Hacker News Reader

I've started handling the security inbox at Buffer now and we use a normal email approach. I can honestly say that the experience is pretty much the same and I feel like the issues you describe are independent of Hackerone (perhaps the scale increases?).

From my end, there are a lot of trivial things I have to go through where it's low effort on the researcher end (And I've even had automated searches where the researcher has sent mails to us assuming we'd have the same issue because of some similar HTTP Header or something similar). Thankfully I've gotten faster at keeping these out but it still takes up more time than needed.

From the researcher end, I assume it's frustrating where they put in the effort to craft a well documented mail and I have to inform them that it's a duplicate or known issue that we are currently working on a fix for. It's a hard call and I'll often have to use a judgement call on these. But it's made harder still when I'll suddenly see an issue that has existed for a long time be reported by a single researcher. And then in a matter of two days 3 to 4 other researchers will pop up with the exact same issue leading me to believe that either there's different accounts under the same name, or some kind of researcher group that works together in sharing findings (And maybe bounty).

Basically, I'm not sure how much this is a HackerOne issue vs a general bounty program pain ¯\_(ツ)_/¯

As a bug bounty hunter, I can attest to having an awful experience at times. The three companies I have worked with @ HackerOne have all taken forever to payout or fix bugs. Currently, I have been waiting 4 months to be paid by a company on HackerOne, for a pretty dang high impact bug that leaves all their customers vulnerable; I checked today, & they still haven't fixed it, let alone paid out.

You also have to be aware of policy changes. I've noticed companies remove language that told how much they'd pay out. Some companies have a mandatory pay out of 7-14 days but they are rare; with everyone else, you just have to hope they pay you, and they do, I guess... whenever they feel like it.

> you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”.

Yes. I would say 2/3 of my reports were resolved this way. Sadly I can't fault either HackerOne of the company -- I don't see a viable alternative.

One alternative is to allow a report without full documentation and a PoC. If it’s a dupe, mark it as a dupe, otherwise ask for the full writeup.

As for the problem of spammy submissions: charge a small nominal fee of $10 or so to submit, with a full refund if it’s a legit issue (even if it’s a duplicate).

Isn't that a potential information leak, though? A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes.

Maybe that's a little farfetched, though.

Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days.

Not a perfect fix, but I think it helps.

>Mozilla just recently changed their program to divide bounty amongst submissions of same vuln within 3 days.

One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money.

It's not a major likelihood, unless the bounties are numerous or especially large.

>A potential black-hat attacker could sit around and brainstorm a big list of potential vulnerabilities without going through to figure out if they exist and are exploitable. Then they can start submitting them, and if they get closed as duplicate, they can quickly dive into that one, figure out how to exploit it, and make use of it for nefarious purposes.

So long as there is a big of lag before confirmation (which, in practice, there already is), the vendor would know about the issue at least several days in advance of the black-hat even getting a hint and could hopefully patch it in that time.

For especially big holes, just take a bit longer than usual to get back to people until it's fixed.

No it's exactly the sort of thought process people have.

Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.

Honestly, neither of these things would ever happen. It just doesn’t work that way and wouldn’t make sense for them to go about it that way.

if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me.

>if its a dupe then that means you are sitting on unpatched live bug that I found, F you pay me.

The problem is that you can just tell all your friends to file the same bug, and now they have to pay everyone?

If the vulnerability is still there, and you find and report it, you should be paid the bounty regardless of whether or not you were first. This should give companies a further incentive to close the vulnerability as quickly as possible. Isn’t the point supposed to be to discourage black hats from acting on vulnerabilities they find? If only the first person to find the bug is awarded the bounty and all others are told “tough shit” this really doesn’t solve that problem.

As a hacker, I see a very easily exploitable flaw in your proposed solution :)

Sadly, the solution to Sybil attacks is generally either exclusivity or proof-of-work…

Most companies don't do bounties at all (and arguably they shouldn't). The idea that the companies that do are going to 2-3-4x pay the same bounty on a bug collision is unrealistic.

The "fair" thing here is probably to split the bounty among the discoverers, but that's not going to happen either.

If you do that, you're merely trading one grievance for another: "evil company marked my bug as duplicate to avoid paying" for "evil company claimed to have gotten duplicate reports to weasel out of paying the full amount". More people upset, although individually, maybe to a lesser extent.

