Hacker News Reader

Comment by iudqnolq | Hacker News Reader

The Microsoft writeup is really something.

> Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications.

Sure, a small number of internal applications. Just the ones that gave them arbitrary JavaScript execution on every visitor to bing.com and full access to every signed in user's emails and cloud office documents.

https://msrc.microsoft.com/blog/2023/03/guidance-on-potentia...

View on HN

I see these sort of things, and always chuckle to myself. It's reassuring to see even the Giants screwing up too. It's way too easy to assume devs at some fancy wiz-bang company are all 10X'ers and produce perfect elegant code every time.

Then you realize developers at all companies are nearly universally bad.

It's a kind of miracle any of this stuff works at all, despite all the intelligence that's gone into them.

To add insult to injury, the $40k bounty seems awfully low for the amount of access the vulnerability gave its reporters.

It doesn't seem out of line with the published award scales of Microsoft's bug bounty program[0]. If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!) have done the research with that motive.

[0] https://www.microsoft.com/en-us/msrc/bounty

Or they did it out of moral reasons, which is not something every discoverer of vulnerabilities will care about

If their motive wasn't the bounty, and it is just an unexpected bonus, why complain about it being too small?

The researchers didn't complain about the bounty, AFAIK.

I know. That's the entire point. It is just HN complaining on their behalf, unsolicited.

So. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe.

Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.

It's almost as if HN is a site where we discuss things instead of just passively consuming information.

In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft.

Use Microsoft products at your own peril.

Wiz.io is a cloud security company which directly competes with Microsoft’s own offerings. They do this type of research as a marketing expense.

> It doesn't seem out of line with the published award scales

And yet, it still seems out of line with the scope of the vulnerability.

"seems" implies a subjective measurement.

> If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!)

Researchers are going to research. Please don't carry water for trillion dollar companies; the reward was paltry don't blame the researchers for Microsoft's cheapness.

I'm not blaming the researchers for anything. They did the research, found a major issue, and got a reward in line with the published expectations, and have not complained about it being too little. Why would I blame them for any of that?

It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty.

And by repeating this low-value conversation for the hundredth tube, you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small.

No need for the ad hominem attacks about “uninformed HN posters”. Zerodium and their likes are ready to enter discussions with you for paying ~ $X million given a sufficiently high impact vulnerability, which I strongly believe this is.

> you (yes, the specific you) are just hijacking the conversation and taking attention from what is unique and interesting about this case into your fantasy grievances about the bounty being too small

Well, good morning to you as well.

Anyway, the conversation had turned to the topic of remuneration. You didn't reply with THIS comment originally, you joined right in and defended Microsoft's payment terms. If you thought this thread of conversation was "taking attention away" why did you wallow into the mud with the rest of us?

> some imaginary black market

It's neither imaginary nor black. They list their prices on their website: https://zerodium.com/program.html

> It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty.

Sure normally it is a joke but this one in particular does look like something that would actually be worth something to the right buyer

A $40K bounty from a $2TN dollar company for this bug is like feeding pocket lint to sniffer dogs.

These researchers would get more from re-selling the exploit from dark web criminals than this bug bounty program.

Forget darkweb criminals, for something that juicy you can bet that nation states would be very interested. I don't know what China's equivalent of the NSA is, but if they're half competent they'd provide serious wonga for a bug like that one.

I don't follow your argument. We are discussing whether the bounty is high enough to provide a good incentive for researchers to pick up and report issues like this timeously.

It's impossible to know if anybody else has been abusing this for some time or not, and it's a valid concern for people here to argue the bounty is low enough that this kind of valuable exploit may have ended up on an exploit marketplace in the interim.

For that price I would just sell it to the Mossad.

I would sell it first to the Mossad and after to Microsoft...

Say what you want to about crypto, the bug bounty payments are enormous:

From the https://immunefi.com/leaderboard/

#1. 4 paid reports: $13,010,000 total earnings

#2. 2 paid reports: $10,020,000 total earnings

#3. 8 paid reports: $8,010,000 total earnings

Crypto bug bounties are high because the alternative is https://web3isgoinggreat.com/?theme=hack

Or for an even more funny take, see https://rekt.news

Because massive vulns like this are existential threats for these protocols. If Equifax gets breached for 150m peoples' personal information, they just get a slap on the wrist, pay you $15 (if you're lucky), and continue as a going concern.

If these trillion dollar companies messing around with your personal information was an existential threat to their business, they would pay comparably with crypto companies.

Is that dollar amounts or crypto amounts normalized to dollars?

As long as the conversion was done at the exchange rate at the time the grant was given, I would say it doesn’t matter.

But taking an ancient bounty and multiplying it by an exchange rate from years later would definitely be silly.

Most large crypto bounty programs are paid in things that are instantly convertible to dollars (mostly USDC, some DAI/USDT or occasionaly ETH). There are a few out there but in general the dollar numbers are real.

Yeah because they don't have their own security teams, 100% of the security budget goes to bounties.

I assume these are paid in crypto too, is it possible to easily exchange this large amount of money to regular currency? Then again, even 10% of that looks enormous.

Yes, moving cash around in fiat currency quickly is a solved problem.

> is it possible to easily exchange this large amount of money to regular currency?

Yes, but you have to go through a KYC process, and of course pay your taxes. (In the US)

It also depends on which country you're in. There are a lot of OTC desks if you know where to look.

Should've reported every app that got hacked as separate bounty :D

Doesn't get much smaller than "being able to read all Outlook emails from every Bing.com visitor", right?

This is only bing - we aint talkin Google here.

Reply on news.ycombinator.com