×

Announcing: Slashdot Deals - Explore geek apps, games, gadgets and more. (what is this?)

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!

Researcher Blows $15K By Reporting Bug To Google

timothy posted more than 3 years ago | from the can't-win-'em-all dept.

Security 69

CWmike writes "A security researcher lost a sure $15,000 at this week's Pwn2Own hacking contest because he had earlier reported the bug to Google, which has patched the vulnerability in its Android Market. 'I missed out money wise,' said Jon Oberheide, co-founder and CTO of Duo Security, a developer of two-factor authentication software. 'But it was good that Google is rewarding researchers. And now I have my first Android vulnerability that qualified for a bounty.' Google cut a check to Oberheide for $1,337."

Sorry! There are no comments related to the filter you selected.

Nice! (2, Interesting)

Anonymous Coward | more than 3 years ago | (#35425614)

I wish Google would cut me checks for $leet ;-) Gotta hand Google some props for style, though! And congratulations to Mr. Oberheide; maybe he didn't get the full $15k, but getting a check at all is pretty cool!

Re:Nice! (-1)

Anonymous Coward | more than 3 years ago | (#35426122)

I wish Google would cut me checks for $leet ;-) Gotta hand Google some props for style, though! And congratulations to Mr. Oberheide; maybe he didn't get the full $15k, but getting a check at all is pretty cool!

fact is he got Jewed out of it.

Better (2)

Mateorabi (108522) | more than 3 years ago | (#35426222)

Free publicity may be worth more.

Re:Nice! (2)

mysidia (191772) | more than 3 years ago | (#35426238)

I would rather Google cut me checks for 31337.

Re:Nice! (2)

Bacon Bits (926911) | more than 3 years ago | (#35427256)

Zimbabwean dollars ok?

Re:Nice! (1)

mysidia (191772) | more than 3 years ago | (#35437562)

Zimbabwean dollars ok?

If the US government continues its trend of get further and further into debt, monetize that debt, and print more money, 31337 Zimbabwean dollars will be worth more than $31337 USDs before too long.

Auction it off (1)

future assassin (639396) | more than 3 years ago | (#35426286)

I bet he'd get more for the cheque if he auctioned it off to a l33t collector.

Good publicity (3, Informative)

houstonbofh (602064) | more than 3 years ago | (#35425632)

He also got a lot more good press that he might have otherwise. Good for a starting up security company.

Re:Good publicity (4, Informative)

Anonymous Coward | more than 3 years ago | (#35425710)

No, Pwn2Own is white-hat - successful exploits are never published and full details are given to the developer. He only reported it beforehand because he mistakenly believed it wouldn't be a permitted exploit for the competition.

If you read his comments on the matter he's more upset about not being able to embarrass Google with such a simple exploit than he is about the money.

Re:Good publicity (0)

mysidia (191772) | more than 3 years ago | (#35426304)

he mistakenly believed it wouldn't be a permitted exploit for the competition.

Perhaps then he should perceive and do what he would have done if it was not permitted anyways.

Go find another vulnerability, develop an exploit for it, and earn that $15k.

Otherwise, consider his mistake a $15,000 lesson.

Re:Good publicity (-1)

Anonymous Coward | more than 3 years ago | (#35426926)

Who the fuck are you?

$15K is more than some people make in a year and your advice is "get over it"? As if he didn't earn it the first time? Why don't you tell him to find another winning lottery ticket while you're at it?

Douche.

Re:Good publicity (0, Flamebait)

Anonymous Coward | more than 3 years ago | (#35427008)

It's $15k you fucking peasant. Not a million.

Re:Good publicity (1)

91degrees (207121) | more than 3 years ago | (#35427778)

Someone with the skills this guy obviously has is going to make more than $15000 in a year.

Re:Good publicity (2, Insightful)

tlhIngan (30335) | more than 3 years ago | (#35427068)

he mistakenly believed it wouldn't be a permitted exploit for the competition.

Perhaps then he should perceive and do what he would have done if it was not permitted anyways.

Go find another vulnerability, develop an exploit for it, and earn that $15k.