The core issue is not the reward division algorithm, it's the inherent lack of visibility. One solution here would be to just open all reports after a while, but this creates problems of its own. One is that it gives ammo to people engaging in dishonest or clueless PR. Another is that some researchers don't actually want visibility, because their employers have murky rules around such engagements, or because they have some far-off disclosure timeline in mind (as a part of a presentation at a conference, or whatnot).

How about combining reward splitting with having some way to show a count of recent submissions (no details, just count), so people know before submitting that there is a chance someone else already submitted the issue.

Or a mechanism for companies that use email to register the researchers submissions in HackerOne. The details will be sealed and non-public, with researchers having no way to know it exists unless the company provides a link to it as proof of work. HackerOne thus acts as a kind of notary against accusations from researchers that it wasn’t really a duplicate.

How about dividing among reporters, bounty increases the longer it's not fixed since first report, and those paid must be publicly acknowledged.

Probably also need stiff penalties for insiders who might conspire to notify others of bugs and split the pay out.

Nobody is going to do anything like this. Bug fixes take time to coordinate and deploy, and nobody is going to make themselves and their schedules accountable to some random bug bounty submitter. At the point where you're doing this, you might as well just engage professional pentesters; they don't give a shit when you ship fixes --- you just pay them to find bugs and write them up.

The trouble with your first point is that companies won't go for it; no point in having HackerOne around if no one will use their platform. It's a tricky problem; let's solve it with AI and Blockchain!

Why not divide the payout? The companies paying will pay the same amount, just divided among all the reporters. They already do the work of identifying duplicate reports. Maybe it could be weighted to pay more to the first reporter.

As far as not doing it. At some point critical industries may be have to be regulated to force them to behave responsibly.

Do that and a bad actor would just use multiple accounts to report to take a bigger chunk of the pool

Someone's going to create multiple bank accounts to fight for a bigger slice of the $50 they're contending for on an open redirect finding? This sounds like a concern that is plausible mostly on a message board.

I have multiple bank accounts. And I can get my friends on it.

That sounds like a super good use of your time and I wish you the best of luck.

This sarcasm seems misplaced. How much effort does it take to share the details of a bug with friends? Not to mention that some bounties are much greater than $50.

Particularly when you have a syndicate. You find a bug? Share it with the group, they find one and share it back. Now you have two smaller pieces of the pie that cumulatively are bigger than your initial piece.

And some payouts are 10k, I’ve never even heard of $50 minimums, I thought it’s either $100 or swag.

> Most companies don't do bounties at all (and arguably they shouldn't)

Out of curiosity, why shouldn't they? Is it because they then end up with a lot of garbage/spam submissions to sort through from people hoping to trick the company into paying out a bounty?

Yes, and they're a less time-efficient way to get a serious read-out of application security than a pentest is. A lot of companies run bounties because they think they're "supposed to", but really, no.

Same here. 90% of reports are from folks that didn't bother to read the terms and sending in useless reports. As a researcher, I'd spend days chasing something down just to get $50 for my finding months later.

Wow, that's like a 90% discount from what is presumably the actual going rate. I don't know how you could live in the Bay Area and possibly afford to do this, other than as a sort of beer money game.

I find in BugCrowd that most of these reports that are spammy or useless in nature are from researchers in developing countries and have a limited grasp of the English language.

They simply don't take no for an answer.

HackerOne has people screening reports that don't seem very technical.

They closed one of my reports for being a "denial of service" attack when it was a crash caused by malformed input. I've also heard of others having the same issue.

"a crash caused by malformed input" absolutely does sound like a DoS, though.

Sounds like you have a crash that you think might be exploitable- in that case, consider saying "memory corruption triggered by malformed input" to make it more clear that the crash isn't the point.

We can fix that issue with the title with s/by/via/. Thanks!

As contentious as reporting bugs can be during the development process, while working at the same company as the developers, I'm not at all surprised that ethical disclosure is terrible, especially with a monetary motivation.

> People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days.

sounds these "hackers" have an incentive to be stubborn over non issues

Agreed. There's also a clear incentive for companies offering the bounties to downplay valid bounties.

No, there isn't. Bounty dollars are immaterial to the companies offering them. In fact: the opposite incentive exists. These programs justify themselves by uncovering significant bugs.

When a bug has been submitted, and the company is trying to figure out how much to reward?

