Hacker News Reader

Comment by mmaunder | Hacker News Reader

Which certainly makes vulnerabilities more interesting.

"Oh you discovered a life threatening vulnerability that affects every car in the deployed fleet of electric vehicles?

Thanks, here's $5k for your hard work as part of our bounty program."

I know this is a joke, but I am unsure if you're pointing it directly at Tesla. To clarify, Tesla does not have a bug bounty program that I was able to find for their car software.

Haha no, I was just poking fun at high profile bug bounty programs like Facebook/Google's which routinely offer pennies for very very serious vulnerabilities.

I'm not in a position to discuss bug bounty ethics or judge what the right thing to do is given the market circumstances, I'm only in a position to make an opportune joke.

But you gotta admit...it is amusing seeing very critical vulnerabilities like ubiquitous user login being reported by researchers whom get 5k or 10k for doing the right thing. These holes could instantly cripple the trust of a company's userbase and yet the people reporting them get pennies.

I'm not seeing what point you are trying to make.

What other option do these researchers have? Try to sell the vuln on the black market (illegal) or to a state actor (unethical and likely illegal)? Keep quiet about what they found and not get any money/recognition?

Companies are under no obligation to pay and researchers are under no obligation (except ethics, I guess) to turn over their findings. By having some non-trivial payment the companies are encouraging people to provide cheap sec audits for them.

> What other option do these researchers have? Try to sell the vuln on the black market (illegal)

That's probably what GP is alluding to. They do have this option and I can imagine they could get much more money this way, with little or no way to trace the source of a 0day back to them.

> Companies are under no obligation to pay and researchers are under no obligation (except ethics, I guess) to turn over their findings. By having some non-trivial payment the companies are encouraging people to provide cheap sec audits for them.

Well, of course. The question is, whether the amount companies chose to pay is enough to get most people to report vulnerabilities instead of selling them elsewhere, or if those companies are just putting a lot of trust in the strong morals of security researchers?

Is it actually illegal to sell information that a particular bug exists and can be exploited? What if it is sold to the company which owns the software? What if it is sold to one's own government?

Yeah, I can attest to that. Found a github page with ssh keys, home directories, infrastructure scripts, configs, etc for Comcast that could've been used to do just about anything within their infrastructure. I raised the issue as ethically as I could, particularly since someone with an "infosec background" already forked it a bit before I found it. The engineers who I got in contact with were hugely appreciative, got the issue fixed almost immediately (seriously, kudos again), and brought up the possibility of starting a bug bounty program with me as a pilot of sorts. Cool, right?

Well, after talking to their CISO, it sounds like no such thing will happen. Her reason was, "It's not actually a 'bug', so it's not going to be included in a bug bounty program". So there goes that idea.

I really don't get it. I could have just as easily sold everything in there for big monies, or could have personally done havoc of my own. There's a certain point where "thanks" just doesn't feel enough, especially after the bug bounty comment.

Look at it this way, you could also have been "rewarded" with a 30-year jail sentence. Please don't mess with big corps.

If bpchaps would mess with Comcast directly then maybe; if he sold the knowledge somewhere else than not really. I don't recall hearing of any case where a hack was traced all the way back to the third party that found and sold the vulnerability.

Well considering it's Comcast, I'd be more then happy to "accidentally" disclose those vulnerabilities.

Yeah, it's one of those companies that are really asking for it. In some cases it's hard to do the ethical thing :).

The thought crossed my mind. ;)

But being able to say "$GOODTHING happened because of me" felt so much better. It just means in the end that 50% of my meals are lentil based :P.

But small corps are OK?

Your attitude is so amazingly fear based - fuck that sauce.

What makes you think I'm actually messing with big corps? I'm not. I disclosed the issue properly and safely. I have a good lawyer who would step in to help if something bad happened. But hell, if something bad did happen, where I can't get out of a sentence like that, then fine. It is what it is.

But letting that fear of 30 years of prison prevent me from disclosing something that could have long term effects for millions? Fuck. That.

I wasn't even doing any of this for money. I found it, I wanted to correct it. That's it. But for their CISO to drop a giant deuce on me like that without as much as a "Thank you" from her? Heh. It's a little annoying.

Have you ever heard of a thing called the "Computer Fraud and Abuse Act"? Even the act of disclosing a vulnerability to the company itself can be misconstrued by paranoid big corps as a "security breach", hence the possibility of a 30 years sentence. I'm just saying it's not worth the risk. At least not in the US.

I'm well aware of what the risks are. It was something from github, so it's not like I was doing anything crazy, anyway. During my disclosure, I told them the kinds of port scans I did, and the types of individuals I shared the information to. As full disclosure as I possibly could have been.

I'd rather not fall into this trap: https://theintercept.com/2016/04/28/new-study-shows-mass-sur...

That isn't possible under the CFAA.

> Your attitude is so amazingly fear based - fuck that sauce.

I really think this part:

> > I really don't get it. I could have just as easily sold everything in there for big monies, or could have personally done havoc of my own.

would have earned you a prison sentence (if caught). The most obvious ways to 'profit' from security bugs for corps with no bug bounties are illegal.

Right. I'm just sharing my experience at this point, though. Can't get caught if I'm not doing anything to get caught. And again, I went through the proper, ethical channels to get this raised.

Well it is "pennies" + public recognition. I am also of the opinion that small bounties are much better than no bounty (cough apple cough)

Tesla does have a bug bounty program: https://bugcrowd.com/tesla

I specified they didn't have one for their car software, but I missed the part of that webpage that does actually list "vehicle" as a potential target. I was thrown off by the "This program is focused on Tesla's public facing web application" statement. So you're correct.

Reply on news.ycombinator.com