undefined | Better HN

Skip to content

Top Best Ask Show New Jobs

0 pointslaweijfmvo4y ago0 comments

> This time, the bug gives the attacker full access to every website ever visited by the victim. That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts too.

Honestly, $100,000 for this is too low.

0 comments

5 comments · 4 top-level

kingcharles4y ago· 1 in thread

I found a bug in Cash App that exposes SSNs, but their max bug bounty is $8000, so fuck 'em. The other option for people finding bugs is to sell it to "the other side" if they pay more money.

https://bugcrowd.com/cashapp

rasz4y ago

No. Fuck-em would be actually selling it, not throwing a hissy fit and publicly outing yourself as potential source of the discovery. They DGAF about that bug, their only concern is very low probability of negative consequences in case of data leak with full attribution, but bugcrowd presence gives CISO full ass coverage.

mhoad4y ago

Agreed, of all the places you could have sold that information the official channel by FAR pays the worst (Apple in particular being a notoriously terrible company to deal with for security problems but by no means are the only ones) which is a huge problem that people should be making a lot more noise about.

I kind of shudder to think of how many of these bugs have been out there for years and only ever ended up in the hands of governments and shady groups like NSO.

londons_explore4y ago

This bug would, in the wrong hands, let someone steal a lot more than $100k.

It should be at least 10x higher, this bug affects a billion users

j / k navigate · click thread line to collapse