehat feels he is underpaid he could just go look for bugs for another product.
Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would…
Huh... First result in google for "selling exploits" shows it's not only criminals who are buying exploits:
https://zerodium.com/program.html
(up to $500K for Chrome RCE, but probably not for this since requires extension install)
Another result is the Wikipedia article, which also talks about these gray markets:
"Gray markets buyers include clients from the private sector, governments and brokers who resell vulnerabilities."
Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
> sell these on the black market. How? I always see this mentioned but it seem impractical to me. I've discovered bugs which have paid out a few thousand dollars - big corporates have well publicised schemes, but I've no idea how I would go about selling it to a criminal. Even if I did know where to find them - how would I trust them? Can I tell they're not really the police doing a sting? If they paid me, how would…
Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…
Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
Earlier quoted context omitted.
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal. principles > wild market
He got nothing. No money at all. The CEO pretended to have forgotten every verbal agreement.
You only need to experience that kind of thing once to change your mind.
Earlier quoted context omitted.
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But..
The bug bounty itself is only a drop in the bucket for security companies, as it's a, unsteady and b, not enough to cover even trivial research environment cost.
Pratcially it's a nice monetary and reputation bonus (for having the name associated with the detection) in addition to the regular bussiness of providing baseline security intelligence, solutions and services to enterprises, which is what earns the regular paycheck.
Living from quests and bonties is more the realm of fantasy.
Earlier quoted context omitted.
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
Yea, legitimate with illegitimate is a weird kind of calculation, as the risk with illegitimate market is to end up in jail, and few people want to calculate the monetary value of lost time due to incareration and all the fallout that comes with it. The more interesting question would be, if the bug bounty is enough to keep legitimate researchers engaged to investigate and document the threats. But.. The bug bounty i…
From a speech perspective, if I discovered an exploit and wrote a paper explaining it, what law prevents me from selling that research?
Earlier quoted context omitted.
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.