Hacker News Reader

Comment by capableweb | Hacker News Reader

Especially because of the last part:

> With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities.

So this person basically saved them from loosing tons of money (if you accept these companies claim that pirating games actually make them lose money in the first place) and they only awarded them $20K.

Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.

View on HN

I had some considerations of getting into white hat hacking. I'd have enough motivation to become somewhat proficient in a few years,maybe even very good in a decade. But then I look at the rewards for vulnerability discovery and I think what the hell??? If I'd spend years honing my skills and someone would offer me a few grand for something that could potentially cost them millions,I don't think I'd manage not to sell it for the highest bidder. This is like a gig economy but for infosec.

> for something that could potentially cost them millions

You can be very sure that if a piracy case went to court, Sony would claim to suffer billions in damages.

In an alternate universe, perhaps the fact that Sony valued this exploit at just 20k would work against them in a piracy case

Not sure on that, the Nintendo v Team Xecuter case ended up with $10 million in damages for selling Switch piracy mods/tools

https://torrentfreak.com/gary-bowser-agrees-to-pay-10-millio...

I despise Team Xecuter for a number of reasons, but these two exploits aren't necessarily comparable. The Playstation vuln in question would allow people to create pirated Blu-Ray disks that work as-expected on vanilla PS5 models. TX created a custom firmware that required hardmodding your Switch to persist. Nintendo couldn't really wring out TX without proving that their damages went beyond just the owners of hacked Switch consoles, which it certainly didn't. In Sony's case, they could probably sue pretty hard if people started selling pirated or counterfeit PS5 games, since every PS5 owner is effected.

IANAL, but I think you have to keep the scope of the damages in consideration.

By every owner affected you mean, there is small to no moat and everyone can use it if they so wish.

It is not like PS5 owners are going to be upset for having a straightforward way to run games -- e.g. make their own Blu-ray copies etc.

Edit: To clarify: that this is valued for/by Sony at only 20k is beyond me. But absolutely that valuation should be admissible in court in my opinion. On the other hand, this number tells me to never submit a bug bounty for the money -- at least to some companies. It is simply not worth most of the time/most of the contexts. Write a paper/publication of some short and use it to get a good job that pays you salaried for more -- if you have already one just publish them immediately with a ping to the sec team. If they want to fix these fine, otherwise... they can pre-pay you to report them to them under contract for a good amount of money.

> allow people to create pirated Blu-Ray disks that work as-expected on vanilla PS5 models.

I don’t understand why there isn’t an industry of selling pirate copies of official games. What I mean is buying an official copy of the game, “image” the disc, and press 1:1 copies for cost + a couple dollars.

Why didn’t that happen? Are there technical issues preventing this from working? I can’t think it’s a matter of cost, BRD can’t cost that much to make at scale.

Not sure how it works exactly (I'm sure someone else in this thread can fill in!), but that hasn't ever been possible on consoles. Not even the very first Playstation which used CDs would accept copies out of the box.

I think PS1 CDs had data written in an area (early?) consumer CDR writers couldn’t reach. I don’t know about PS4/5 games.

Most white hat security researchers seem driven as much by curiosity and just a general passion as rewards.

When I worked with someone who was a point of contact for outside security researchers it seemed for many were just happy to get their name in the release notes.

And I’m not sure if you’re selling that you’re a white hat researcher anymore…

Yeah, it would be super tempting. But law or lawyers might find you if you’re not careful

I expect to get downvoted to oblivion for this but whatever. Your comment completely lacks morals. Selling something to the highest bidder implies you have no hesitation about selling exploits to criminals.

You don’t have to do research on any given platform. If you don’t like the terms of their bounty, find something else to play with. If you are skilled enough to find something like this you will have no problem finding very highly paid jobs.

>Your comment completely lacks morals

Try not to regard things in such an all-or-nothing perspective. At worst it indicates a psychological disorder, at best—a high conflict personality. Either way, it wont benefit you or the people that interact with you.

I also disagree that it ‘completely’ lacks morals. If OP is being truthful, then he has a desire to work hard and put in the time necessary to fulfill a virtuous (albeit under-compensated) calling.

However, OP is also cognizant of a hypothetical (albeit realistic) temptation that will most likely confront him, should he carry out these pursuits: ethical conflicts which would force him to choose between large financial gains (selling exploits to bad actors), or the less lucrative (and often thankless) white hat approach of reporting it in good faith, and expecting (but not necessarily receiving) equal measures of good faith from corporations (like Sony in this case).

Having an awareness of one’s own weaknesses or susceptibilities to temptation isn’t a weakness to be admonished from atop a digital soap box. Instead, recognize and reinforce OPs desire to do good—it costs little more energy to encourage the good in people, rather than shaming them for not having an unshakable moral fortitude. Have a Happy Father’s Day.

