Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google launches new vulnerability reward platform

security.googleblog.com

Post reply on HN
Print view View original

91–100 of 109 posts

Re: Google launches new vulnerability reward platform

#91

Post by thaumasiotes »

newphonnewaccnt wrote: post #86
thaumasiotes wrote: post #72

Earlier quoted context omitted.

How would that work? I publish some 256-bit values. You file a report. I mark you duplicate and tell you a random 256-bit value. What did you learn? The number of reports that eventually become fully public is nearly zero. Most don't become public at all, but of those that do, a lot of content is generally redacted.

The hash input could just be a generic description of the bug, minus any sensitive info, plus some salt. All report hashes would have to go public as soon as the report is accepted. The hash input could go public once the bug goes public, so the duplicate reporters can then finally see proof that the bug had already been reported. In what cases would companies be unable to publish generic descriptions after the bug i…

I can prepare generic descriptions of bugs well in advance, regardless of whether those bugs are known to me or not. That scheme lets me mark everything duplicate if I feel like it.

Re: Google launches new vulnerability reward platform

#92

Post by izacus »

gibba999 wrote: post #41
bsamuels wrote: post #26

Earlier quoted context omitted.

Bug bounty prizes are set to encourage a certain quantity of bugs to be reported. If you offer 10x as much, your triage channels will get overwhelmed and you'll have to deal with a bunch of hostile researchers and development teams who hate your guts because you just blocked their next 2 sprints. If a bug bounty program is effective, then the payouts should trend up slowly over time as your security program becomes m…

As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. Google Docs, Search, and Mail do little in 2021 that I need that they didn't do in 2016. There's a lot more churn than bona fide improvement. Most tech just doesn't change that much. Heck, I'd take an online version of WordPerfect 7 from 1996 if it was trustworthy. That's a quarter-century. There's nothi…

> As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust.

As an enterprise customer of said products, you'd probably switch to the nearest competitor who offers more features and better UX as soon as the "secure" option would lag behind. That's what numbers show.

Re: Google launches new vulnerability reward platform

#93

Post by newphonnewaccnt »

thaumasiotes wrote: post #91
newphonnewaccnt wrote: post #86

Earlier quoted context omitted.

The hash input could just be a generic description of the bug, minus any sensitive info, plus some salt. All report hashes would have to go public as soon as the report is accepted. The hash input could go public once the bug goes public, so the duplicate reporters can then finally see proof that the bug had already been reported. In what cases would companies be unable to publish generic descriptions after the bug i…

I can prepare generic descriptions of bugs well in advance, regardless of whether those bugs are known to me or not. That scheme lets me mark everything duplicate if I feel like it.

It comes down to how much companies are willing to reveal after the fact then. If companies aren't prepared to reveal enough unpredictable detail involved in an exploit after the exploit had been fixed, that's another issue. I think companies like Google would be ok with it though.

Re: Google launches new vulnerability reward platform

#94

Post by gibba999 »

izacus wrote: post #92
gibba999 wrote: post #41

Earlier quoted context omitted.

As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. Google Docs, Search, and Mail do little in 2021 that I need that they didn't do in 2016. There's a lot more churn than bona fide improvement. Most tech just doesn't change that much. Heck, I'd take an online version of WordPerfect 7 from 1996 if it was trustworthy. That's a quarter-century. There's nothi…

> As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. As an enterprise customer of said products, you'd probably switch to the nearest competitor who offers more features and better UX as soon as the "secure" option would lag behind. That's what numbers show.

What numbers?

My experience is the opposite.

Re: Google launches new vulnerability reward platform

#95

Post by remus »

gibba999 wrote: post #41
bsamuels wrote: post #26

Earlier quoted context omitted.

Bug bounty prizes are set to encourage a certain quantity of bugs to be reported. If you offer 10x as much, your triage channels will get overwhelmed and you'll have to deal with a bunch of hostile researchers and development teams who hate your guts because you just blocked their next 2 sprints. If a bug bounty program is effective, then the payouts should trend up slowly over time as your security program becomes m…

As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. Google Docs, Search, and Mail do little in 2021 that I need that they didn't do in 2016. There's a lot more churn than bona fide improvement. Most tech just doesn't change that much. Heck, I'd take an online version of WordPerfect 7 from 1996 if it was trustworthy. That's a quarter-century. There's nothi…

> On the other hand, I strongly distrust Google to maintain my data securely. As far as I can tell, aside from backwards compatibility/legacy reasons, the major reason people use Office 365, for better or worse, are issues like compliance and security.

Out of interest, why do you distrust google to maintain your data securely? Having done no actual research, my impression is that google has a pretty good record when it comes to security (though obviously not perfect).

Re: Google launches new vulnerability reward platform

#96

Post by nwellnhof »

tptacek wrote: post #48
nwellnhof wrote: post #47

Earlier quoted context omitted.

> there is essentially zero upside to screwing over bounty hunters. Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-2021-30560.

I'm not saying you shouldn't feel that way. I'm saying Google has no incentive to actually screw you over; that they have in fact the exact opposite incentive.

