I don’t think we’re ready for the absolute warp-speed break down of reliable references this process of slop creation, citation, and publication that is going to occur.
If you’re saying that bug bounties exist for a reason according to both the program runners and the contributors then how is that not the reason they exist?
The people paying and the people working are all in agreement that it exists for that reason.
What part of my logic do you not follow? The way you've posed this question, the simplest response would require me to write that whole comment over again.
Additionally, part of my businesses remediation services include helping companies set up bug bounty programs. Giving researchers an incentive to report bugs for payouts instead of selling or exploiting them for profits is always the intended goal.
It's the product of direct interviews with bounty people, FAANG/MAG7 blue teamers, and black market participants. If you want more, there's also an interview online that we did with Mark Dowd, who is one of the best known CNE vendors to the NATO IC. You can just Google [SCW Mark Dowd].
I'm happy to go into more detail, but, like I said, you didn't really respond to my comment in any way that I could expand on. Feel free to disagree with me in some kind of specific way.
This really is simple: if you work in this space, you already know that there's essentially no black market at all for serverside web bugs. But there's a $90k bounty for this one, and 5-figure bounties for others. Reconcile those two facts.
Well thats nice and Im happy for you but internet points don’t really mean much here…
What a vulnerability sells for and how much damage someone could do exploiting it are two different things. Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.
A company paying big bucks isn’t a contradiction. Its incentivizing disclosure over exploitation which could cost them considerably more. Engineering prioritization is… a minor part of it informed by the ease of exploitation, damage it could do (in the case of an RCE or publicly available keys as in this case quite a bit) etc.
I don’t see why you think these things are mutualy exclusive.
Having given up on the original argument ("Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.") you've now transitioned to a new one: that vulnerabilities can be used by the hackers who find them to plan heists. And that is true. It doesn't set any kind of market-clearing price, and selects for actors who are comfortable ending up in prison, but it is indeed a statement that aligns with reality.
My original comment explicitly said “selling or exploiting them for profits.” You are just ignoring the second half for some reason.
I think you need to breathe a bit and then re-read my comment. I’m not coming at you, I’m saying that what an exploit sells for and what it could cost a company if exploited are entirely different things. That’s where you’re hung up.
Companies have an obvious financial incentive to encourage discovery and disclosure before exploitation.
“Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.”
I’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it.
>If you take the post-mortems on the psyops campaigns from our national adversaries at face-value
Which is a bad premise, because despite how much "russian troll farms" (and now "chinese AI troll farms") is bandied around in the media, it's entirely unclear how big their impact is, if any.
I see sentiment like this (which is valid; it’s a different perspective), and then I look at my company’s current caseload of breaches and how most of the (insane) increase in business we’ve received is caused by poorly coded apps with obvious security issues, along with the inability of orgs to remediate those issues or adequately follow incidents because no one actually knows the applications anymore.
And I’m wondering if this isn’t the enormous amount of organizational debt from having security second to everything finally coming calling.
Not in security, but "vibe coding remediation"--that's the best way I can think to describe it--has been a booming business in my line of work (SIP/VoIP infrastructure engineering) as well.
How long it'll last, I can't say, only that before LLMs, the industry entered a phase of consolidation and quiescence that had me seriously worried about a fade into irrelevance. The delusions of businesspeople and the managerial class about what LLMs can do has fueled a very nice business renaissance, as they run into the limits but have committed to contracts, business models, etc.
I’ll give you an example of one that was written recently actually.
The initial compromise happened because the app explicitly did not verify auth claims when a specific string was in the ISS field. Well, fuzzers exist and are common.
The next issue was that once you’re in, there was no delineation between admin and regular users. Everyone had all privileges if they just made the calls.
Anyway, we did the usual post-remediation investigation and write up. The devs were of course using the latest models, as they were instructed, and the issue stemmed from a problem they’d been having integrating a specific company into their auth scheme.
Eventually, after many enumerations, the model opted to just skip auth altogether if that companies ISS was present. The devs, being in the habit of just accepting the changes did so and because of the nature of the code implemented nothing caught it in the pipeline.
This is sadly an incredibly common story and it won’t be fixed by models improving I don’t believe.
This was the result of what unfolded after regional electricity prices spiked (550%) after a corporation decided to take a lot of local power for itself.
After local opposition began forming, Shiawase Corporation made a false flag attack against itself to influence a future ruling where it could then defend itself similar to a sovereign nation in a foreign land. So full corporate “extraterritoriality”, to where maintaining its own regulated militia/defense force would be legally free and clear.
This is something that I worry about as well for my junior incident responders at my company.
We have a culture that I’ve pushed to always understand what the model is doing, even if you have to go back after the response action is done and walk through it step by step.
I encourage everyone to use AI to the extent that they feel comfortable and can do their jobs but I feel it’s necessary to always be able to do what the LLM has done if you don’t have access to it
I was interested until I saw the picture for labor month was a clearly generated picture with protest signs saying “Workers Unit” instead of “Workers Unite”.
Does that mean everything in the site is bogus or low-effort? No, but it means I don’t want to potentially waste my time or be misled.
reply