Slashdot Mirror
Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt
Hugh Pickens DOT Com writes "More and more companies are offering Bug Bounty Programs remunerating security researchers for reporting vulnerabilities and weaknesses in their applications and software. Now Security analyst Graham Cluley writes that researchers at High-Tech Bridge informed Yahoo's Security Team about three cross-site scripting (XSS) vulnerabilities affecting the ecom.yahoo.com and adserver.yahoo.com domains. According to High-Tech Bridge, each of the vulnerabilities could compromise *any* @yahoo.com email account. All that was required was that the victim, while logged into Yahoo, should click on a specially-crafted link received in an email. Forty-eight hours later, Yahoo had patched all of the vulnerabilities and Yahoo's security team responded, thanking the researchers and 'offering the mighty bounty of err.. $12.50 per vulnerability,' writes Cluley. But there was one catch. The $12.50 was given as a discount code that can only be used in the Yahoo Company Store, which sells Yahoo's corporate t-shirts, cups, pens and other accessories."
What's the problem? :P
I read TFA and all I got was this lousy cookie
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy.
They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
Don't you know that security vulnerabilities go into the NSA arsenal before they are fixed? Why do you still do "responsible disclosure"? Why do you work with the vendors at all? Security vulnerabilities are valuable, but you're propping up a corrupt system and get only peanuts in return, if anything. The NSA does not have moral hangups about their war on the internet. They use what you give them to undermine any and all security protocols. The only problem that companies like Yahoo have with cooperating is when they're found out. They have no shame, only interests.
With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"
what kind of cheap a&&ed finished plated poor 4 sides kind of reward is this ? honesty truly does not pay :\ .at least fork over a complete , stitched and sewn together " We're cheap " tshirt. :\ Might as well be a slap in the face and a kick in the crotch.
Come on Yahoo .
How insulting it is to get that kind of reward
You don't know what 12.5 is ?!?
And you call yourselves geeks... Ahahahaha!
Curiously yours, crip.
Why not half of what an exploit like that could cost on the black market, because that's how much it'll cost to even begin to look like anyone will pay attention to their 'bug bounty program'.
When Microsoft lost their Hotmail domain name, some guy snatched it and kindly returned it to Microsoft because he thought it was the right thing to do, to protect Microsoft from their stupidity. Well, Microsoft sent him a personal thank you note and that was all. Yep, the guy could have legally resold the domain for like a billion dollars (wouldn't be the first time.. ahem, live.com) and gotten away with it. All he got was a lousy certificate of gratitude.
C'mon. This is WAY better than the Standard Operation Practice: suing them into the ground.
We're moving forward, it seems.
No-one forced you to fix any bugs. If you want to be a 'security researcher', either fix bugs for people who have said that they want you to and will pay you, suck up the $12.50, or do 'full disclosure' (and get nothing but the kudos).
Don't play by the rules, then come whining when you don't like what you get. The internet is not your personal army.
If you don't like the way it is, try being a street sweeper instead. (Note that here too, you usually have to have a prior agreement with a municipality to clean the specific streets they want you to and get paid for it. You can't just sweep the streets you choose and then hassle the owners for cash.)
Well, $12.50 is certainly not worth the time and effort. But, it's not like the researchers could easily nor legally sell the information for a bigger profit. Having invested the time, they would've earned more fame/respect disclosing the vulnerabilities to the public.
Where's the major failure here? Well, the researchers should not have sold their research to yahoo for $12.50.
More fundamentally, for $12.50 a vuln, no reasonable person would expect yahoo to ever receive a notice via this system. Yahoo, however, has a monopoly as the only interested party and all they offer is $12.50. Take it or leave it.
I'd suggest finding a shady Russian bar and explain that you have services to offer to the organized crime syndicate to the bartender. The bartender will likely tell you to fuck off and that he knows nothing about this. Buy a drink and wait. Someone will speak to you.*
*: This may fail terribly.
