Subject: Re: Bounty: Consultation on DRAFT Infrastructure and Services Vulnerability Disclosure Statement

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 6 Aug 2020 15:00:57 +0000

It would be great to see comment on this very important question:

>    * Whether or not this statement should be supplemented with a "bug bounty" program.

Jason

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Aug 2020 15:21:04 +0000

>    * Whether or not this statement should be supplemented with a "bug bounty" program.

In my experience (several years running openssl.org), bug bounties for websites are not worthwhile.

---

From: "John Levine" <[email-masked]>
Date: 6 Aug 2020 14:56:33 -0400

>In my experience (several years running openssl.org), bug bounties for websites are not worthwhile.

Agreed. They can be counterproductive and lead to silly situations of
"I won't tell you unless you pay me first because I don't trust you to
pay later."

R's,
John

---

From: Rob Sayre <[email-masked]>
Date: Thu, 6 Aug 2020 12:12:36 -0700

> websites are not worthwhile.

It really depends on how complicated the website is. Lots of web software
companies have bounty programs: <https://hackerone.com/bug-bounty-programs>

I think the IETF infrastructure might be able to use one. Trying it out
seems like a reversible decision, too.

thanks,
Rob

---

From: "Livingood, Jason" <[email-masked]>
Date: Thu, 6 Aug 2020 19:28:07 +0000

I have heard that some security researchers may not bother reporting absent a small bounty. So I would love to hear from any of you that may have direct experience either (1) being paid a bounty as a security researcher or (2) working at company that pays bounties (such as reacting to/validating those bugs).

Thanks
Jason

From: ietf <[email-masked]> on behalf of Rob Sayre <[email-masked]>
Date: Thursday, August 6, 2020 at 3:14 PM
To: "Salz, Rich" <rsalz=[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: Bounty: Consultation on DRAFT Infrastructure and Services Vulnerability Disclosure Statement

    >    * Whether or not this statement should be supplemented with a "bug bounty" program.

In my experience (several years running openssl.org<https://urldefense.com/v3/__http:/openssl.org__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPmIXuesN$>), bug bounties for websites are not worthwhile.

It really depends on how complicated the website is. Lots of web software companies have bounty programs: <https://hackerone.com/bug-bounty-programs<https://urldefense.com/v3/__https:/hackerone.com/bug-bounty-programs__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPjBP5Y6D$>>

I think the IETF infrastructure might be able to use one. Trying it out seems like a reversible decision, too.

thanks,
Rob

---

From: Rob Sayre <[email-masked]>
Date: Thu, 6 Aug 2020 12:45:50 -0700

Both (I donate the bounties).

I would suggest contracting it out to something like Hackerone for an
experiment, so the initial strain on the IETF is low.

thanks,
Rob

On Thu, Aug 6, 2020 at 12:28 PM Livingood, Jason <
[email-masked]> wrote:

> I have heard that some security researchers may not bother reporting
> absent a small bounty. So I would love to hear from any of you that may
> have direct experience either (1) being paid a bounty as a security
> researcher or (2) working at company that pays bounties (such as reacting
> to/validating those bugs).
>
>
>
> Thanks
>
> Jason
>
>
>
> *From: *ietf <[email-masked]> on behalf of Rob Sayre <
> [email-masked]>
> *Date: *Thursday, August 6, 2020 at 3:14 PM
> *To: *"Salz, Rich" <rsalz=[email-masked]>
> *Cc: *"[email-masked]" <[email-masked]>
> *Subject: *Re: Bounty: Consultation on DRAFT Infrastructure and Services
> Vulnerability Disclosure Statement
>
>
>
> On Thu, Aug 6, 2020 at 8:21 AM Salz, Rich <rsalz=
> [email-masked]> wrote:
>
> In my experience (several years running openssl.org
> <https://urldefense.com/v3/__http:/openssl.org__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPmIXuesN$>),
> bug bounties for websites are not worthwhile.
>
>
>
> companies have bounty programs: <https://hackerone.com/bug-bounty-programs
> <https://urldefense.com/v3/__https:/hackerone.com/bug-bounty-programs__;!!CQl3mcHX2A!QieyyWr7vAnR2jz6yx1D3fxr_mu4TMQOtrCTYOm7swW6-DqpFLzP5ztk1WNK4dInPjBP5Y6D$>
> >
>
>
>

