Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

51–60 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#51

Post by dsacco »

afpx wrote: post #48
richforrester wrote: post #44

Earlier quoted context omitted.

Sounds like everyone got what they wanted. Also sounds like you were dealing with humans, who (before escalating) followed company protocols. Also seems not too far-fetched that those protocols are in place to weed out the whatever% that make bogus claims. All in all, nothing I'd call "truly sad", "evil" and whatnot. Just big businesses being big businesses.

Curious why you have such high tolerance for this type of behavior, since it appears that you don't actually approve of it.

I can't speak for the parent, but I have a tolerance for it because I've actually managed bug bounty programs; I also know Google receives on the order of 100,000 bug bounty reports annually, while a full order of magnitude less are actually valid.

Re: Google Bug Bounty – The $5k Error Page

#52

Post by dsacco »

mickrussom wrote: post #42

Nice , glad he got paid. Whats truly sad is they did try to chisel him out of his bounty if you read the timeline, he had to prod them to get his bounty. Can any of these top-ten companies that make like 200 million per day (google/alphabet, amazon, microsoft) ever do anything in good faith? One time google stiffed me initially on an RMA with a nexus phone until I stamped my feet a bit complaining that a company that…

I wish I could flag this.

There's invariably one comment like this on bug bounty stories here. One comment that isn't happy with the bug bounty result even when the researcher is and goes off the rails with a weird anti-large company bias and some conspiracy.

This has absolutely nothing to do with your Nexus RMA story, or your cloud SLA story from downthread, or whatever other agenda you have against these large companies.

Do you have any concept of it's like to run a bug bounty at Google's size? Have you ever been involved in managing one? Have you ever participated in one? Can you qualify any of your opinion with something aside from these irrelevant grievances you're throwing out?

You're not contributing to the discussion at all, you're just hijacking the thread so you can perpetuate your soapbox. Human beings make mistakes and bug bounties are an easy place to drop the ball. No one is trying to cheat security researchers out of their rewards.

Re: Google Bug Bounty – The $5k Error Page

#53

Post by Ajedi32 »

dsacco wrote: post #39
Ajedi32 wrote: post #28

Earlier quoted context omitted.

I got a bug bounty once because I reported a bug in Chrome that someone else was complaining about in the comments section of a tech blog. If instead of just complaining that commenter had taken the time to fill out a bug report they could have easily gotten the bounty instead. Sometimes it just takes a tiny bit of extra effort to go from noticing something's amiss to actually doing something to get it fixed.

What was the security issue?

CVE-2015-1274

Basically, Chrome allowed users to use the "Always open files of this type" option with executable files. So if anyone was ever foolish enough to set that option after downloading a `.exe` on Windows, any future site they visited could take over their machine just by initiating a download for a malicious executable.

Re: Google Bug Bounty – The $5k Error Page

#55

Post by i336_ »

carvalho wrote: post #38
ensiferum wrote: post #4

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Ed…

Interesting. What'd you find? :)

Re: Google Bug Bounty – The $5k Error Page

#56

Post by jcims »

daddyo wrote: post #35
jcims wrote: post #33

Earlier quoted context omitted.

Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporte…

What's the general signal to noise ratio for bug reports?

Whoever runs this definitely works in a bug bounty program:

https://twitter.com/cluelesssec

Re: Google Bug Bounty – The $5k Error Page

#57

Post by rachelbythebay »

mh- wrote: post #16
Artemis2 wrote: post #11

Earlier quoted context omitted.

Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.

fairly sure it just stands for "staticfile frontend".. nothing too exciting. edit: some support for that at https://bugs.chromium.org/p/chromium/issues/detail?id=548688... /bns/pe/borg/pe/bns/static-on-bigtable/staticfile.frontend.sffe/93

So if you just want to serve 5 TB... there you go.

Re: Google Bug Bounty – The $5k Error Page

#58

Post by carvalho »

ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

Re: Google Bug Bounty – The $5k Error Page

#59

Post by em3rgent0rdr »

komali2 wrote: post #27
Macuyiko wrote: post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.

If the good people don't do it soon, the bad people will...

Re: Google Bug Bounty – The $5k Error Page

#60

Post by carvalho »

i336_ wrote: post #55
carvalho wrote: post #38

Earlier quoted context omitted.

Depending on the severity of your finding, your report could wake up a senior security engineer. When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report. Ed…

Interesting. What'd you find? :)

Apparently I was part of a test where input sanitization was turned off. Reported and fixed before they could push it live.

Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css.

http://aster.or.jp/conference/icst2017/program/jmicco-keynot...

Post reply on HN