Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researcher Blows $15K By Reporting Bug To Google

Posted by timothy on from the can't-win-'em-all dept.

CWmike writes "A security researcher lost a sure $15,000 at this week's Pwn2Own hacking contest because he had earlier reported the bug to Google, which has patched the vulnerability in its Android Market. 'I missed out money wise,' said Jon Oberheide, co-founder and CTO of Duo Security, a developer of two-factor authentication software. 'But it was good that Google is rewarding researchers. And now I have my first Android vulnerability that qualified for a bounty.' Google cut a check to Oberheide for $1,337."

19 of 69 comments (clear)

  1. Nice! by Anonymous Coward · · Score: 2, Interesting

    I wish Google would cut me checks for $leet ;-) Gotta hand Google some props for style, though! And congratulations to Mr. Oberheide; maybe he didn't get the full $15k, but getting a check at all is pretty cool!

    1. Re:Nice! by mysidia · · Score: 2

      I would rather Google cut me checks for 31337.

    2. Re:Nice! by Bacon+Bits · · Score: 2

      Zimbabwean dollars ok?

      --
      The road to tyranny has always been paved with claims of necessity.
  2. Good publicity by houstonbofh · · Score: 3, Informative

    He also got a lot more good press that he might have otherwise. Good for a starting up security company.

    1. Re:Good publicity by Anonymous Coward · · Score: 4, Informative

      No, Pwn2Own is white-hat - successful exploits are never published and full details are given to the developer. He only reported it beforehand because he mistakenly believed it wouldn't be a permitted exploit for the competition.

      If you read his comments on the matter he's more upset about not being able to embarrass Google with such a simple exploit than he is about the money.

    2. Re:Good publicity by tlhIngan · · Score: 2, Insightful

      he mistakenly believed it wouldn't be a permitted exploit for the competition.

      Perhaps then he should perceive and do what he would have done if it was not permitted anyways.

      Go find another vulnerability, develop an exploit for it, and earn that $15k.

      Otherwise, consider his mistake a $15,000 lesson.

      More like $15k lesson. I'm not sure if Pwn2Own can really be considered a "white hat" activity - CanSecWest is a white-hat convention for security professionals, yes, but given the way people act for Pwn2Own, it's like they suddenly see the money and turn into black-hats.

      After all, they openly admit sitting on bugs for *years* so they can try to win that new shiny MacBook Pro (I'm not sure what fancy machine they use for Windows/Linux...) during Pwn2Own. (Of course, competition is fierce for the MacBooks because it's the nicest machine there, so it always falls first then all the "losers" focus on the runner up prizes of not-so-nice machines).

      Sure they risk someone else finding the bugs and reporting it, but if the prize is $15k and a $2k computer, it sure beats reporting it and getting whatever paltry sum they can get.

      It's both good and bad, I suppose - companies like Apple can't rely strictly on reports but should proactively search for bugs, but on the flip side, sitting on bugs for years so you can pull it out to try for Pwn2Own doesn't rub me the right way either.

  3. You Know... by CrazyDuke · · Score: 5, Insightful

    If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

    --
    Any sufficiently advanced influence is indistinguishable from control.
    1. Re:You Know... by adisakp · · Score: 4, Insightful

      If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

      Some banks like JP Morgan Chase now let you "deposit" a check by iPhone by taking a picture of the check.

      You could keep the original check in your portfolio while getting the cash as well :-)

    2. Re:You Know... by larry+bagina · · Score: 2

      I wonder what would happen if I "smashed your head in" with a "baseball bat" and then "took" your "wallet".

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

  4. Re:1337 by Anonymous Coward · · Score: 5, Funny

    Does anybody else think the amount of money he received is interesting?

    (Glances at thread.) Pretty much everyone else, yeah.

  5. Re:1337 by Anonymous Coward · · Score: 2, Funny

    "What is $666 multiplied by 2, as calculated on a Pentium computer?"

  6. Slightly over 2 shares.... by olsmeister · · Score: 2

    Should have just given him a couple of shares of stock.

  7. Poor post title by DuranDuran · · Score: 3, Insightful

    Get thee behind me, Satan - a better post title would have mentioned that Google actually rewarded the researcher's honesty. This is a great outcome for everyone, including Android users.

    --
    "You can justify anything by putting it in quotes, adding a famous name and making it a sig" - Albert Einstein
  8. Possibility.. by OopsIDied · · Score: 2

    This might also have been a good decision money-wise if someone else had found the bug but decided to save it for the pwn2own contest. Instead of risking getting $0 by being beat by someone else, he got a still respectable $1,337 relatively stress-free. (Note, I have no idea how small the chance that someone else had actually found the same bug and decided to save it for the contest is)

    1. Re:Possibility.. by arth1 · · Score: 2

      ... or someone else might have discovered it and disclosed it in any other way. Including (but not limited to) bugtraq/cert/mitre/fulldisclosure, or even exploiting the bug, after which AV software detects it.
      To me, all of those seem far more likely.

      Speed is of the essence, because black hats won't wait until the vendor has a fix, or the researcher can publish in the best paying venue. Disclose early, disclose often.

  9. Re:1337 by abednegoyulo · · Score: 2

    Though 600613 is unrealistic, I think it would be much better

  10. Re:1337 by Pseudonym+Authority · · Score: 4, Interesting

    But more importantly, 1337% of pi is....... ~42

  11. Better by Mateorabi · · Score: 2

    Free publicity may be worth more.

    --
    "You saved 1968." - Ms. Valerie Pringle to the crew of Apollo 8

  12. Re:1337 by dakameleon · · Score: 2

    Goddamn, it actually is. How about that.

    --
    Man who leaps off cliff jumps to conclusion.