Hacker News Reader

Comment by tptacek | Hacker News Reader

He's 12 years old. He found a stack overflow. In document.write. In Firefox. In 2010. Clearly something has gone wrong with spacetime.

View on HN

This should go in your next hiring post. "Who we're looking for: Somebody with the chops to dig into code that has passed professional inspection and do horrible, horrible things to it. Someone who can find a stack overflow in document.write. Someone like you, because if you can program we will teach you these and other dark arts. The last stack overflow in Firefox was found by a 12 year old. Are you going to let yourself lose to a 12 year old?"

Sidenote: I think I have a guess based on a prior conversation, but for the edification of HNers: $3,000 is how many orders of magnitude below the market worth of that vulnerability?

Assuming it is reliably exploitable and packaged with the exploit, $3,000 is substantially less than what that vulnerability is worth. As with everything, it depends on how aggressively you sell it, and whether you believe in an immortal soul.

I can't tell you exactly how much though because I'm busy tracking down his email address so we can be his 8th grade internship.

publicity for this boy is far more valuable than any money he could make out of this. he doesn't even know what to spend $3,000 on and it doesn't surprise me at all.

I remember when I was a teenager making more than my parents (dot-com boom) and money I was making was just piling up. I had virtually no goals that would require money back then... of course now as I get older, it's exactly the opposite, plenty of goals, no money :)

Everyone has a story about a friend who sold a vuln for X. At least one case though has been documented in an academic paper by a well respected researcher [1]. (That would put the cheque at < 10%)

[1] http://weis2007.econinfosec.org/papers/29.pdf

This is pretty old, in vulnerability-markets terms. The practice has become more mainstream since then.

These stories always make me think of another bug that is unbelievable.

The bug is in Binary Search - one of the most fundamental algorithms in programming. It's been around in a published implementation of Binary Search since 1986, and the implementation of Binary Search for the JDK was broken for 9 years. This bug was only discovered in 2006, when someone's program broke.

If you haven't heard of it, read more here: http://googleresearch.blogspot.com/2006/06/extra-extra-read-...

Quick Summary - to get the "middle" element of the array, the line is this: int mid = (low + high) / 2;. This overflows when low + high is larger than MAX_INT, causing havoc.

This is an awesome, awesome post. Thanks for sharing it.

One can only hope that the next generation will find a way to blow whistles into cell phones to get free calls.

But hopefully we won't need them to reboot the earths core.

Awesome Phreaker reference...nice

For those who don't know: early phone hackers (phreaks/phreakers) discovered that a 2600hz tone would indicate a trunk was idle, reset and listen for a new call. Since the line was not actually hung up the billing system wouldn't activate leading to free phone calls.

Some people learned to whistle the tone, while others used bird calls, and even a whistle given free by Captain Crunch (the cereal).

http://en.wikipedia.org/wiki/2600_hertz

I remember reading about this in iWoz and thinking "WTF! This is serioualy cool".

I'm actually even quite positive I remember hearing Mitnick wasn't allowed to use the phone in prison for some time because they were concerned he could initiate some sort of military attack by whistling into the phone.

I heard this around the age of 14 though- so it's possible my memory is foggy.

true story: http://news.cnet.com/8301-1009_3-9995253-83.html

Don't think the number of clever kids changed much over the year. It's just much harder to spot them, because everyone and their dog is "doing computers" now.

I don't think the time-warp is so much the clever kid, as the fact that this is a 1970s vulnerability: an exploitable buffer overflow in a print statement. You'd think we would have solved that problem by now!

Reply on news.ycombinator.com