News for hackers. Stuff that matters.
Re:Slack account takeovers using HTTP Request Smuggling by NikolaeVarius on Friday March 13, 2020 @12:25PM (#22568572)
The literal hacker themselves indicated it was a fair payout.

I don't understand unsolicited complaining for other people.

Re:Slack account takeovers using HTTP Request Smuggling by pathseeker on Friday March 13, 2020 @12:58PM (#22568885)
>I don't understand unsolicited complaining for other people.

If you observe someone getting paid a much lower-than-market amount for something you can complain that the company is being cheap and likely driving away a lot of potential sellers (security researchers in this case) regardless of how happy the one person is.

Re:Slack account takeovers using HTTP Request Smuggling by tptacek on Friday March 13, 2020 @02:31PM (#22569693)
This is not a below-market rate.
Re:Slack account takeovers using HTTP Request Smuggling by fiberoptick on Friday March 13, 2020 @03:16PM (#22570077)
I noticed that throughout this thread you have been making this assertion. Could you share any data or citations to support this?

Would you feel any differently about the value of this bug if it affected, e.g. Google or Facebook?

Re:Slack account takeovers using HTTP Request Smuggling by tptacek on Friday March 13, 2020 @03:28PM (#22570168)
No, I would not feel differently about it. The same dynamic would apply.

People on HN seem generally to believe that for any malicious activity you could do with a bug, there's a bidding group of willing buyers somewhere on some darknet site. That's not the case. Random bugs like this may get passed around, but the bugs that command a price all fit a couple specific molds: they're things you can drop into someone's existing operational process.

A Firefox drive-by RCE has some value: many organizations are set up to actively exploit Firefox browsers. So does an iOS jailbreak: lots of people stockpile iOS jailbreaks, for malware implants and for other purposes.

An important common thread among the bugs with liquid markets is that they have a meaningful half-life: once they're burned, it still takes time to eradicate the vulnerable installations. Serverside bugs are fixed worldwide instantaneously. You can see this dynamic in how grey-market payments are tranched.

Re:Slack account takeovers using HTTP Request Smuggling by pathseeker on Friday March 13, 2020 @04:13PM (#22570490)
This ignores the black market. This exploit would have been extremely valuable to insider trading rings.
Re:Slack account takeovers using HTTP Request Smuggling by kjaftaedi on Friday March 13, 2020 @12:45PM (#22568751)
They're not 'complaining' about the amount in the way that you're thinking.

They're suggesting that the severity of such a bug warrants a larger payout, because not doing so creates possible incentives for future explorers to consider selling these sorts of things on the black market.

This person may be satisfied, the next person that finds something similar may think twice.

Re:Slack account takeovers using HTTP Request Smuggling by empath75 on Friday March 13, 2020 @12:59PM (#22568901)
I do wonder what the FSB would have paid for it tho.
Re:Slack account takeovers using HTTP Request Smuggling by whiskeykilo on Friday March 13, 2020 @12:55PM (#22568853)
It's a free market. Don't like the payout? Don't submit the bug. Someone else probably will anyway