Slashdot Mirror
Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt
Hugh Pickens DOT Com writes "More and more companies are offering Bug Bounty Programs remunerating security researchers for reporting vulnerabilities and weaknesses in their applications and software. Now Security analyst Graham Cluley writes that researchers at High-Tech Bridge informed Yahoo's Security Team about three cross-site scripting (XSS) vulnerabilities affecting the ecom.yahoo.com and adserver.yahoo.com domains. According to High-Tech Bridge, each of the vulnerabilities could compromise *any* @yahoo.com email account. All that was required was that the victim, while logged into Yahoo, should click on a specially-crafted link received in an email. Forty-eight hours later, Yahoo had patched all of the vulnerabilities and Yahoo's security team responded, thanking the researchers and 'offering the mighty bounty of err.. $12.50 per vulnerability,' writes Cluley. But there was one catch. The $12.50 was given as a discount code that can only be used in the Yahoo Company Store, which sells Yahoo's corporate t-shirts, cups, pens and other accessories."
What's the problem? :P
I read TFA and all I got was this lousy cookie
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy.
They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
Don't you know that security vulnerabilities go into the NSA arsenal before they are fixed? Why do you still do "responsible disclosure"? Why do you work with the vendors at all? Security vulnerabilities are valuable, but you're propping up a corrupt system and get only peanuts in return, if anything. The NSA does not have moral hangups about their war on the internet. They use what you give them to undermine any and all security protocols. The only problem that companies like Yahoo have with cooperating is when they're found out. They have no shame, only interests.
With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"
Why not half of what an exploit like that could cost on the black market, because that's how much it'll cost to even begin to look like anyone will pay attention to their 'bug bounty program'.
When Microsoft lost their Hotmail domain name, some guy snatched it and kindly returned it to Microsoft because he thought it was the right thing to do, to protect Microsoft from their stupidity. Well, Microsoft sent him a personal thank you note and that was all. Yep, the guy could have legally resold the domain for like a billion dollars (wouldn't be the first time.. ahem, live.com) and gotten away with it. All he got was a lousy certificate of gratitude.
C'mon. This is WAY better than the Standard Operation Practice: suing them into the ground.
We're moving forward, it seems.
There was no expectation in the beginning except to get the problem solved, and that's what happened. Do you want them to hold the vulnerabilities for ransom or something? Maybe in the future some good samaritan will help you out with one of your problems too. Think of all the users you have helped out as well.
Twinstiq, game news
But that is the whole point, Yahoo hasn't got a monopoly because they aren't the only interested party.
Next time, the researchers (not just these guys, but researchers in general) are going to ask why they should give Yahoo first bid when they know it's going to lead to nothing but an insult for their efforts.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
I think Yahoo acted correctly in this case. I think paying people to much for bugs will distort the security landscape. The reason is security is an issue about the common good. No vulnerability is good... even if it is in your competitors products. We should have a culture of assisting with security issues without expecting money for it.
What will we have? People selling vulnerabilities to the highest bidder which is socially acceptable? Note that the word here is social, NOT commercial.
Of course security researches needs to get paid... but I think there are other ways that will be more effective and more thorough. Grants to universities for security research, dedicated employees/teams focusing on security and possibly even government/industry bodies funded by tax and/or membership fees. And focus on security where the impact is the biggest... not which get the most headlines....
Why do you think that if someone finds a vulnerability in Yahoo's stuff their efforts now belong to Yahoo? What if the person just doesn't want to give it to Yahoo? Do you think that their work should be taken from them summarily? Maybe in the future, only those willing and able to sell the vulnerability to scammers and criminals will be the ones looking because the others had to find some other work that pays bills.
Wow. That's all kind of fail. It would be better for Yahoo to state as a matter of policy that they don't pay bounties. You might disagree with that; but at least you'd respect it. What they did instead is the equivalent of leaving a nickel tip at a restaurant. Giving nothing makes you look cheap, careless or unaware of tipping customs. Giving the nickel says, "yes, I know I should tip, here's what I think you're worth".
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
The vouchers are traceable. The REAL reward is coming AFTER the winner or researcher tries to claim it or use it at the store. Supply your own ending e.g. Congratulations, here's your new office...
WARNING: Smartphones have side effects--most of them undocumented.
It sure doesn't need to be an insult. A $13 voucher that can only be spent to advertise the company...that's an insult.
I think we've pushed this "anyone can grow up to be president" thing too far.
That's quite a blatant yet sneaky way to get these blokes' addresses and credit card infos -- tshirt+shipping is likely over $12.50. Know thine whitehat.
A T-shirt or something...
Hey! It's better than getting sued!
(As has happened before.)