Re:My car insurance exposed my location
by tptacek on Saturday December 09, 2017 @11:11AM
(#15886392)
Not much. It's a good finding; as a bounty submission (for a good company), I could see it getting $1-$2k. But I don't think there's a market for these kinds of information leakage bugs. As a rule of thumb: if you can't plug a vulnerability directly into a business process that was already built and operationalized on some other vulnerability, it's probably not worth anything on the black market.
[ Parent
| on HN ]
Re:My car insurance exposed my location
by jdavis703 on Saturday December 09, 2017 @11:17AM
(#15886417)
It might be good for class action lawyers and bounty hunters to start teaming up. Then the company either settles up to avoid a trial and bad publicity, or else they have an expensive court battle with potential negative PR coming out.
Re:My car insurance exposed my location
by tptacek on Saturday December 09, 2017 @11:47AM
(#15886579)
Something like that already happened with Justine Bone and Medsec.
This seems like the kind of bug that can cause a lot of harm (if a malicious actor wants to track someone's location) but not so much profit (no generic mass-account-stealing).
And that's a situation that the US legal system isn't well set up for.