The companies that consistently publish their bugs have a good track record of giving appropriate bounties. I don't see a clear incentive for a company that doesn't allow their bugs to be published, to be anything other than stingy. Computer security is a cost center for a business, and the folks managing the bug bounty program have a clear incentive to minimize their costs, while maximizing the bugs found.

I think a potential solution would be increased bug disclosure on platforms like Hackerone. Currently, a company has to agree to disclose the details, and most never do. Openness allows hackers to vote with their feet, and spend more time on the companies that are easier to work with, both in bounties rewarded, and easiness of the reporting process.

I've read this a couple times and don't really follow it. In reality, there is a tacit consensus scale for vulnerabilities by severity; a real XSS, for instance, in a platform where XSS isn't somehow sev:crit like it is on a large social network, is worth "hundreds" of dollars. Most companies have a scale worked out ahead of time. HackerOne will give you advice on scales if you want to take it.

Whatever the scale is, companies have no incentive to avoid paying them, because even at the high end of the scale the amounts are immaterial. Remember, we're talking about H1 bounties here, not the Apple and Google platform bounties, which are totally different animals.

The real risk companies that run bounties face is that their programs won't generate any real bugs at all, but will absorb costs from both the platform and all the nonsense bugs they have to triage. New serious bounties are good news, not bad news, for most bounty programs.

(I've managed several, continuing until recently; before I did, I went around talking to people who ran them to get the lay of the land. I'm pretty confident in my answers here.)

Speaking as a former client of H1: exactly. Our problem was how to get more critical reports to throw money at, not how best to chisel the hackers. We weren’t able to sufficiently motivate hackers to dig into the places we felt deserved better coverage, but would have happily paid for critical bugs in those areas if anyone submitted them.

I agree with the points you made.

The issues I've personally experienced have been with impact, for bugs outside of the very traditional XSS/SQLI/RCE. I've gotten things along the lines of "yes, our _______ is seriously broken, but it's not/barely a security issue," with an explanation that stretches plausibility. Maybe I'm full of crap, maybe they are.

I'm sure those running bounty programs would have all sorts of folks contesting things that aren't actually real bugs. I think the only real good solution is increased visibility on all sides. That way each of our technical arguments can stand on their merits, whoever is full of crap can get called on it, and others looking for bugs can choose where to invest their time (glossing over that solution missing a bunch of thorny implementation details, I'm sure).

I'm not going to name the billion dollar company on HackerOne I have an issue with, but they routinely downplay bug reports, take over 1 year to deal with some of them (if ever). And just recently one report HackerOne screeners closed as being out of scope blew up in their face as it was exploited in the wild, and they only fixed it only after numerous public complaints.

I've heard rumors of people selling exploits for this company on the black market for more money now.

A company can ignore a report, then get the reporter banned on HackerOne if the reporter decides to no longer follow the HackerOne guidelines and publicly discloses a vulnerability. This gives companies an opportunity to turn HackerOne into a black hole where they get to not pay any bounties and simultaneously keep the vulnerability secret.

I don't believe any serious company does this. There are lots more companies running bounties than I could ever talk to, but I can't even fathom how the cost/benefit of this is supposed to work. It's a negligible amount of money, and a non-negligible reputation risk. I find it a lot more likely that the people who feel this happened to them either reported out-of-scope bugs, or collided with someone else.

Is there a feasible way to ask an organization if they're aware of a vulnerability before you put in too much work on it? Can the query be ambiguous enough to avoid a free service rendered?

>“closed: duplicate issue”

cool, posting my PoC on pastebin then

> HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform.

(Tangent) Can anyone recommend a coherent interpretation of that statement?

I know what it means for an individual person to be proud. And I could see an argument for extending that notion to a group of persons if every person in the organization was proud.

But I assume HackerOne has had employees / members come and go over time. And I also assume that some of the past or current members don't share that feeling of pride for this particular milestone.

So the only interpretation I can think of is that the person writing the PR was being sleazily vague. I.e., trying to get the audience to take a sentiment that's only meaningfully applied to individual humans / animals, and getting them to unwittingly apply it to a brand name instead.

Is there a better explanation that eludes me?

Not really sure what you’re getting at here. Without getting into the boilerplate cooperate “we’re helping the world”, it’s a perfectly coherent sentence.

Expressing sentiment on behalf of collectives isn't a new idea from a PR writer, it's an ancient figure of communication.

Idiomatic English might be eluding you.