It's a little perplexing. Of course it's always a controversial topic since it's difficult to value an exploit, but whenever we read about these online, which probably goes through some survivorship bias, they seem pretty low.
On <a href="https://www.microsoft.com/en-us/msrc/bounty" rel="nofollow">https://www.microsoft.com/en-us/msrc/bounty it seems the top is $100,000 or $250,000 depending which program this counts under.
As I understand it, bug bounty awards are a rough proxy for "would nation-state actors be able to exploit this for operational purposes without getting caught".
Zero-click iPhone exploits that affect the current OS and also previous ones are worth hundreds of thousands.
I think HN, like a lot of people in this industry, have strongly skewed perception of the actual importance of these bugs.
You could view the bounty prices as market evidence that most of this is rightfully treated as nothingburgers. I.e. the alternative to paying $5000 to some random person for this class of vulnerability research is not risking a trillion dollar hack the next day - it's just risking shmaybe some kerfuffle down the line, followed by fixing it through normal triage process. The bounty program is as much marketing as security, and $5000 is probably about the right price for marginal effort into sustaining the "we are treating security seriously" message.
In a way, the very existence of those bug bounty programs in large companies is evidence they don't see a reason to treat vulnerabilities seriously enough to proactively find and fix them in-house.
If security vulnerabilities would be anywhere serious as most commenters on-line seem to think, companies would pay hundreds of thousands for serious vulnerabilities, just to save a day before they get hit by them - on top of spending millions in-house to try and stay ahead of the attackers.
But they don't. Because most exploits are inconsequential and/or aren't being exploited much.
What's worse is the alternative is winding up like Aaron Swartz... (all he did was scrape PDFs for mostly public funded / tax funded papers) Which is even worse, I think I'd be glad to receive $20 for Starbucks instead of being legally chased for showing them they messed up.
There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued.
"all he did was scrape PDFs for mostly public funded / tax funded papers"
He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.
We shouldn't support theft and he should have gotten some jail time/punishment for it.
"There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."
Too many 'security researchers' demand money or threaten to release the vulnerabilities.
I don't know anyone that got into trouble going through a legit bug bounty program.
I have not done a deep dive so I could be wrong, weren't these papers published (or soon to be)? Wasn't the one and only group with negative effects the Journals that could extract a fee? Especially with researchers usually happy to send a copy? This wasn't someone stealing trade secrets they weren't even secret.
It was a protest against the monetization of academic knowledge.
You can call that "theft" as much as you want. There are lots of people like Aaron out there that think this sort of information should be freely available.
Just because there is a law doesn't mean that that law is just and correct. Saying we "shouldn't support theft" is an over-simplification of the situation.
Every HN post regarding security exploits inevitably results in some comment saying the bounty is too low. I find it helpful to read previous comments by tptacek regarding bug bounties and market values:
This is correct. I've made well over six figures over the last couple of years through bug bounty programs. I wouldn't spend months finding one bug. It's usually days or a week or two max.
$5,000 is actually pretty normal for a critical. I think the most I received for one bug was around $10,000, but this is the exception.
AI has also ruined the market. I'm a security consultant (where I make most of my money) and stopped bug bounty once AI slop reports made it impossible to actually get anything triaged in a timely manner.
Something else many don't know is that with all of the major platforms, customers can see the bugs before they are even triaged by the platform team. Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.
> Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.
Isn’t that just a speedrun-encouragement for selling the exploit not to the one offering the product, but an attacker offering more (in this case, >$0 is not difficult to exceed) instead?
If there was an easy way to extract value out of any particular kind of a vulnerability, it'd cost much more and thus the bounty would've been higher.
$5K seems like an absolute steal compared to paying contracted security experts to find such bugs. I'm surprised these programs aren't pushed harder, as the potential ROI seems fantastic.
> $5K seems like an absolute steal compared to paying contracted security experts to find such bugs.
