What Happens When You Send a Zero-Day to a Bank?

Re:What Happens When You Send a Zero-Day to a Bank? by venantius on Friday April 21, 2017 @08:35PM (#14170501)

As someone who has been on the receiving end of a bug bounty's mailbox, 3-to-1 sounds about right. We got a ton of invalid "security vulnerabilities" that were essentially either people reporting OAuth as a vulnerability or not understanding how XSS actually worked. Most of these came from teenagers in southeast Asia.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by charleslmunger on Saturday April 22, 2017 @12:32AM (#14171128)

I've also seen lots of reports of some serious vulnerability - "major product X doesn't validate TLS certificates" - where it looks like the reporter forgot they had added their own cert to the OS's trust store.

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by logicallee on Friday April 21, 2017 @08:42PM (#14170525)

super-interesting - thanks.

[ Parent | on HN ]