61–70 of 164 posts
Earlier quoted context omitted.
What's an "exploit broker"? Where would you find them? What price would you ask for this vulnerability?
I was referring to companies like Zerodium.
I used to work support for GAE and recognize all of this. This is really impressive, congrats on the great work and huge bounty. Keep it up!
Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
I’m curious why there was no auth required for his calls.
Earlier quoted context omitted.
I was referring to companies like Zerodium.
If you look at Zerodium's FAQ, they explicitly say that they don't buy one-off vulnerabilities like this. Have you found a firm that does?
I'm not quite sure what you're getting at here. If you're trying to point out that I haven't done my homework on this and that I don't have a sufficiently specific/workable plan how to approach it - that is accurate. I don't have exploits to sell.
In my previous comment I already stated the assumption that I made, if you feel it's incorrect, which clearly you do, feel free to correct/fill in whatever you think is missing. I'm not getting into a debate about something with which I don't have in-depth experience with someone who does.
I used to work support for GAE and recognize all of this. This is really impressive, congrats on the great work and huge bounty. Keep it up!
Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...
Earlier quoted context omitted.
If you look at Zerodium's FAQ, they explicitly say that they don't buy one-off vulnerabilities like this. Have you found a firm that does?
I have not and I haven't been looking for one either. I'm not quite sure what you're getting at here. If you're trying to point out that I haven't done my homework on this and that I don't have a sufficiently specific/workable plan how to approach it - that is accurate. I don't have exploits to sell. In my previous comment I already stated the assumption that I made, if you feel it's incorrect, which clearly you do,…
I think a lot of HN'ers believe that there's a market for high-severity bugs of any ilk, when, in reality, there's really only a liquid market for a pretty specific subset of those bugs.
Earlier quoted context omitted.
Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.
XXXX == what types of things? I’m curious why there was no auth required for his calls.
* Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc.
* With the above two things, you know the location of services and every RPC endpoint on them, and all access control configs. You can take your sweet time to audit the 10's of millions of lines of code to find vulnerabilities and get to attack as an authenticated (albeit low privilege) user. A lot of stuff is open to all authenticated internal users.
* For example, you could take down any google service by quitting all the application servers at the same time by calling the right debugging RPC. You'd be caught obviously tho.
Earlier quoted context omitted.
Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market. Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it?…
You don't have to think about it too hard, there's companies that will help you with the transaction. https://www.zerodium.com/
Earlier quoted context omitted.
I have not and I haven't been looking for one either. I'm not quite sure what you're getting at here. If you're trying to point out that I haven't done my homework on this and that I don't have a sufficiently specific/workable plan how to approach it - that is accurate. I don't have exploits to sell. In my previous comment I already stated the assumption that I made, if you feel it's incorrect, which clearly you do,…
Sorry, I'm interested in anyone's response to this, since the HN community reaction to any price paid in a bug bounty by a big company always seems to be "people can make more money on the black market". Rather than recapitulating all the previous debates about why that's not true, I'm interested in seeing someone --- doesn't have to be you --- work their way to an educated guess at a black market price for a bug lik…
Earlier quoted context omitted.
Yes, but I don’t think you find a ton of highly skilled 18 year old software engineers in the US selling RCEs in the black market for $200K, so I’m not sure you find that in Uruguay.
You don't find a ton of people of any age anywhere selling serverside RCEs in individual websites for $200k, or $20k, or --- I will go out on a limb here --- $2k. The $2k limb is shaky because I guess in theory you could buy a GCE RCE for $2k and flip it to Google for their bounty payout, which will probably be at least $3,133.70.