Otherwise, consider his mistake a $15,000 lesson.

More like $15k lesson. I'm not sure if Pwn2Own can really be considered a "white hat" activity - CanSecWest is a white-hat convention for security professionals, yes, but given the way people act for Pwn2Own, it's like they suddenly see the money and turn into black-hats.

After all, they openly admit sitting on bugs for *years* so they can try to win that new shiny MacBook Pro (I'm not sure what fancy machine they use for Windows/Linux...) during Pwn2Own. (Of course, competition is fierce for the MacBooks because it's the nicest machine there, so it always falls first then all the "losers" focus on the runner up prizes of not-so-nice machines).

Sure they risk someone else finding the bugs and reporting it, but if the prize is $15k and a $2k computer, it sure beats reporting it and getting whatever paltry sum they can get.

It's both good and bad, I suppose - companies like Apple can't rely strictly on reports but should proactively search for bugs, but on the flip side, sitting on bugs for years so you can pull it out to try for Pwn2Own doesn't rub me the right way either.

Re:Good publicity (0)

Anonymous Coward | more than 3 years ago | (#35427086)

Withholding the information from the vendor, thus prolonging the vulnerability window, is grey in my book.

Andy Kate (-1, Offtopic)

joy Ann (2006710) | more than 3 years ago | (#35426106)

Supra Shoes [uksupracheap.com] Supra UK [uksupracheap.com] Supra Trainers [uksupracheap.com] Cheap Supra Shoes [uksupracheap.com] Supra Muska Skytop [uksupracheap.com] Supra TK Society [uksupracheap.com] Beats by dre [beatsbydre-dr.com] Monster beats headphones [beatsbydre-dr.com] Dr dre beats [beatsbydre-dr.com] Monster Dr Dre [beatsbydre-dr.com] Monster Beats [beatsbydre-dr.com] Monster Beats Studio [beatsbydre-dr.com] Monster Beats Solo Headphones [beatsbydre-dr.com]

Re:Andy Kate (0)

Anonymous Coward | more than 3 years ago | (#35427116)

Why hasn't this spambot been banned yet? I'm sick of seeing this crap.

Lawls (0)

Anonymous Coward | more than 3 years ago | (#35425696)

They cut him some 1337 money.

You Know... (5, Insightful)

CrazyDuke (529195) | more than 3 years ago | (#35425702)

If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

Re:You Know... (4, Insightful)

adisakp (705706) | more than 3 years ago | (#35425812)

If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

Some banks like JP Morgan Chase [usatoday.com] now let you "deposit" a check by iPhone by taking a picture of the check.

You could keep the original check in your portfolio while getting the cash as well :-)

Re:You Know... (1)

jdpars (1480913) | more than 3 years ago | (#35425890)

Pushing hard for a promotion, aren't you?

Re:You Know... (1)

mysidia (191772) | more than 3 years ago | (#35426268)

You could keep the original check in your portfolio while getting the cash as well :-)

Hm... aren't you supposed to destroy it or mail it in, after you do that? Makes one wonder what would happen if you then had later 'lost' that "deposited" check, and someone else with a similar name as yours picked it out of the trash and tried to have it paid...

Re:You Know... (1)

houstonbofh (602064) | more than 3 years ago | (#35426744)

Probably being busted for bank fraud? OK, only if actually caught...

Re:You Know... (2)

larry bagina (561269) | more than 3 years ago | (#35426816)

I wonder what would happen if I "smashed your head in" with a "baseball bat" and then "took" your "wallet".

Re:You Know... (0)

Anonymous Coward | more than 3 years ago | (#35427944)

You made my day... cheers!

Re:You Know... (0)

Anonymous Coward | more than 3 years ago | (#35426920)

Or maybe. you know, just keep the photocopy?

Re:You Know... (1)

Weedhopper (168515) | more than 3 years ago | (#35427510)

With USAA, the app tells me to write VOID across the front. It might also tell me to destroy the check, but I'm not sure. It certainly doesn't tell me to mail the thing in.

Re:You Know... (0)

Anonymous Coward | more than 3 years ago | (#35428748)

They can deposit it then have the back return it. It'll have a large "deposited" stamp or something similar on it, but it'll be the same piece of paper.

