Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm not sure I understand the cognitive dissonance here. The same imbalance exists in a lot of commercial products; for instance, a new reliable Chrome bug chain might earn you more than a Chrome developer makes in a year, and a lot of those people make bank. It's simply the case that for some projects, reliable exploits are more scarce than feature engineering resources --- they involve different skill sets.

None of this is to say that $25k is adequate compensation for critical FOSS development work.

View on HN

I don't think cognitive dissonance is the right label to apply to this. I read it more as a misalignment of incentives. It's a sad comment on the state of things that a year of effort to produce some popular software is worth only a quarter of what somebody else is willing to pay for exploitable bugs in that same software.

Like, I understand why that's the case, but it still sucks.

Unless the foss developer is also getting the RCE award.

That would be a conflict of interest, no?

I would pay more than my yearly salary to find out if I have a 'curable' cancer, so that I could treat it. To not, or ignore that, would likely mean my death. I imagine it is similarly motivating for OSS projects.

It's not.

OSS projects aren't people with curable diseases. Most of them are labors of love, run by people in their spare time. Those people have needs that are mostly not met by working on open source projects. Epsilon open source projects are well-enough funded that nobody in the project feels starved for resources.

Bug bounty programs are only useful for these projects if the details of the bug are shared with the project. Zerodium's model relies on keeping developers unaware of the bugs for as long as possible [1].

Nobody developing OSS is grateful for programs like Zerodium.

[1]: https://security.stackexchange.com/questions/199480/what-doe...

One difference is that people may have a safety net in either savings or insurances, but underfunded open source projects don’t.

Compare the project fundings?

Chrome funding is probably in the XXM$/year, while Zerodium offers 500k$ for a vulnerability, that's an approximate 20-100 funding / vulnerability ratio.

Pidgin is at 25k$/year, for 100k$ for a vulnerability, so a ratio of 1:4.

I think the only reasonable conclusion is that community-driven opensource projects are 100 time safer than private company-funded opensource projects /s

The 0day market is actually getting disrupted by cryptocurrency. Even the major exploit brokers can't compete with weaponizing the exploit against an exchange or online wallet provider to net tens of millions in easily cleaned money.

Any evidence of this?

Its pretty common sense, if you exploit people and steal their cryptocoin wallets, that is worth a lot more than a single one time payment of 100k.

Speaking of common sense ... most people don't have cryptocoin wallets

Also, those selling 0days are not the one's using them in the wild... out or principal. One can sell a 0day and float away on a silver cloud never to be seen again, but use it in an active campaign and they'll come after you hard.

Yes it makes sense, that doesn't mean it is common. I can sell a 0-day for money and it is legitimate income. If I try and scam an exchange I have to be successful, be able to clean the coins I steal and then hope I am not caught.

I would take the 0-day payday thanks.

https://blog.coinbase.com/responding-to-firefox-0-days-in-th...

One example where it was unsuccessful, not sure it counts as evidence. Yes one time someone did try to use it but it doesn't indicate a pattern of behaviour

But not more than Google's revenue / Chrome project funding. (Or at least not above board, out in the open like this.)

I don't necessarily disagree with you, but I do think it's dissonant enough to be interesting.

Fair point, but as someone not familiar with exploit markets, I do find it surprising that an exploit in a relatively niche (because desktop linux is relatively niche) IM client is worth $100,000k.

Zerodium is a proxy for governments wanting to buy exploits. That niche IM client might be the software of choice for a child-exploitation ring or a high level ISIS commander.

Comparatively a single hellfire missile costs $150k - plus $32 million for the drone to fire it from.

The 100k exploit bounty is probably less than the yearly cost of 1 agent for many government organisations. So the target doesn't even have to be a high value ISIS terrorist to make this bounty worth it. Just save them 1 or 2 FTE somewhere and the economics already work.

I would have thought the same, but the existence of this "ask" certainly would suggest there is indeed demand from a market dynamic perspective. Pidgin is cross-platform, and you could conceive that it was being used by people for various activities with OTR or OMEMO end-to-end encryption. At that point, there's a bunch of potential customers looking to pay Zerodium for a good, robust, zero-click exploit that would give them access to exfiltrate and monitor messages sent through the client.

The work is the work, no matter how much the project itself took to build. If it was easy for exploit developers to pull a Pidgin exploit out of their butt, they'd be cheap. The fact that it's a niche target can actually make bugs scarcer; sometimes, exploit devs can draft off the work other people have done beforehand.

Sure, my surprise is more that the demand exists at $100k, not that the supply isn't cheaper.

I get why that's surprising but I think it's important to beat that surprise out of your brain, because $100k is a rounding error for any state-level actor --- not just the US, but, like, Seychelles as well. If you have a problem that can be solved with a Pidgin exploit, it's a problem you'd fall over rushing to write a simple $100k check for.

What's so perplexing to me is why the pay grades for people in the military are so low. Take Michael Flynn, for example, the O-9 pay for a three star general is lower than what a senior software developer makes. Surely if we're spending $100k a pop for these random exploits it makes sense to spend more at the top of the military to make sure we're buying the right ones.

Also, I don't really see any possible way out of this cyberarms market. There are too many degrees of freedom to really secure anything completely and I'm continually surprised that our governments allow the sale of these munitions to non-allied foreign governments. If someone puts up a $2m dollar bounty for Tesla do we just accept this even if it means physical harm?

I think we don’t want those at the top of the military to be motivated by money.

You're missing the value of military pensions and healthcare when you speak about O9 compensation.

Undoubtedly some TLA has learned someone of interest is using Pidgin, and has offered a premium for an exploit to target them. TLAs have deep pockets for such things.

Pidgin has, or at least had, more usage than you might think. I know that it was the typical Jabber client at Oracle a couple years ago. It's been superseded by Slack/Teams/Zoom recently, but it's not exactly rare. Also, if you were going to profile network admins or ops people that might be interesting to target for attack, they're more likely than most to be running Pidgin.

Pidgin is ubiquitous on darkweb drug markets and in exploit communities.

Solution: put bug in, get accomplice to claim bug bounty under an alias.

(This is fraud, don't actually do this! But it comes up every time someone does bug fixing metrics)

Obfuscated Open Source Subtle Bug Insertion Contest

Edit: If it's not a bug bounty to fix it, but a vuln bounty to sell it, then it's highly-unethical but not necessarily illegal.

Sounds like the University of Minnesota already has a team ready.

Seems like unnecessary steps- I'm sure Zerodium would be happy to just pay you directly to put in a backdoor

Erm how would that be fraud? It's certainly unethical to the software's users, but seems to fit the spirit of a private bug bounty. Apart from the ethics, what would legally trip you up is later "disclosing" that bug as a public bugfix, which is presumably against Zerodium's terms.

The difference is that Zerodium can turn around and sell these exploits to autocratic governments. More often than not, these governments then use the exploits to monitor political dissidents.

If you're reading me as saying the two enterprises are morally equivalent, you're taking something I'm not saying from that comment.

Sorry, I did not mean to imply that. I was just noting an important difference between bug bounty-style exploits funded by companies and what Zerodium does.

and to democratically elected governments too, who will then spy on their own citizens

Sploits are worth a lot more because of the damage they can do.

Fixing some bugs and adding some features is a nice-to-have that most people and companies aren't willing to pony-up much for.

Reply on news.ycombinator.com