Slashdot Mirror
Security Researchers Rewarded With $12.50 Voucher To Buy Yahoo T-Shirt
Hugh Pickens DOT Com writes "More and more companies are offering Bug Bounty Programs remunerating security researchers for reporting vulnerabilities and weaknesses in their applications and software. Now Security analyst Graham Cluley writes that researchers at High-Tech Bridge informed Yahoo's Security Team about three cross-site scripting (XSS) vulnerabilities affecting the ecom.yahoo.com and adserver.yahoo.com domains. According to High-Tech Bridge, each of the vulnerabilities could compromise *any* @yahoo.com email account. All that was required was that the victim, while logged into Yahoo, should click on a specially-crafted link received in an email. Forty-eight hours later, Yahoo had patched all of the vulnerabilities and Yahoo's security team responded, thanking the researchers and 'offering the mighty bounty of err.. $12.50 per vulnerability,' writes Cluley. But there was one catch. The $12.50 was given as a discount code that can only be used in the Yahoo Company Store, which sells Yahoo's corporate t-shirts, cups, pens and other accessories."
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy.
They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
With the tshirt that says "I found a vulnerability and all I got was this lousy T-Shirt"
Have you seen the new Yahoo logo?
Surely they sell a T-shirt that reads "I saved Yahoo! public embarrasement, millions of dollars in damages and all I got was this lousy T-shirt".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
There weren't any in XXL.
When Microsoft lost their Hotmail domain name, some guy snatched it and kindly returned it to Microsoft because he thought it was the right thing to do, to protect Microsoft from their stupidity. Well, Microsoft sent him a personal thank you note and that was all. Yep, the guy could have legally resold the domain for like a billion dollars (wouldn't be the first time.. ahem, live.com) and gotten away with it. All he got was a lousy certificate of gratitude.
C'mon. This is WAY better than the Standard Operation Practice: suing them into the ground.
We're moving forward, it seems.
Which part of "Forty-eight hours later, Yahoo had patched all of the vulnerabilities" did you miss?
If you want to object here, then get that tinfoil hat straight and get some sharper Occam's razor.
Seriously, if you think "bug reported to Yahoo -> NSA demands it from Yahoo -> NSA quickly uses it to hack Yahoo's accounts in 2 days -> Yahoo patches it" is realistic, then you should realize that "NSA demands access to Yahoo accounts -> NSA leisurely browses through all Yahoo accounts they want" would be much more plausible.
FFS, learn the fucking difference between software on your PC and web services at least. In the latter case, govt spooks won't need any vulnerabilities if it comes to that - they can just come with a subpoena/NSL/whatever.
I know, at least Yahoo! didn't insult them by offering them a job at Yahoo! or something...
You are not alone. This is not normal. None of this is normal.
At least Yahoo! thanked them explicitly and didn't threaten to sue them.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Wow. That's all kind of fail. It would be better for Yahoo to state as a matter of policy that they don't pay bounties. You might disagree with that; but at least you'd respect it. What they did instead is the equivalent of leaving a nickel tip at a restaurant. Giving nothing makes you look cheap, careless or unaware of tipping customs. Giving the nickel says, "yes, I know I should tip, here's what I think you're worth".
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
The problem is that Yahoo just sent out a message to every grey hat, letting them know "if you want anything other than a T-Shirt talk to the metasploit guys" and ya know what? they will. Its not just about the money, its about respect. A t-shirt is the kind of prize you get from some DJ standing on a street corner NOT what you get for saving a company endless bad press and possible millions in pissed off users.
Of course the real bitch isn't just the XSS, its when you mix that with an insecure browser you get a real perfect shitstorm. See my journal for what I labeled the "Yahoo porn bug" a couple years back, if you take Yahoo and ONLY Yahoo, didn't see this with either Gmail nor Live mail, and Firefox which again ONLY FF, not any of the Chromium or Webkit browsers nor Opera nor IE, put them together and what do you get? you get the ability for spammers to be able to spam entire address books without having any real access at all. They do this by using the fact that FF runs at the same permission levels as the user (which is retarded but Moz refuses to fix, Chromium had the ability to run below user permission more than 6 years ago) and with a hidden iFrame and using the FF auto login (or even just a still valid cookie) they could have access to the entire address book without having to break into the account or even send a drop of data back to themselves.
