News for hackers. Stuff that matters.
Re:Slack account takeovers using HTTP Request Smuggling by pathseeker on Friday March 13, 2020 @12:58PM (#22568885)
>I don't understand unsolicited complaining for other people.

If you observe someone getting paid a much lower-than-market amount for something you can complain that the company is being cheap and likely driving away a lot of potential sellers (security researchers in this case) regardless of how happy the one person is.

Re:Slack account takeovers using HTTP Request Smuggling by tptacek on Friday March 13, 2020 @02:31PM (#22569693)
This is not a below-market rate.
Re:Slack account takeovers using HTTP Request Smuggling by fiberoptick on Friday March 13, 2020 @03:16PM (#22570077)
I noticed that throughout this thread you have been making this assertion. Could you share any data or citations to support this?

Would you feel any differently about the value of this bug if it affected, e.g. Google or Facebook?

Re:Slack account takeovers using HTTP Request Smuggling by tptacek on Friday March 13, 2020 @03:28PM (#22570168)
No, I would not feel differently about it. The same dynamic would apply.

People on HN seem generally to believe that for any malicious activity you could do with a bug, there's a bidding group of willing buyers somewhere on some darknet site. That's not the case. Random bugs like this may get passed around, but the bugs that command a price all fit a couple specific molds: they're things you can drop into someone's existing operational process.

A Firefox drive-by RCE has some value: many organizations are set up to actively exploit Firefox browsers. So does an iOS jailbreak: lots of people stockpile iOS jailbreaks, for malware implants and for other purposes.

An important common thread among the bugs with liquid markets is that they have a meaningful half-life: once they're burned, it still takes time to eradicate the vulnerable installations. Serverside bugs are fixed worldwide instantaneously. You can see this dynamic in how grey-market payments are tranched.

Re:Slack account takeovers using HTTP Request Smuggling by pathseeker on Friday March 13, 2020 @04:13PM (#22570490)
This ignores the black market. This exploit would have been extremely valuable to insider trading rings.