Re:You Know... (1)

mjwx (966435) | more than 3 years ago | (#35426808)

Most banks will permit you to keep a cheque once it's been cashed, especially a commemorative cheque. At worst they'll write "cleared" or some such on there to indicate it's been used.

1337 (-1)

sltd (1182933) | more than 3 years ago | (#35425740)

Does anybody else think the amount of money he received is interesting?

Re:1337 (5, Funny)

Anonymous Coward | more than 3 years ago | (#35425762)

Does anybody else think the amount of money he received is interesting?

(Glances at thread.) Pretty much everyone else, yeah.

Re:1337 (2, Funny)

Anonymous Coward | more than 3 years ago | (#35425796)

"What is $666 multiplied by 2, as calculated on a Pentium computer?"

Re:1337 (0)

Anonymous Coward | more than 3 years ago | (#35426092)

The calculator in my dual-core Pentium processor based computer says, 666*2=1332. Just like my 10$ Radio Shack calculator.
What have you been smoking?
Or are you one of those Tea Party mathematicians they quote to explain the economy.

Re:1337 (0)

Anonymous Coward | more than 3 years ago | (#35426182)

wooooooosh

Re:1337 (1)

zill (1690130) | more than 3 years ago | (#35427082)

I think "w000000000sh" is more appropriate in this case.

Re:1337 (1)

segin (883667) | more than 3 years ago | (#35427048)

I believe it's a crack at the floating point division bug on the original Pentium processor. Don't take it seriously.

Re:1337 (4, Interesting)

Pseudonym Authority (1591027) | more than 3 years ago | (#35426134)

But more importantly, 1337% of pi is....... ~42

Re:1337 (2)

dakameleon (1126377) | more than 3 years ago | (#35426230)

Goddamn, it actually is. How about that.

Re:1337 (1)

houstonbofh (602064) | more than 3 years ago | (#35426758)

OK. The statement was funny. The response was a riot! :)

Re:1337 (1)

mcavic (2007672) | more than 3 years ago | (#35425822)

Does anybody else think the amount of money he received is interesting?

Yes, I noticed that. Surely it's intentional.

Re:1337 (0)

Anonymous Coward | more than 3 years ago | (#35426078)

But what could it mean?

Re:1337 (1)

houstonbofh (602064) | more than 3 years ago | (#35426772)

Yeah... He needs to quite being an eleetist snob and tell us! (No it is not spelled wrong)

Re:1337 (2)

abednegoyulo (1797602) | more than 3 years ago | (#35426084)

Though 600613 is unrealistic, I think it would be much better

Re:1337 (1)

dlgeek (1065796) | more than 3 years ago | (#35426152)

6006.13 isn't so bad for an important bug.

Slightly over 2 shares.... (2)

olsmeister (1488789) | more than 3 years ago | (#35425944)

Should have just given him a couple of shares of stock.

Re:Slightly over 2 shares.... (0)

Anonymous Coward | more than 3 years ago | (#35426066)

But it wouldn't be 1337. duh!

Poor post title (3, Insightful)

DuranDuran (252246) | more than 3 years ago | (#35425958)

Get thee behind me, Satan - a better post title would have mentioned that Google actually rewarded the researcher's honesty. This is a great outcome for everyone, including Android users.

Re:Poor post title (1)

drinkypoo (153816) | more than 3 years ago | (#35428062)

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

Re:Poor post title (1)

metacell (523607) | more than 3 years ago | (#35428288)

Or if you're a lawyer.

Re:Poor post title (1)

drinkypoo (153816) | more than 3 years ago | (#35428312)

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

Or if you're a lawyer.

[-1, Redundant]

Re:Poor post title (0)

Anonymous Coward | more than 3 years ago | (#35433122)

Or you'd like it really, REALLY, into YOU. HEYO!

Re:Poor post title (1)

Paul1969 (1976328) | more than 3 years ago | (#35440520)

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

You know where that quote comes from, right? Right?
Spoken by one Jesus Christ, according to a book called the Bible.
Yeah, we all knew Jesus was pretty "light in the loafers."

