News for hackers. Stuff that matters.

A comment on Instagram's Million Dollar Bug (2015). Parent comment

Re:Instagram's Million Dollar Bug (2015) by MaxBarraclough on Monday December 14, 2020 @06:54PM (#25425099)
> the severity of the exploit, not the potential damage you could do with it

Isn't severity measured in terms of potential damage?

[ Parent | on HN ]
Re:Instagram's Million Dollar Bug (2015) by WalterGR on Monday December 14, 2020 @06:59PM (#25425143)
Yes.

https://www.facebook.com/BugBounty/posts/approaching-the-10t...

CDN bug report... Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our CDN... a very sophisticated attacker could have escalated to remote code execution. As we always do, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty — $80,000.

[ Parent | on HN ]