Hacker News Reader

Comment by strictnein | Hacker News Reader

Everything in Crypto (for both meanings of the word) has a built in bug bounty. It's just whether or not the companies want to take part in it.

View on HN

Everything in finance... banks have the same bug bounty.

Not really. Bank transactions are reversible (especially when banks themselves are affected). And if you try to wire money to your account, you will be found trivially.

Definitely not true. My last company had the finance department phished and they never recovered the funds. It was about $50k I believe.

See also all the people pissed at zelle.

Nothing is true in absolute terms but banks care about loss percentages and that’s much better in the real banking sector.

For example, the national bank of Bangladesh was compromised in 2016, believed to be a well-resourced attack by North Korea, and the attacker was able to attempt to transfer $1B. That’s about as severe as it gets, but the U.S. Federal Reserve blocked 85% of the transferred funds and of the remaining funds, all of the money sent to Sri Lanka was recovered, and they were able to recover some of the funds laundered through a corrupt bank in the Philippines whose manager was subsequently charged. About $64M was laundered through casinos which were not at the time required to follow KYC.

https://www.bbc.com/news/stories-57520169

So, not great, but the losses are under 10% of the amount the hackers had access to and there’s still a chance of recovering the rest - that’s survivable with insurance and it’s basically the traditional finance world at its worst in terms of corruption & poor preparation. Compare it to cryptocurrency, where losses on that scale happen multiple times a year rather than once a decade, and the attackers have a much easier time laundering funds through the infrastructure setup for exactly that purpose. North Korea is getting over a billion dollars a year from cryptocurrency, which is much better than the tens of millions at greater risk they got here.

The money was only stopped at the Federal Reserve because the address used in some of the wire transactions included the word Jupiter which was a sanctioned entity at the time and the matching was sufficiently fuzzy that this was caught. That was a complete accident. It just as easily could have gone the other way. I just read a case on the layoffs subreddit where a law firm was hacked and one of their clients was tricked into wiring millions of dollars to the wrong account, resulting in the client suing the law firm for negligence and the law firm having to fire a bunch of people. One Latvian guy tricked Google and other large tech companies into wiring him a hundred million dollars total which was only recovered because he was arrested and plead guilty. Business email compromise is a huge plague on society and in many cases the recovered amount is trivial.

The only way you are recovering the bulk of losses if you don't notice the theft very quickly is if the amount is high enough that a prosecutor is interested and it hasn't all been withdrawn as cash yet.

This discussion has really gone off the rails.

All I was saying was that banks have a bug bounty on their head, the next person responded that bank transactions are reversible, which isn't entirely true in all cases.

I wasn't trying to compare sizes or anything like that.

Sometimes they are. There's a network of seedy international banks that scammers use to take their victims money, because otherwise the scam wouldn't work.

Do you have examples? People can avoid them

The scammers wire the money out of your account into a bank account they control, and then put it in another bank, and then move it further on from there. Knowing which bank they have their account at doesn't help you avoid the problem.

Yeah I understood the mechanism, just wanted to know the companies that enable such things.

One just happens to be more legal than the other.

Depends, it's not clear yet that "code is law" or is not.

> Depends, it's not clear yet that "code is law" or is not.

Aren't there quite a few cases already where attackers stealing funds from smart contracts were considered just that: thieves. And where their "code is law" defense didn't amuse the judge?

IIRC we recently even saw two sent to jail for manipulating smart contract prices: it's not even clear they used a bug in a smart contract.

I already posted it but Uncle Sam cannot have it both ways: if Uncle Sam asks people making money with cryptocurrencies to pay taxes, Uncle Sam goes after those who steal from the taxpayers. And... Oh boy, does Uncle Sam tax gains.

iirc someone successfully argued code is law in a court in france

Is there any hint of the legal system accepting that?

They certainly don’t accept “locks are law” or “finders keepers.”

yes, sometimes. Its mostly the opposite of what people expect, but truth is often stranger than fiction.

The MEV and Sandwicher attackers are legal, increase the transaction costs for everyone, skim profits from everyone and annoy everyone, the exploiter of a MEV bot gets charged and convicted.

I don't have any problem with that, I've analyzed the sentiment of discussion though.

I don't think anyone got charged and said code is law. Its more about who gets charged at all.

You could say that about anything that is critical.

Try thinking through other comparisons to understand the difference: if I find a bug in the power grid, how do I cash out? There aren’t many buyers, it’s really hard to move a lot of cash without getting caught, and if I use any other electronic system I have to pay a ton of money to get help laundering it because the risks are so high. Criminal outfits in Asia play games trying to get gift cards or things like that but it’s hard to scale and a lot of their dupes here get caught.

Contrast that with cryptocurrency where a bunch of VC money pumped up a market for you to launder the proceeds and the protocols are intentionally designed not to have antifraud protections. Ransomware was possible a decade earlier but the profitability went up massively once it became easy to launder millions rather than hundreds of dollars.

I have a general rule of exploit sales which nobody has shot me down on yet and I'm increasingly confident about: people are buying non-speculative outcomes. Every dorm room conversation about vulnerability valuation inevitably veers into speculation about what bank-shot outcomes a buyer might hope to achieve with a purchase. The reality is that unless the buyer is getting exactly an outcome they already planned (and, usually, have already repeatably achieved), they're not interested. Exploits have to slot into existing business processes.

This explains reliable, stealthy, zero-interaction full-chain iOS vulnerabilities, which fit into every intelligence, military, and law enforcement business process pin-compatibly. It explains browser vulnerabilities and ATO vectors.

And it also approximates the market for blockchain vulnerabilities: if the exploit is "literally transfer untraceable cash from victims to buyer", lots and lots of criminal organizations already have that business process; you probably simplify their existing repeatable process.

Blockchain vulnerabilities thus have a very credible market. As bonus: the work of discovering and POC'ing these vulnerabilities may be gnarly, but the engineering required to exploit them at scale probably isn't. It doesn't take months of R&D to make the exploit "reliable", it generates straight cash until it dies (and probably has a half-life measured in minutes), and so on.

Every lucrative class of vulnerability has some kind of story like this; they all fit into some existing, very clearly stated demand.

We get into trouble trying to generalize. All the markets are very specific; they're all sui generis. Most vulnerabilities are worth zero. There are mobile OS RCEs that are probably worth zero!

That’s a really good way to think about it. Having been security-adjacent for a long time, I definitely remember the reactions of dread which some of the earlier big vulnerabilities in things like OpenSSL got, which were never exploited at the feared scale, and that’s well explained by your theory: the NSA isn’t interested in every phone in a country, and a lot of unsexy vulnerabilities like WordPress exploits are going to be more widely attacked because people know how to make money with ad/affiliate spam, SEO, etc.

No, you can't.

I can and I do, I say it all the time.

Not really - a bug bounty gives you some type of currency.

Jacking a database and trying to sell it on a DLS or dark web is a massive process.

Reply on news.ycombinator.com