So as I've been saying for a few years now yahoo really needs to get their shit together, its entirely too easy to use Yahoo email addresses for spamming. The same can be said of Moz, I no longer include any gecko based browsers specifically because they refuse to add low rights mode. Bad security practices are bad practices and insulting those that find bugs by giving them a lousy $12.50 t-shirt? They have made sure the next bug found by a grey hat will only be found out by Yahoo when they are getting pwned.
ACs don't waste your time replying, your posts are never seen by me.
The vouchers are traceable. The REAL reward is coming AFTER the winner or researcher tries to claim it or use it at the store. Supply your own ending e.g. Congratulations, here's your new office...
WARNING: Smartphones have side effects--most of them undocumented.
After lurking on slashdot for the last 10 years, this post finally got me to set up an account. Woo! It's my ... well, you know.
The hypothesis here is that yahoo didn't pay for the exploits, so obviously grey hats will go to the black market. Further, it's ethically justified because of the slap in the face.
I think if you tell a private company that they have a security problem, and they thank you, you can pat yourself on the back. If you're doing it specifically for money, then don't spend your time on yahoo. I don't think it's ethically justified to specifically look for and sell these exploits on the black market, just because you feel morally righteous about a t-shirt. Where are your hacker ethics?
Even more, you've forgotten that you have a civic responsibility. Recently, I drove past a high tension line on route 1, and noticed that one of the towers was about to fall over. I could see it from the highway, and I'm a nerd, so I'm observant. I told dominion VA power about it, and within a day, they had a crew out to fix it. It potentially saved them millions. I asked for nothing in return and got nothing. By your logic, I should sell the location of the next messed up tower to terrorists so they can destroy a chunk of the power grid. Why on earth would I want to do that? Even if I don't use power from those lines, I almost certainly have friends and family that do.
Same with yahoo. Even if I don't use them, someone I know almost certainly does. Why wouldn't I want to perform a civic duty to protect them?
Again, if they won't pay me, I'm not going to walk the entire length of their lines and function as a free lineman for the power company. I'm also not going to be a dick about it. I'm just going to feel good about myself.
Put it this way:
If folks despise a company, some who would otherwise help them will decline to, and others who would otherwise ignore them will act to harm them. Perhaps you don't think people *should* act that way, but they *do*. And I'm not at all certain that this isn't reasonable. I tend to help my friends in preference to helping strangers, and I'd be quite reluctant to help someone who had spit in my face. That I wouldn't give him a faceful of knuckles says more about my being a rather passive person than about what I think is a reasonable reaction.
I think we've pushed this "anyone can grow up to be president" thing too far.
Recycling email addresses is a great time saver. It saved me the hassle of getting myself on spam and porn lists. If not for Yahoo's decision my grandmother would never have discovered the delights of European bestiality. It also meant I didn't have to go making accounts on other services, as I just waiting for newsletters and other mailings to come through so I could use them to reset the passwords of the prior owner.
Top notch idea! I wish Yahoo would make a computer. I know they'd add useful features, such as the "decrypt hard drive" button on the back for those awkward moments when someone has files I really need to see.
-- Using the preview button since 2005
If you contacted me and reported a bug in fakeroot-ng or rsyncrypto, I'd fix it. I'd do it for free. I'll say "thank you" for reporting it.
If you contacted me with the precise same bug, and offered to pay me $1000 to fix it, I'd take your money and fix it as soon as I could, because I believe it is okay for FOSS developers to make money from their work.
If you contacted me and offered to pay me $10, I'd probably be offended.* If you can't afford to pay me a reasonable fee for my time, then ask me nicely to volunteer it. Do not, however, presume to pay me an unreasonable fee for it. There are things I'd happily do for free that I will simply refuse to do for a reward that is demeaning.
Shachar
* - If you waited for me to fix it, and then contributed $10 to my pay pal account, I'd not only say "thank you", I'd even happily tell everyone I know that someone did it. $10 makes for a lousy paycheck, but it's a perfectly reasonable donation.