There was no expectation in the beginning except to get the problem solved, and that's what happened. Do you want them to hold the vulnerabilities for ransom or something? Maybe in the future some good samaritan will help you out with one of your problems too. Think of all the users you have helped out as well.
Twinstiq, game news
.. that the bounty has to be a large financial reward?
The testing area is just up ahead. The quicker you get through, the quicker you'll get your 60 bucks. Caroline, are the compensation vouchers ready?
-Cave Johnson
I think Yahoo acted correctly in this case. I think paying people to much for bugs will distort the security landscape. The reason is security is an issue about the common good. No vulnerability is good... even if it is in your competitors products. We should have a culture of assisting with security issues without expecting money for it.
What will we have? People selling vulnerabilities to the highest bidder which is socially acceptable? Note that the word here is social, NOT commercial.
Of course security researches needs to get paid... but I think there are other ways that will be more effective and more thorough. Grants to universities for security research, dedicated employees/teams focusing on security and possibly even government/industry bodies funded by tax and/or membership fees. And focus on security where the impact is the biggest... not which get the most headlines....
how about creating a bidding portal like ebay but all about security vulnerabilities. illegal? then lets do an onion site.
$12.5 is pathetic and we should teach them a lesson.
COMMUNIST!
As long as the beneficiary is a corporation, that is...
Sorry, you wanted work done, you should pay for it. you get what you pay for and how much work do you want for $12.50 that is not even worth that since you can at least pay rent with cash. Pay your landlord with a voucher instead and see how much it's worth...
If you can't be bothered to sell to a spammer, or don't have connections to sell it on the darknet, then don't do the work.
However, that doesn't solve the problem of security holes being in Yahoo services either. But that's Yahoo's fault.
They could also just ignore telling Yahoo at all and tell EVERYONE about it. Then people know Yahoo is insecure and can stop using it. The problem here is why should someone care to spend their time on searching and telling Yahoo alone about the bugs?
They paid 12.50 for every user that still uses Yahoo.com
Why do you think that if someone finds a vulnerability in Yahoo's stuff their efforts now belong to Yahoo? What if the person just doesn't want to give it to Yahoo? Do you think that their work should be taken from them summarily? Maybe in the future, only those willing and able to sell the vulnerability to scammers and criminals will be the ones looking because the others had to find some other work that pays bills.
Stuff like this makes me wonder if there will be any professional security researchers if no careers are possible. No one can make a living getting $12.50 occasionally. I thought we needed more security professionals, but if they can't have careers, we won't have them.
I once registered domains through Yahoo! (They actually used an Australian company at the time)...
So one day I needed to setup my own DNS servers (which is one of their products), and after talking for what seemed like days with several of their "tech support" reps, who, no matter how hard I tried, just couldn't figure out what I was talking about. So I finally said something like "what is wrong with you people". His response was to hang up and delete my account leaving me stuck with a bunch of customers domains in limbo. I had to call Australia, arrange to transfer all the domains to another registrar... it was a mess.
F-U Yahoo! I won't touch you with a 50,000 ft pole. I won't visit your websites, groups, or answer email from your users. You are Yucky!
If I lend money to the bank, they pay me back 1% of interest....if I get a loan from them, for the same amount, I have to pay 3%.... fair?
the concept of honor, real gratitude, moral and values doesn't matter ...you just crush your enemies....and if they are crushing you, after killing half of your soldiers, you make a deal..
Wow. That's all kind of fail. It would be better for Yahoo to state as a matter of policy that they don't pay bounties. You might disagree with that; but at least you'd respect it. What they did instead is the equivalent of leaving a nickel tip at a restaurant. Giving nothing makes you look cheap, careless or unaware of tipping customs. Giving the nickel says, "yes, I know I should tip, here's what I think you're worth".
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
That's quite a blatant yet sneaky way to get these blokes' addresses and credit card infos -- tshirt+shipping is likely over $12.50. Know thine whitehat.
A T-shirt or something...
Hey! It's better than getting sued!
(As has happened before.)