Big companies who run these programs don’t use them as their only security. It’s a bonus program. They have internal employees and often third parties doing testing too.
> I'm surprised these programs aren't pushed harder, as the potential ROI seems fantastic.
I have some exposure to managing one of these programs, which was started by someone who left the company abruptly (right after it went on their resume as an achievement).
It’s a huge amount of work. We got an unbelievable number of bad reports before AI was available. Now it’s just a nightmare. The ratio of bad reports to actual payout-worthy reports was out of control.
Most submitters also tried to inflate the severity of their submission to get to the higher tiers. This created a problem where people were withholding small bugs while they’d try to find a way to chain it or elevate privileges. You could tell because as soon as you detected and closed their exploit, they would hurriedly submit a rushed report to try to claim it and then argue with you for not paying out because it was fixed before they submitted it.
We had payouts that went to larger numbers, but honestly I think it would have been better off if we didn’t. This makes bystanders irate, but honestly the incentives get bad when the payouts are large and everyone is spamming LLM bots at your service.
The young researcher is a teenager. Getting your name out there, clout/influence/fame, is worth $1M to them.
It’s almost like most of you people have already forgotten your teenage years. And it shows. Doesn’t matter the decade or generation. A teenager , likely living with parents or grandparents, will always prioritize intangibles.
A mere 5 bands for full editorial control is quite literally peanuts for M$. It’s yet another case of abusing free labor, unfortunately.
If I have an income of $250k/yr and a pack of peanuts costs $2 or very roughly 0.001% of my annual income, the equivalent peanut money for ~$130 billion a year microsoft would be more like $2 million.
I personally think it sets a bad precedent: you want to broadcast that valuable info will be treated as such. A hacker in the future will see this, compare the "precedent" price to the black market, and not even ask Microsoft the next time.
I find it perplexing and stingy. Such a bug would likely fetch tens, hundreds of times more on the grey market. Why would anyone not just sell it there? $5000 for trillions of exposed records with PII from Microsoft is a joke.
sdfhbdf · · focus · HN ↗
It's a little perplexing. Of course it's always a controversial topic since it's difficult to value an exploit, but whenever we read about these online, which probably goes through some survivorship bias, they seem pretty low.
On <a href="https://www.microsoft.com/en-us/msrc/bounty" rel="nofollow">https://www.microsoft.com/en-us/msrc/bounty it seems the top is $100,000 or $250,000 depending which program this counts under.
What does HN think? Why would it be only $5000?
muglug · · focus · HN ↗
Zero-click iPhone exploits that affect the current OS and also previous ones are worth hundreds of thousands.
buckle8017 · · focus · HN ↗
yieldcrv · · focus · HN ↗
the unilaterally set awards by the affected corporation are far lower and based on the price of the researcher’s liability
Perz1val · · focus · HN ↗
bix6 · · focus · HN ↗
k2xl · · focus · HN ↗
3.85 billion is actually closer to a "penny" for Microsoft.
poly2it · · focus · HN ↗
<a href="https://www.microsoft.com/investor/reports/ar25/index.html" rel="nofollow">https://www.microsoft.com/investor/reports/ar25/index.html
TeMPOraL · · focus · HN ↗
You could view the bounty prices as market evidence that most of this is rightfully treated as nothingburgers. I.e. the alternative to paying $5000 to some random person for this class of vulnerability research is not risking a trillion dollar hack the next day - it's just risking shmaybe some kerfuffle down the line, followed by fixing it through normal triage process. The bounty program is as much marketing as security, and $5000 is probably about the right price for marginal effort into sustaining the "we are treating security seriously" message.
In a way, the very existence of those bug bounty programs in large companies is evidence they don't see a reason to treat vulnerabilities seriously enough to proactively find and fix them in-house.
If security vulnerabilities would be anywhere serious as most commenters on-line seem to think, companies would pay hundreds of thousands for serious vulnerabilities, just to save a day before they get hit by them - on top of spending millions in-house to try and stay ahead of the attackers.