This is an excellent microcosm of everything that is wrong with the internet. I 100% agree with the entirety of your post. Had you not taken the time and effort to make a well-thought-out comment like this, the narrative would have been shaped from your parents post, possibly influencing tens of thousands of people.

I won't downvote this, even though I disagree with many of the particulars.

One of note: the "criminals" in this context are, at best, homebrew developers and users who'd like to unlock the full potential of the hardware they bought. At worst, they're "pirates" (the industry term, not mine) and game cheats. Nobody likes a cheater in a video game, but I don't know if I'd go as far as to make ethical prescriptions about it.

Sony feels comfortable paying a pittance for these vulnerabilities because the market for them is relatively soft. But that doesn't mean that the underlying asset actually lacks value; it means that Sony has successfully criminalized applications of the asset, artificially lowering their salability.

Replying, to avoid edit confusion: you're the CEO of a financial services company that seems to employ reverse engineering to figure out private banking APIs. In the (not-very-distant) past, that was potentially criminal under both DMCA and ECPA.

Your position affords you a unique opportunity to have some perspective here.

Thanks for noticing. I do have a unique perspective indeed, and that is exactly the activity we engage in. It was never criminal. Reverse engineering for interoperability has always been permitted by law.

> Reverse engineering for interoperability has always been permitted by law.

It's not that straightforward (even if I wish it was).

First, it requires a judge and jury who understand "interoperability" to include "connecting to a server you don't own and sending it payloads that it isn't expecting."

Second, it requires a lenient interpretation of EULAs under the DMCA: the DMCA promotes otherwise legal reverse engineering activities into illegal activities by allowing companies to establish "acceptable use," which can include prohibiting reverse engineering activities that circumvent restrictions on copyrighted or other controlled material. A bank may plausibly (in the eyes of attorneys) claim that third-party uses of its APIs compromise the bank's ability to comply with federal regulations, since no law requires that compliance and operation be integral operations.

What? That is just clearly untrue, even though I agree it ought to be the law. DMCA 1201 made no exemptions to circumvention of technical protection measures (for research, interoperability, fair use etc). Assuming any kind of security measure was employed here the interpretations of violating that have been quite broad.

ianal etc.

Reverse engineering does not necessarily imply circumvention of technical countermeasures, e.g. removal of DRM.

Reverse engineering would also be a copyright infringement issue, which does have a carve out for reverse engineering.

You are right, my initial comment excluded morals altogether. I did it to emphasize the low value attribution to the vulnerability discovery. If I were to actually face such dilemma, it would include much more complex thought process, including morals.

I understand that nobody has to do the research of any sort but my point is that these skills and effort involved are being commoditised very quickly and become comparable to gig economy. Bounty programmes are very very cheap to large corps, compared to the returns involved. Building a substantial infosec division that could match the crowdsourced model is way more expensive.

A very thoughtful reply. Thank you. For the avoidance of doubt, you clearly do not lack morals yourself :)

This isn’t about selling guns to killers. Or bugs that allow you to spy on political opponents.

It’s selling bugs in customer hardware that can used to reduce control of the manufacturer of it and allow users to run pirated stuff (and homebrew likely as a result). It’s totally in the best interest of the manufacturer to always be the highest bidder.

I don’t have any moral issues with people selling those issues on the black market, if manufacturer isn’t interested in rewarding researcher properly.

The parent was merely stating the payout is wrong, vs other avenues.

An example, if you find a bag of cash, typical finders fee is 10%. Insurance companies, others, often offer this.

Meanwhile, Sony is kicking maybe .01% "cash saved" for this vulnerability.

Or perhaps Sony only considers piracy to cause about 200k of damages in actual fact.

200k in damages after recovering funds from lawsuits.

I see it as a broken social contract, and this behavior has kept me out of white hat too. While selling to the highest bidder isn't what we collectively want to happen, neither should we want large companies to fail rewarding individuals for improving their systems, particularly security. I don't want a landscape of pirated software, but I can't apply moral judgement to someone who chooses to sell the information elsewhere because the owner won't offer in-kind value. It seems to me the first immoral action is actually being made by the company. I wonder if a proper way of addressing this is for individuals to negotiate higher awards through a non-profit specializing in legal and monetary law.

But what hasn't worked and will continue to not work is using social moral condemnation. I think we all find "you wouldn't download a car" funny, right? Worse for this situation is the context of the growing economic divide worldwide in 2022. Under that lens I wouldn't be surprised to see this happening more. The more oligarchies show individuals that they don't care, why should individuals show they care about the oligarchies?

Sony TVs spy on what their viewers are watching, and Playstations specifically are designed to prevent their "owners" from using their property as they wish. And let's not forget the rootkit Sony installed on buyers of their music CDs, for which no Sony employee or executive went to jail.

That Sony is not the criminal here is a reflection of our inadequate laws, not morals, and selling vulnerabilities to them is just as bad.

