Hacker News Reader

Comment by vmception | Hacker News Reader

The market for random serverside bugs doesn't have to be liquid, it just has to exist

I think you could flip this on White House Market pretty quick and pretty well. Either partner up with someone willing to risk their rep, or just sell 99 cent tutorials for a week and get your rep up. Or resell fullz lol

And then come in with the much larger payload and a few forum posts about it

They only use Monero for payments and PGP signed messaging on White House

View on HN

People on this subthread are talking about how you'll get caught, and maybe there's something to that, but the real reason this won't work is that nobody wants to buy your stupid auth bypass bug in a random line of business application.

If your bug generates OG Instagram accounts, you'll probably find a buyer --- they will be loons who are likely to land you a prison sentence, because that's the general caliber of person who commits felonies to briefly lock up short account names on Instagram, and you'll have absolutely no way of arguing in court that you didn't know exactly what they were going to do. But you'll probably sell it, because there is an existing business process that acquires OG Instagram accounts your bug can slot into.

Nobody has a business process for exploiting access to a stupid internal legal dashboard application. Nobody is going to shell out more than $7000, speculatively, for access to this website.

I disagree. I can imagine tons of parties that would pay good money for access to Facebook's legal admin panel. Without knowing exactly what's in there, one could imagine lawsuit filings, documents and data that have been put aside during a legal hold, C&Ds sent to people doing things Facebook doesn't like, etc. What can you do with this data? Well, probably embarrass Facebook badly by exposing all sorts of confidential discussions. You might be able to pull an invoice scam by harvesting vendor information and sending a bunch of fake invoices to be paid. You might find other unsecured information that allows you to escalate your access. One can only imagine.

Sure, the economic value of the root password to the NAS for Joe's Carwash is quite low but I suspect even the low level systems at high profile companies is worth tons (I'd guess millions) of dollars to the right (wrong people).

You can disagree, but you're wrong. The kinds of people who watch dark marketplaces for exploits are not dreaming of the super interested information they can get off a random backoffice system.

One time, about 15 "bug bounties are a ripoff" threads ago, someone actually made a non-ironic case for a high valuation for logout CSRF bugs. A competing image service could employ it to ruthlessly log users out, degrading service and jacking up their own signups. A logout CSRF. That's the kind of logic we're talking about here.

Nobody buys these kinds of bugs speculatively.

Using PGP signed messaging to do crimes seems like a pretty bad idea. As in, worse than not doing it.

I had to chuckle at your comment (at first glance it does seem foolish), thinking about it a little more however, I realize that there is a good reason to why they do it, and if you are careful enough you can probably evade the negative consequences. I guess you have to know what you are doing.

I mean you would be using a live OS and set up a key on that instance so it’s always a new identity, if you choose not to persist it, that service just doesn’t let you message any other way.

It would be much harder to mix identity with your clearnet pgp, if that’s what you were thinking, as the machines would air airgapped or the other ones simply off if you are using the same computer to boot the live os

Any other configuration is just lazy

1. You can create throwaway PGP keys, it's not like they can definitively identify you 2. You can encrypt messages for target PGP public key(s) without actually signing them

It's a good way to prevent people from snooping on your messages. Why do you think it's a bad idea?

The newer protocols for encrypted messaging like Signal are intentionally less weak than PGP in order to give plausible deniability. Specifically, the other person in the conversation can forge messages from you inside it.

because it works but some people think it getting in criminal hands is too big a price.

If you want to stay whitehat and avoid jail, committing crimes is a bad idea. For criminals, blackmailing is part of their M.O.

There's an international market of brokers for zero days, but this specific vulnerability is less in demand.

I doubt that the information found at Facebook legal team could be used by nation-states (but perhaps I am not thinking creatively enough). I can imagine it being used as leverage by a nefarious nation-state, or informational by anti-trust dept. but it would be thrown out of court (therefore only viable for parallel construction). In the case of leverage the nefarious nation-state would feel the wrath of Facebook and/or US government. A country where Facebook has near zero adoption and already on bad terms with USA while within power vacuum, perhaps. Russia has Vkontakte, North Korea and China don't use Facebook either.

Regarding PGP, you don't have to use your real name. You can use an alias. You can sign each other's keys at a crypto party.

Reply on news.ycombinator.com