Re:Poor post title (1)

drinkypoo (153816) | more than 3 years ago | (#35441886)

You know where that quote comes from, right? Right?

Yes, from someone who wasn't there whose words have been [often deliberately] poorly translated at least three times over.

Possibility.. (2)

OopsIDied (1764436) | more than 3 years ago | (#35426018)

This might also have been a good decision money-wise if someone else had found the bug but decided to save it for the pwn2own contest. Instead of risking getting $0 by being beat by someone else, he got a still respectable $1,337 relatively stress-free. (Note, I have no idea how small the chance that someone else had actually found the same bug and decided to save it for the contest is)

Re:Possibility.. (2)

arth1 (260657) | more than 3 years ago | (#35426096)

... or someone else might have discovered it and disclosed it in any other way. Including (but not limited to) bugtraq/cert/mitre/fulldisclosure, or even exploiting the bug, after which AV software detects it.
To me, all of those seem far more likely.

Speed is of the essence, because black hats won't wait until the vendor has a fix, or the researcher can publish in the best paying venue. Disclose early, disclose often.

$1337 = leet speak (-1)

Anonymous Coward | more than 3 years ago | (#35426062)

I don't know if anyone else caught it, but $1337 is leet speak for, you guessed it. Leet.

Re:$1337 = leet speak (1)

mcneely.mike (927221) | more than 3 years ago | (#35426130)

No... no one else caught it. You are indeed leet.

Re:$1337 = leet speak (0)

Anonymous Coward | more than 3 years ago | (#35426738)

Nope, no one else did. You are the only one on the internet who has ever heard of this... "leet" thing.

Misleading headline (1)

Prien715 (251944) | more than 3 years ago | (#35426266)

It's ~$14K, not $15K. He did get paid for finding the exploit -- just not as much as he could have. $Lost = $Received - $Possible. And props for anyone who thinks that's Perl rather than simply labeling my units;)

Re:Misleading headline (0)

Anonymous Coward | more than 3 years ago | (#35426712)

$Lost = $Received - $Possible

Only when using the MPAA/RIAA definition of $Lost. The rest of the world defines $Lost as the amount that you actually HAD, then managed to, well, lose.

Re:Misleading headline (0)

Anonymous Coward | more than 3 years ago | (#35426736)

"And props for anyone who thinks that's Perl rather than simply labeling my units;)"

Gah! Programming has changed my brain.

Re:Misleading headline (0)

Anonymous Coward | more than 3 years ago | (#35427536)

$Lost = $Received - $Possible

$Lost = $Received - $Possible
$Lost = 1337 - 15000
$Lost = -13663
So you're sying he lost -13663, or, in other words, gained 13663.

Re:Misleading headline (1)

Rysc (136391) | more than 3 years ago | (#35427984)

Lost = Had - Have

Missed = Possible - Received

So

Lost = 0 - 1337

Therefore he lost -1337, aka he gained.

PROFIT! (1)

zill (1690130) | more than 3 years ago | (#35427098)

1. Report bug
2. Receive $1337
3. Complain about not getting the $15000 for public attention
4. Google caves in to public pressure and awards him $15000
5. Receive $16337 in total

1337 (0)

Anonymous Coward | more than 3 years ago | (#35427112)

Is this a coincidence or the 1337 (Leet) is on purpose?

Re:1337 (0)

Anonymous Coward | more than 3 years ago | (#35430490)

Is this a coincidence or the 1337 (Leet) is on purpose?

Actually they chose this figure because it's exactly 2622 - 846 x 1.

Remember when they used to write it "31337"? (0)

Anonymous Coward | more than 3 years ago | (#35427580)

I bet that he wish that they still did!

Noble Brin and Page (0)

Anonymous Coward | more than 3 years ago | (#35427814)

have decided to reduce their salary to $0.99 to pay for this, so as to preserve stockholder value

The secret of genius? (0)

Anonymous Coward | more than 3 years ago | (#35440906)

Hide your sources... No credit to elBulli. I thought the Catalans invented this type of modernist cuisine.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?