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Aug 2020 19:46:12 +0000

*   It really depends on how complicated the website is. Lots of web software companies have bounty programs: <https://hackerone.com/bug-bounty-programs<https://urldefense.proofpoint.com/v2/url?u=https-3A__hackerone.com_bug-2Dbounty-2Dprograms&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=9yopDRX42PExPbYF-eggvlq4FExMfOLqx8W5jhXhGco&s=UjUf-cfSf4dYMzBfB4ZCyDTIC51syIcsOO2WkqSbicE&e=>>

I stand by my opinion. I also don’t recommend H1 since you mentioned them.

---

From: Rob Sayre <[email-masked]>
Date: Thu, 6 Aug 2020 12:55:03 -0700

On Thu, Aug 6, 2020 at 12:46 PM Salz, Rich <[email-masked]> wrote:

>
>    - It really depends on how complicated the website is. Lots of web
>    software companies have bounty programs: <
>    https://hackerone.com/bug-bounty-programs
>    <https://urldefense.proofpoint.com/v2/url?u=https-3A__hackerone.com_bug-2Dbounty-2Dprograms&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=9yopDRX42PExPbYF-eggvlq4FExMfOLqx8W5jhXhGco&s=UjUf-cfSf4dYMzBfB4ZCyDTIC51syIcsOO2WkqSbicE&e=>
>    >
>
>
>

Well, as someone who's triaged reports for a few of the larger websites in
the world, I find them productive. They do generate a certain amount of
noise, though.

As a reporter (just finding problems in software I'm using--I don't hunt
for them), I find they're helpful because they cause companies to fix the
bugs, even if they refuse to pay.

thanks,
Rob

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Aug 2020 20:04:25 +0000

The IETF website is not worth people hacking. If you had a bounty program in my view you’d get things like “I can read your .htaccess file” or the equivalent – nobody cares. Maybe people will find unauthenticated access to the datatracker site and be able to do things there. Depends on what you think the risk is.

The OpenSSL website is not worth people hacking. (“Yes, thanks, being able to view the site with SSLv3 is deliberate.”)  Finding CVE bugs in the OpenSSL source was worth it, but OpenSSL never had a bug bounty program. Researchers are quite good about responsible disclosure.

Akamai does not have a bug bounty program. We also seem to be quite good about getting responsible disclosures; this week’s BlackHat presentation (https://blogs.akamai.com/2020/08/black-hat-presentation---web-cache-entanglement.html is our take on it) is an example. In the past I’ve given Tshirts to a couple of folks.

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Aug 2020 20:05:31 +0000

And just to make it very explicit: I don’t discount Rob’s experiences, they’re just different from mine.

---

From: Rob Sayre <[email-masked]>
Date: Thu, 6 Aug 2020 13:13:42 -0700

> they’re just different from mine.

With the IETF website, I'd worry about hacking the mailing lists, changing
RFC text, stuff like that. And the bugs would probably be down to unpatched
software, although there do seem to be some bespoke parts as well.

Definitely prank-level stuff, but more expensive to clean up vs paying a
bounty.

thanks,
Rob

---

From: Jay Daley <[email-masked]>
Date: Fri, 7 Aug 2020 08:15:35 +1200

> On 7/08/2020, at 8:04 AM, Salz, Rich <rsalz=[email-masked]> wrote:
> 
> The IETF website is not worth people hacking. If you had a bounty program in my view you’d get things like “I can read your .htaccess file” or the equivalent – nobody cares.

