Comment by Stevvo
12 hours ago
You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
12 hours ago
You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
Not sure that logic really holds up. If the cost of trying is low, why wouldn't you?
This is where I am, currently. There's a lot of talk about the low opportunity-cost here, but I think that relies on the assumption that there also isn't a single opportunistic person out there with access to the RCE. That doesn't strike me as a strongly supported assumption, in my experience.
For all I know, it's a straight up scam. Someone already sent more bitcoin to the address to double the bounty.
Shouldn’t the expected value of attempting this somehow include the likelihood of the key actually being on the machine? Surely the probability is much higher than 0? I would guess the expected value for actually being the first one is around $300, not 0
> Surely the probability is much higher than 0
I genuinely have no idea how to even start calculating this probability. How would we do it? Is there reliable data on honeypots?
You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.
Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.
lol the exploit is patched, why are people acting like it's a a zero-day? anyone you attack with this, in any case, has to be someone who hasn't yet upgraded their PHP version. it's worth nothing to hide/sit on.
The exploit is supposedly so trivial that everyone needed to take down their services until they could patch? There should be nothing to give away here, which I think is the point. Either it’s trivial and you swipe the $500 or it’s not and you save it (assuming you have it). In the latter case you shouldn’t really be worried, since they won’t burn an exploit on you either.
what a pedantic way to look at the world