While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?
# assumed to be $0.5mil USD or greater
A := What quantity of salaries-and-benefits and AI-dollars does Google spend on zero-day research?
# assumed to be greater than zero
B := How many full sandbox RCEs are they *hoping* to discover per year with that budget?
# $/RCE budgeted spend
C := A ÷ B
# $/bounty
D := $1000 USD
# % discount per bounty relative to in-house spend
E := (C - D) / C
So, the most likely case is that they're greedy and miserly, and hope we don't do the math. However I recognize that there are judgment calls to be made here. Either their internal spending finds hundreds of RCEs per year, or they're significantly discounting bounty payments versus their actual worth, or they're negligent in budgeting for RCE discovery at all, or they assign zero value to the security of the Chromium platform underpinning Edge, Electron, et al. All of these are bad in different ways; one hopes a competent tech reporter actually pursues this line of questioning with them!
I generally agree, but a 3rd explanation is they figure that too generous a bounty will flood them with reports of minor issues making major ones harder to see (and costing time and money to verify that could be spent looking for security issues).
Remember that you can sell the same vulnerability to multiple people: it's software you can copy.
$1k is so dumb and the fact we’re discussing auctions is proof (hello, Sundar, what you doing over there?).
Guess this will change after the next e.g. nationwide hospital ransomware by a hacker who publicly laments bounty rates, if the news cycle accommodates the story long enough.
Negotiating with terrorists or black mailers is a bad idea.
The legitimate threat the researcher has is to disclose to the general public. (And to disclose the next bug to the general public, if there's no good payment.)
Isn't that a good thing?
> However it is now clear that all bugs that can be found will be found. So this makes a ton of sense.
If Google can find all the bugs nowadays, presumably with AI, why still pay a bug bounty? At least by this logic, bug bounties make less sense now.
Even a resume item.
* They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable).
* They don't require you to actually build a reliable exploit chain.
* They pay up front, not in tranches.
* They work with essentially all comers, unlike the grey market, where you're generally subcontracting to sell your first few.
Sound very interesting!
There's also a couple of Darknet Diaries episodes with similar interviews.
... than Google?
> Selling to Google though you aren't chancing jail time.
Why would you go to jail for selling a vulnerability? It's free speech.
Not so much for taking money from someone who the buyer should know has no reason to be interested in buying the information. And either you know who your counterparty is, in which case you know that they are using it nefariously, or you don't know who your counterparty is, in which case you know that they are using it nefariously. Any court and any jury should see straight through this.
Similarly if you figure out how to get the ATM down the street to give you free money, and you "accurately describe the bug" to people who pay you, and they use it to steal money from the ATM, expect to be charged for participating in, and in fact being an instrumental enabler of their crime. Because it is beyond all reasonable doubt that you could've believed they could have been interested enough to pay you for any other reason.
Since it's all so legal and risk-free, you'd think selling an exploit for a million bucks would be quite the feather in their cap!
It may also be helpful to visualize being interviewed by the FBI and being asked "Did you sell this exploit? To whom? How much did you receive? For what purpose did you think it would be used?". And to remember they already know the answers to these questions, and lying to the FBI is also a crime.
There's no way money is the motivator.
But they weren't security issues necessarily. I never thought about it, fixing a huge performance issue is big. A security fix that gets caught early makes no noise so you just don't know how important it would have been. We also once had a really terrible bug that lead to lots of customers getting effectively attacked.
Potentially creates a misaligned incentive to intentionally hide bugs in the code you write so that later you can fix it and get the bounty.
Now exploiting them? Yes that's a crime.
"Safety" is also a relative thing, when the world is safer for one party, it is usually worse for another.
99.999% of people will agree that reducing software vulnerabilities is desirable if they're able to understand the question, including the bad actors themselves a lot of the times.
The situations like bad state actors are already not bound by laws, and things like keeping activism legal are better fought for through other ways
"Making money from bugs" is not solely a black-market activity. There are plenty of grey and even white hat activities in this market.
Yeah let's see how this plays out, paying people less than their time is worth for RCEs.
Aka security research.
It's one thing to hold something for ransom ("give me $5M or I release the 0day"). It's another to sell a valuable piece of information ("give me $5M if you want the 0day"). As long as you're only offering the bug to the company who would be impacted by its release, there's nothing unethical about asking for payment.
Maybe you think that, ethically, all bugs should be reported, regardless of payment, because it prevents harm. Well a lot of things prevent harm that we don't all take it upon ourselves to do voluntarily. Should everyone do all safety-related work for free? If we don't want to do it for free, should we not do safety work at all?
If the company really wanted it safe, and they can't make it safe themselves, they can pay someone else to make it safe. If they aren't willing to do that, then nobody is obligated to do free work for them, because we don't require anyone else to do safety-critical work for free. Let's not forget, this isn't a scrappy startup struggling for a seed round, this is one of the world's largest corporations with billions of dollars in cash. If they want your labor, make them pay for it.
Thanks for putting it like that, it changed my opinion on the subject.
If it's normal to expect people to be compensated for other security work, it implies it should also be normal to compensate security researches.
No it’s not lol
If old systems had no bugs/issues, companies could do without the maintenance burden altogether (which includes even systems not being evolved/extended).