I’ve run a bounty program that got exactly that, all from individuals using automated tools.  We paid in the region of $20 - $50 and after about 20 or so they dried up as all the basic things an automated scanner can find had been addressed.  There was no indication of anyone doing more sophisticated testing.  I was quite happy with it as a way of pushing us to take an "outside looking in" view and it was cheap and easy to administer but it basically just found the small issues we introduced ourselves in-between regular commissioned pen tests, which in my view are the one thing nobody can do without (for opsec that is).

Jay

> Maybe people will find unauthenticated access to the datatracker site and be able to do things there. Depends on what you think the risk is.

-- 
Jay Daley
IETF Executive Director
[email-masked]

---

From: Rob Sayre <[email-masked]>
Date: Thu, 6 Aug 2020 13:49:19 -0700

On Thu, Aug 6, 2020 at 1:15 PM Jay Daley <[email-masked]> wrote:

> > The IETF website is not worth people hacking. If you had a bounty
> program in my view you’d get things like “I can read your .htaccess file”
> or the equivalent – nobody cares.
>
> I’ve run a bounty program that got exactly that, all from individuals
> using automated tools.  We paid in the region of $20 - $50 and after about
> 20 or so they dried up...
>

This is pretty low. For example, see <
https://hackerone.com/twitter?type=team>

The point about reports "drying up" is a good one, though. The value of
operating the program can decline if the software is low-churn.

thanks,
Rob

---

From: "Bron Gondwana" <[email-masked]>
Date: Fri, 07 Aug 2020 11:01:27 +1000

> I’ve run a bounty program that got exactly that, all from individuals using automated tools.  We paid in the region of $20 - $50 and after about 20 or so they dried up as all the basic things an au…

You're not going to get anything good for $50!  We've paid up to $4000, which is still not heaps but does attract people willing to do more detailed research than just running an automated scanner:

https://www.fastmail.com/about/bugbounty/

One thing to keep in mind - you will get quite a lot of work to do just processing bug reports.  I'd say we've spent more on the staff time to review incoming reports and assess them for correctness (not to mention arguing with cranks who are sure they deserve a payout for some nonsense that a tool told them) than we have on payouts.

Bron.

--
  Bron Gondwana, CEO, Fastmail Pty Ltd
  [email-masked]

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 25 Aug 2020 17:35:18 -0400

On Thu, Aug 06, 2020 at 07:28:07PM +0000, Livingood, Jason wrote:
> absent a small bounty.

This is true.

One of the many problems with this approach is that the bounties are,
indeed, small.  Serious bug research may take months of painstaking work;
offering someone $500 for that isn't going to really motivate them
to share their result when they may be able to go elsewhere and get $50K
for it.  This is particularly glaring in the case of companies which
are reporting multi-billion dollar profits and paying some employees
multi-million dollar salaries, yet for reason can't seem to find more
than pocket change for bounties.

While it's true that some reported bugs are the result of minimal work
and the use of an automated tool, some of them require months of diligent,
careful work.  A bounty for such things should reflect the current market
value of that labor plus a bonus because all of that work was done on
a speculative basis plus a bonus because that work fixes a problem that
got by everyone else plus a bonus because it will save the company the
much larger expense of dealing with the fallout if it's exploited.

Bug bounties probably need to start at five to six figures.

Another problem is that companies often refuse to pay.  This is
understandable if it's a non-bug or if it's something found by an
automated tool that they already ran 63 times and know about, but it
happens often enough with serious/detailed/complete bug reports that it
has created an atmosphere of distrust.  So anyone who's got a viable bug
now has a choice: offer it to a company which may well use its legal and
bureaucratic resources to weasel out of paying even a minimal amount or
offer it on the open market to buyers who also may weasel out of paying
but *might* cough up a lot more for it.

If those offering bug bounties want to be taken seriously in the
marketplace, then they need to start adding more zeroes to the right
side of their bounties.

---rsk