Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

81–90 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#81

Post by technion »

thrwawy0001 wrote: post #66
hartator wrote: post #54

Earlier quoted context omitted.

To be on the other side of this, we do received unsolicited but welcomed bug and security reports. Some are legit and we pay bounties even if we don't have an official policy and we are an early startup. Others are just automated reports that people copy and paste. These ones are uninteresting, but these people still think they deserve money. Often more aggressively than the legitimate ones.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

I don't run a bug bounty but I do sit on a security@ inbox. I don't believe I've ever seen a report I would want to pay out on even if I could, but if you discount blatant spam (often peddling EV certificates), I've received reports asking about bounties for:

- nginx version disclosed in headers - "Feature-Policy" header missing - DNSSEC not set up on zone - Domain not in HSTS preload list

Responding to this sort of thing with "not a vulnerability" is intensely difficult because the of the potential for a PR backlash about "poor security" from people who just don't know better, particularly when the company is definitely not a tech company.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#83

Post by retsibsi »

lucb1e wrote: post #68
mattigames wrote: post #48

Earlier quoted context omitted.

People don't even conceive the difference, in Buenos Aires you can rent a great house in a great neighborhood for 800 USD per month, in San Fran you get a shared room where other 3 people live for that much -IF even that-. In SF you spend at least 5 dollars going anywhere and going back using public transport, in Buenos aires $2 is more than enough to go the the opposite side of the city and back.

I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…

In the case of housing and transport, it's easy to see why prices can be very different in different parts of the world: cheaper housing basically just means that not as many people (relative to the number of houses available) are willing and able to spend a lot of money to live in that location; transport prices probably differ for a bunch of reasons, but the main point is that there's no reason they should converge, as transport within city X is not a possible substitute for transport within city y.

For other goods, you should be surprised if the price discrepancy is one that you really could exploit for significant profit (after accounting for shipping, import/export restrictions and taxes, and so on) -- but otherwise, I don't think it's a very strange phenomenon. Prices will always be set somewhere in the overlapping region between the cost of production (and distribution, and taxes, minus any subsidies, etc.) and the amount that customers are willing and able to pay. Both of those amounts can vary pretty dramatically from place to place.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#84

Post by drewmol »

shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

Lol, TLDR; If you are a startup break every law, agreement, and regulation you can.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#85

Post by rootsudo »

throwawayjava wrote: post #78
thrwawy0001 wrote: post #66

Earlier quoted context omitted.

Can you elaborate on the automated reports a bit more? What makes them uninteresting?

Examples of "vulnerability" reports I've received: - Dump of CVEs for "Web App X" or "Server X", even though literally zero of them apply to the version that I'm currently running. - Dumps of port scans with warnings like "Running SSH on port 22 is not recommended" and "Server accepts HTTP. Always use HTTPS". I assume there are tools that generate these reports because the reports use decent English but the accompany…

I miss the days when nessus was good enough to justify being cool.

Then again my favorite bug back in the day was veritas backup acting as a reverse shell. I only learned of that by running nessus.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#86

Post by rootsudo »

HeavenBanned wrote: post #25
badfrog wrote: post #18

Earlier quoted context omitted.

> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.

What's a way to learn security work? Genuinely curious.

Ironically, it's being curious on how to break something or how something that is for "A" can be used for "XYZ."

Though what you hear about more often are misconfigurations -- which, are valid, but that's more on execution vs truly finding something wrong.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#87

Post by jussij »

lucb1e wrote: post #68
mattigames wrote: post #48

Earlier quoted context omitted.

People don't even conceive the difference, in Buenos Aires you can rent a great house in a great neighborhood for 800 USD per month, in San Fran you get a shared room where other 3 people live for that much -IF even that-. In SF you spend at least 5 dollars going anywhere and going back using public transport, in Buenos aires $2 is more than enough to go the the opposite side of the city and back.

I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…

Rental housing is a market and just like other markets it can be modelled using the economics described by the demand curve.

The demand curve maps the relationship between supply, demand and price.

It says that for high demand and low supply the price is high, for low demand and high supply the price is low and over time supply, demand and price will find an equilibrium.

So if you consider the housing market, on the supply side you are looking at a constrained resource (i.e. it is constrained by the land available to build).

The demand side will be driven by the numbers of people looking to rent and that will be driven by many other factors like work prospects, quality of life, crime rates etc etc.

So for places like SF there will be great demand for that limited housing which means the price (i.e. the rent) goes up.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#89

Post by diogenescynic »

kerng wrote: post #71
killbrad wrote: post #67

Earlier quoted context omitted.

This is hyperbolic nonsense. Having worked at AWS, I've never encountered a business that is more serious about their security position.

It's not, I still have the email exchange from a couple years back - I thought of posting it somewhere because it was so odd, but I dont have a blog and I am not interested in publicity. Amazon still doesn't offer a bug bounty program to my knowledge. Also, it's the only cloud provider my active security researcher friends tell me that attempts to regulate them by some weird pen test authorization requirements which…

Pretty sure they do: https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-... And: https://aws.amazon.com/security/vulnerability-reporting/

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#90

Post by tyingq »

dooglius wrote: post #24

I wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.

I found this, describing his specialty:

"Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities."

Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...

It certainly sounds like the sort of thing you could automate to a pretty big scale.

Post reply on HN