Comment by elevation
9 hours ago
> Do you have any advice for aspiring bug-bounty hunters?
We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens. Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.
That's really not why bounties exist, though people on both sides of the bounty systems claim it is. If it were broadly the case that bounties exist to offset black market sales, you wouldn't pay bounties for vulnerabilities with no market value. This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market.
In reality, the modal benefit accruing to a company running a bounty program on receipt of a new serious vulnerability is simply engineering prioritization. You get bug reports from users when you have reliability and UX bugs, but you don't get them for security flaws, because attackers generally have to force vulnerabilities into revealing themselves --- normal users almost never run into them. Bug bounty programs fill that gap.
"This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market."
Crazy statement. This would easily be worth more to malicious actors
The only actors who will pay you real money for a serverside RCE bug aren't buying an exploit; they're contracting with you to plan a heist. So the same analysis applies: you yourself could come up with some scheme whereby you yourself use this vulnerability to steal stuff from Google. But that's not what we're talking about when we talk about vulnerability valuations.
There is essentially no market for these kinds of serverside vulnerabilities.
I don’t understand your argument here.
If you’re saying that bug bounties exist for a reason according to both the program runners and the contributors then how is that not the reason they exist?
The people paying and the people working are all in agreement that it exists for that reason.
What part of my logic do you not follow? The way you've posed this question, the simplest response would require me to write that whole comment over again.
12 replies →
> Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.
Is this really true? After all, reselling the exploit would be illegal, and most people don't want to break the law to earn income.
most people who care about legality don't work in that field either. whoever gets into this probably starts by being ok with doing shady stuff, I imagine.
Many start in the military and eventually move to private sector. However, an ever growing percentage just straight up go to college to learn the skills.
Cyber companies are in the fortune 100 now, and it's not like it used to be back when you actually had to be interested in it and dedicate your life to learning the skillz from shady forums. Now it's just a job to most practitioners.
4 replies →
Plenty of people in this space who work on entirely legal things
Most people do not, but it needs only some people who do so for it to be a problem. Most people do not steal, but I still lock my front door.
there are enough people operating in countries that would not charge them for hacking an American company for it to matter, $90k can be a life-changing sum
And before it ends, people with existing reputation can milk the last drops, as mostly their reports gets processed from the thousands of others. Unfortunate status quo.