If it was an ethical open source initiative that ultimately benefits the world the one that was being targeted, then yes I'd agree. But if it's a company deeply entrenched in dark patterns, willingly destroys small competition with anticompetitive practices, and trample on basic user rights for triple dollar signs - then, really, who cares? To what detriment to humanity would there be if OP sold to the highest bidder?

What small competition have they destroyed? There's also plenty of competitors in the gaming space with them.

Sony are seeding their online community with toxicity. If you have a PSN account look at the available avatars you can use.

1 in 5 have different variations of devils horns on the characters heads. 3 in 5 look like they've been cropped from communist murals around my city. Almost all of the characters look angry and criminal.

Browse these avatars and in your mind compare them to Nintendos. The vast majority of users are interacting with each other and seeing these creepy avatars as they're friends virtual faces. What effect is this having on young kids?

But the poster is explicitly saying that’s why they have not done this?

In this case, "Crime Pays Much Better" is a valid criticism, relative to the award. It really shouldn't be the case here. This is very much a "worst case scenario" for Sony if publicly released. The award amount IMHO is excessively paltry for the level of effort and the relative impact that this could have caused their business if not reported in an ethical way. An award amount this low, is as other points out and the poster, approaches levels of "deterrent to doing the right thing."

This has always been a heated debate. IMO, the whole concept of "ethical hacking" doesn't exist. The whole concept of morals and ethics is nothing but smoke. It's something someone made up one day to get people to not do bad things and in the modern day companies use it to give out terrible bounty rewards.

If I find a high tier vuln and the company isn't giving reasonable bounties, it's going straight onto Zerodium or similar platforms and I won't lose a second of sleep over it.

The market is telling people what the price of a bug is, as the legal monetization paths get more and more numerous, alongside the illegal ones.

Its literally only the corporation beneficiaries of having their own product fixed that are paying the wrong amount. Inching up the payout amounts ever so slowly.

Anything that makes those corporations pay out better is also a moral outcome, and doing things that supports this status quo lacks ethics as well.

(We actually agree that selling to some bidders, and some actions, lack ethics)

You don‘t need „morals“ when the topic is about billion dollar companies who lowball you and nobody gets hurt if you do sell the exploit on the black market

>Your comment completely lacks morals

Nah, copyright is immoral, bypassing it is the morally right thing to do.

Let's not let our morals get in the way of doing what's right.

> downvoted to oblivion

Wrong website.

I believe it's come out since the initial statement that the "pirated games [...] without a kernel exploit" thing was hypothetical, requiring someone to write a specialized AMD64-to-AMD64 JIT compiler that transforms game programs from using their native memory layouts to using that of the exploited process.

Man that just sounds cool though. Basically a a software MMU in some ways.

It's more-or-less how QEMU system emulation works when hardware virtualization isn't available (it's even called "softmmu"). My understanding is that something similar would need to be written/adapted with knowledge of PS5 processes' memory layouts embedded into it.

Believe it or not, some people are not in it for the money.

20K + prestige, he's gonna have strong cards at his next $nicely_paying_company interview

>Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.

Sure, sell it for how much? twice? thrice? as much

instead using it for your own branding, cv, to negotiate salary which will pay you way more over years

So what you’re saying is that Sony basically paid him the missing half in exposure.

I would expect its worth 10x to 100x 20k to the right group of black-hats.

What makes you think so?

Not parent, but probably this part:

> With these vulnerabilities, it is possible to ship pirated games on bluray discs

I've seen that, but I don't know this market at all

Not sure these kinds of exploits are as valuable as they once were. Online gaming is the default now which means updates can be enforced. And using one of these exploits basically requires disconnecting from the network, losing online, and losing access to new games which will have minimum version requirements.

> losing access to new games which will have minimum version requirements

This isn't always the case. On the Switch for example you can very easily bypass system version checks.

I think the Switch is an example of how little these exploits really matter now. They had a maximum severity bug that was unpatchable and allowed piracy as well as several other patchable ones later and yet the switch did fine since the vast majority don’t want to be banned from online multiplayer. Switch piracy is very contained to a group of tech enthusiasts.

Compare this to the DS and DSI where piracy carts were sold at retail stores and had zero downsides and were widely popular.

That's a good point, but I would say it's heavily dependent on the country. Here in Brazil for example where Switch games cost almost double of Playstation and Xbox games, most of the people I know who have an exploitable console have it hacked.

It's also worth mentioning that vulnerable consoles were sold for a relatively small window of the console's lifetime, and while patched units are still hackable to some extent its much more inconvenient. For the DS all you needed was a flash cart, regardless of anything else.

> Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.

This is illegal AFAIK.

I'm not sure it is if no remote server is involved. You are allowed to hack your own device in most of the world.

That has never stopped anyone from doing it.

I mean by that logic, looting someone under gunpoint is way easier than coming up with working exploit, so why not do that.

I wonder if you could use this if Sony sues you for copyright infringement damages?

Reply on news.ycombinator.com