To the people publishing these exploits and collecting the trivial bounties.
Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded.
Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded.
1. Principle - Some people are raised with really high morals and don't optimize for money. Depending on their own conscience, they wouldn't be able to sleep at night.
2. Obeying the law - Although one can easily make more money by using or selling these exploits, it can be a very dark path to dig yourself in. And depending on where you live the risk for life ruining litigation is very high too.
3. Brand reputation / Brand building / Professionalism - one can see that they can make more money for their own by building a solid portfolio of their achievements, and these bounties are a really strong signal when corporations look for security consulting. It also builds a good reputation which is really hard to build when doing white hat hacking for a living.
Not saying they aren't good people, they are just undervaluing their work.
My point is that there's more to it than just that. Aside from the subjective point 1 in my comment, I think points 2 and 3 are very objective and don't really depend on the pay of the bounty.
If they find the bug and try to sell it on the dark/grey market, you risk litigation. If they are smart they can derive more value from it than just the bounty, although the bounty being bigger would be nice and would encourage more white hat hackers to invest their time on these programs.
That's the most dystopian thing I've heard in a while.
Also left unsaid is that these are products that people's grandparents use. So there is some very white-hat "help the public good" here. Even if it's also to the for-profit benefit of a mega corp. That's an issue for anti-trust courts, not people trying to make the world better (people use these products right now, that's the status quo; either it can be fixed now, or it can be part of a likely ineffectual protest that only harms others).
> trying to make the world better
Indicating that Google the company doesn't care about such things
(Although most individuals working there do)
Wouldn't it be immoral if not straight up illegal?
Should it be illegal? Yeah, potentially. Is it? Unclear.
Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet.
We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.
But from the description, it doesn't sound like this vulnerability has much practical use. If you can convince someone to do all the things necessary to tee this up, you can probably just convince them to email you their password.
One example: At times it seems there are more dogs in my neighborhood than humans, yet, I thankfully seldom see dog poop left on the ground.
This also does not build your career.
Saying
>Hats off to you, no idea why you wouldn't just sell this off considering how poorly your honesty is rewarded.
Is just naïve.
3.3k for doing nothing but disclose is incredibly generous, especially for this where vector is incredibly targeted and needs private information to begin with (doc ID).
Aside from the ethical considerations you'd have to navigate, there isn't a market for vulns like this outside of bug bounties.
People on HN always cite Zerodium or whatever but don't realize those markets exist for vulns with a long half life. The expected return on a vuln which exists in one website is quite bad.
Google's SaaS apps aren't specifically in scope, but I'm not seeing exclusions, and I'm seeing potential parallel programs ("sensitive information disclosure: - MS Office (Word/Excel)") that could imply that they'd be comfortable buying SaaS Productivity Suite exploits as well.
I'm not OP. I'm only presenting this to counter the assertion that there's no market.
How do police departments crack open phones?
Does this mean they are breaking the law by buying these exploits?