I understand your point, but saying that Google has no incentive isn't accurate. There's always an incentive not to pay for bug reports, simply because it results in a short-term gain. Whether it's a good decision in the long run is another question.

It's more helpful to analyze the situation from a game-theoretic standpoint. Bug bounty programs are a typical example of a cooperative game. If someone reports a security issue, they start the game by cooperating. Google can then choose to cooperate by paying a bounty or they can defect by refusing a reward. Like in the classical prisoner's dilemma, both parties can typically maximize their rewards by choosing to cooperate.

My case is a bit special. While I don't know the exact reasons why Google chose not to reward me, it's possible that they thought I would continue to cooperate even after they defected. But like most rational players, I chose to stop cooperating, which ultimately leads to the worst possible outcome.

Re: Google launches new vulnerability reward platform

#97

Post by Mitzi »

tptacek wrote: post #57
smorgusofborg wrote: post #56

Earlier quoted context omitted.

As with any asset that's hard to lock down, if the scrap value is high enough relative to salary of employees then they can't estimate how many phones can be exploited before the next "steal stuff from work" event. As such the NSO Group would end up limiting its clients to fit its pipeline and have trouble buying exploits since most other market participants have a single workforce with a drastically lower rate of lo…

NSO's clients are all organizations with effectively unlimited budgets. That's the premise. Even the shadier companies in NSO's space sell principally to state actors. It's unlikely that Google can drive the price of an exploit past the level that any country can pay for. These are petty cash figures. NSO builds implant technology, so they add some value of their own, but NSO is essentially a middleman in this market…

Okay fair, it's unreasonable to ask Google (who have a limited budget) to 'compete' with the grey market. But isn't then the conclusion to introduce bug bounties with unlimited budgets, e.g. sponsored through the European Union?

It would be interesting to see how high the prices really go - at some point NSO clients might see more efficiency in going for more traditional military means.

Re: Google launches new vulnerability reward platform

#98

Post by thaumasiotes »

newphonnewaccnt wrote: post #93
thaumasiotes wrote: post #91

Earlier quoted context omitted.

I can prepare generic descriptions of bugs well in advance, regardless of whether those bugs are known to me or not. That scheme lets me mark everything duplicate if I feel like it.

It comes down to how much companies are willing to reveal after the fact then. If companies aren't prepared to reveal enough unpredictable detail involved in an exploit after the exploit had been fixed, that's another issue. I think companies like Google would be ok with it though.

You're proposing that they do a lot of work for no benefit. What would they get out of it?

You're also still failing to account for the fact that reports rarely become public. I can refer you, again, to a random number just as easily as I can refer you to the calculated hash of my bespoke summary of an issue that was reported eight years ago.

Re: Google launches new vulnerability reward platform

#99

Post by _kbh_ »

tptacek wrote: post #37
mrRandomGuy wrote: post #29

With rewards this low it's no surprise that people sell bugs and exploits to often shady third party entities.

Nobody is selling XSS bugs to NSO.

with the huge uptake in Electron apps you can probably sell an XSS if you can turn it into a RCE.

Re: Google launches new vulnerability reward platform

#100

Post by gibba999 »

remus wrote: post #95
gibba999 wrote: post #41

Earlier quoted context omitted.

As a customer, I'd be okay with dev teams being blocked for their next 2 sprints if it meant security I can trust. Google Docs, Search, and Mail do little in 2021 that I need that they didn't do in 2016. There's a lot more churn than bona fide improvement. Most tech just doesn't change that much. Heck, I'd take an online version of WordPerfect 7 from 1996 if it was trustworthy. That's a quarter-century. There's nothi…

> On the other hand, I strongly distrust Google to maintain my data securely. As far as I can tell, aside from backwards compatibility/legacy reasons, the major reason people use Office 365, for better or worse, are issues like compliance and security. Out of interest, why do you distrust google to maintain your data securely? Having done no actual research, my impression is that google has a pretty good record when…

* Android loses security updates after a short amount of time, with no notification to the user. Lots of people run insecure devices and have been susceptible to ransomware attacks.

* Chromebooks expire likewise. It does better on notifying users, but many Chromebook users can't afford to upgrade. Google has planned obsolesce to increase sales, but in a particularly security-unfriendly way.

* Google has a long history of withholding security features based on tiered enterprise pricing, especially with regards to Google Workspace / Google Docs. I understand tiered pricing, but having users intentionally be unable to trace back attacks is bad for the internet at large. I know cases where bad actors weren't traced down due to Google charging for basic security features.

... and so on.

I could step through minor issues, and I could give large numbers of them, but that'd be a blog post. That sort of general apathy for user security is omnipresent in Google's culture. Google has an excellent track record in its own corporate security, and is paranoid about IP and internal data. That doesn't translate to my IP and data.

A lot of this comes from looking at customers at statistics. My value to Google are my eyeballs. If my computer is compromised, and I switch vendors, Google's cost is one user's worth of ad revenue, which is a manageable risk. Google doesn't at all care about the security of its customers. Unfortunately, that attitude carries over to the B2B space, not to mention increasing risks to normal Google users.

Post reply on HN