But they don't. Because most exploits are inconsequential and/or aren't being exploited much.
TedDoesntTalk · · focus · HN ↗
TeMPOraL · · focus · HN ↗
giancarlostoro · · focus · HN ↗
There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued.
elmer2 · · focus · HN ↗
He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.
We shouldn't support theft and he should have gotten some jail time/punishment for it.
"There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."
Too many 'security researchers' demand money or threaten to release the vulnerabilities.
I don't know anyone that got into trouble going through a legit bug bounty program.
thereader12 · · focus · HN ↗
mosseater · · focus · HN ↗
You can call that "theft" as much as you want. There are lots of people like Aaron out there that think this sort of information should be freely available.
Just because there is a law doesn't mean that that law is just and correct. Saying we "shouldn't support theft" is an over-simplification of the situation.
latexr · · focus · HN ↗
He was intimidated to the point of suicide, and somehow you don’t think that’s punishment enough?
omoikane · · focus · HN ↗
<a href="https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=tptacek%20bounty%20market&sort=byDate&type=comment" rel="nofollow">https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
This one probably has the best summary:
<a href="https://news.ycombinator.com/item?id=43025038">https://news.ycombinator.com/item?id=43025038
elmer2 · · focus · HN ↗
$5,000 is actually pretty normal for a critical. I think the most I received for one bug was around $10,000, but this is the exception.
AI has also ruined the market. I'm a security consultant (where I make most of my money) and stopped bug bounty once AI slop reports made it impossible to actually get anything triaged in a timely manner.
Something else many don't know is that with all of the major platforms, customers can see the bugs before they are even triaged by the platform team. Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.
physicallyIllfr · · focus · HN ↗
[dead]
msdz · · focus · HN ↗
Isn’t that just a speedrun-encouragement for selling the exploit not to the one offering the product, but an attacker offering more (in this case, >$0 is not difficult to exceed) instead?
dfxm12 · · focus · HN ↗
xnickb · · focus · HN ↗
rnxrx · · focus · HN ↗
Aurornis · · focus · HN ↗
Big companies who run these programs don’t use them as their only security. It’s a bonus program. They have internal employees and often third parties doing testing too.
> I'm surprised these programs aren't pushed harder, as the potential ROI seems fantastic.
I have some exposure to managing one of these programs, which was started by someone who left the company abruptly (right after it went on their resume as an achievement).
It’s a huge amount of work. We got an unbelievable number of bad reports before AI was available. Now it’s just a nightmare. The ratio of bad reports to actual payout-worthy reports was out of control.
Most submitters also tried to inflate the severity of their submission to get to the higher tiers. This created a problem where people were withholding small bugs while they’d try to find a way to chain it or elevate privileges. You could tell because as soon as you detected and closed their exploit, they would hurriedly submit a rushed report to try to claim it and then argue with you for not paying out because it was fixed before they submitted it.
We had payouts that went to larger numbers, but honestly I think it would have been better off if we didn’t. This makes bystanders irate, but honestly the incentives get bad when the payouts are large and everyone is spamming LLM bots at your service.
xyst · · focus · HN ↗
It’s almost like most of you people have already forgotten your teenage years. And it shows. Doesn’t matter the decade or generation. A teenager , likely living with parents or grandparents, will always prioritize intangibles.
A mere 5 bands for full editorial control is quite literally peanuts for M$. It’s yet another case of abusing free labor, unfortunately.
xnyan · · focus · HN ↗
If I have an income of $250k/yr and a pack of peanuts costs $2 or very roughly 0.001% of my annual income, the equivalent peanut money for ~$130 billion a year microsoft would be more like $2 million.
julianeon · · focus · HN ↗
keithnz · · focus · HN ↗
skeptic_ai · · focus · HN ↗
asaddhamani · · focus · HN ↗