1

After finding a vulnerability in a program, one can submit it to a bounty program, such as ZDI. According to ZDI's website, they will examine the vulnerability and possibly offers a bounty. If the researcher does not accept the offer, they promise not to use the vulnerability information. However, I guess some people might not completely trust the bounty program and would like to provide limited information in their submission.

My question is, what is the general practice for providing information to/negotiate with a bounty program? I am thinking about providing software version, OS version, general description of the vulnerability and some proof, such as the info at crash and analyze results by tools like !exploitable Crash Analyzer. However, although the bounty program such as ZDI encourages the researcher to submit a PoC, the PoC will basically disclose the vulnerability entirely. Thus, the PoC will not be included at least in the initial submission.

Please provide your answers and comments regarding this issue. Thank you!

Improve this question

2 Answers 2

Reset to default
3

ZDI, and other similar programs WILL NOT accept anything without reporting on the full vulnerability. There is no sanitizing data. You either trust them, or you don't. Sample applies for all programs listed on BugCrowd. With ZDI, this is what I found has worked best to minimize the amount of time you'd need to wait:

  1. Full detailed report of the bug
  2. Proof of concept
  3. Troubleshooting (step by step guide to exploit including debugging)

What ZDI and others do, is take a look at what you're submitting, and go through the process of validating this. The Proof of Concept is not required, since their staff can make their own PoCs but it minimizes the amount of time spent waiting.

Troubleshooting output (e.g., WinDBG, OllyDBG, ImmunityDBG) helps them in seeing what is affected (EIP, EBX, ECX, etc) when something is overflowed for example. It isolates address space, or illustrates what you did for something like nopsledding, etc.

Now I infer that you're concerned that you will submit something, they will offer minimal, you'll say forget it, and they will go ahead and report it/fix it/etc it anyway. This is not the case hence you signing a non-disclosure agreement with them. So again:

  • Vulnerability - needed to determine the extent of potential damage if X occurred
  • PoC - not necessary but helps proving exploitation against an application
  • Debugging/troubleshooting data - aides in illustrating what, how, and why something got exploited

There is no "partial" submission since they will be spending MONEY (time, resources) to figure out what the issue (if any is). Not chance any theories. The amount of money they offer, is based on how widespread the application is in use (e.g., Microsoft exploits command big bucks versus say MyRandomApplication.exe).

Improve this answer
1
  • Thank you for your clear explanation. I agree with your points.
    – ZillGate
    Commented Dec 22, 2014 at 20:29
2

Generally with bounty programs, the more information you can provide, the more likely they are to pay out the bounty. Unfortunately, the quality of many of the exploits submitted can be very low - for instance, I know of a bounty program for a website that frequently receives warnings that javascript was viewable in the user's web browser.

So, best advice assuming you have no reason to keep the vulnerability secret, submit the PoC and as much information as possible to maximize the possibility of payout.

EDIT I'll add, if your interest is in maximizing profit, not necessarily the disclosure, might be best to approach the company directly, but really these programs are designed to encourage responsible disclosure, not make anyone rich.

Improve this answer
5
  • Thank you. But if a researcher approaches the company directly and tries to sell a vulnerability, is it a blackmail?
    – ZillGate
    Commented Dec 22, 2014 at 20:14
  • Only if you threaten to use it or release it to malicious sources. A good way to phrase it would be to email the company asking if they have a bug / security bounty program, and maybe even reference ZDI.
    – patwhite
    Commented Dec 22, 2014 at 20:19
  • But, again, the point of all of these programs is to reward good people for doing the right thing, not make people rich, and not convince someone who would otherwise exploit this to submit it.
    – patwhite
    Commented Dec 22, 2014 at 20:20
  • Good suggestion. However, when a researcher rejects an offer from one bounty program, he or she could submit it to another program, instead of exploiting it. Such a market might provide better incentives for good people.
    – ZillGate
    Commented Dec 22, 2014 at 20:32
  • Agreed - I guess I'm saying the company will probably pay the most for it if they have a bounty program, followed by a more general program like ZDI.
    – patwhite
    Commented Dec 22, 2014 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .