Researcher Blows $15K By Reporting Bug To Google

CWmike writes "A security researcher lost a sure $15,000 at this week's Pwn2Own hacking contest because he had earlier reported the bug to Google, which has patched the vulnerability in its Android Market. 'I missed out money wise,' said Jon Oberheide, co-founder and CTO of Duo Security, a developer of two-factor authentication software. 'But it was good that Google is rewarding researchers. And now I have my first Android vulnerability that qualified for a bounty.' Google cut a check to Oberheide for $1,337."

Nice!

[Anonymous Coward]

I wish Google would cut me checks for $leet ;-) Gotta hand Google some props for style, though! And congratulations to Mr. Oberheide; maybe he didn't get the full $15k, but getting a check at all is pretty cool!

Better

[Mateorabi]

Free publicity may be worth more.

Re:

[mysidia]

I would rather Google cut me checks for 31337.

Re:

[Bacon Bits]

Zimbabwean dollars ok?

Re:

[mysidia]

Zimbabwean dollars ok?

If the US government continues its trend of get further and further into debt, monetize that debt, and print more money, 31337 Zimbabwean dollars will be worth more than $31337 USDs before too long.

Auction it off

[future assassin]

I bet he'd get more for the cheque if he auctioned it off to a l33t collector.

Good publicity

[houstonbofh]

He also got a lot more good press that he might have otherwise. Good for a starting up security company.

Re:Good publicity

[Anonymous Coward]

No, Pwn2Own is white-hat - successful exploits are never published and full details are given to the developer. He only reported it beforehand because he mistakenly believed it wouldn't be a permitted exploit for the competition.

If you read his comments on the matter he's more upset about not being able to embarrass Google with such a simple exploit than he is about the money.

Re:

[91degrees]

Someone with the skills this guy obviously has is going to make more than $15000 in a year.

Re:

[tlhIngan]

he mistakenly believed it wouldn't be a permitted exploit for the competition.

Perhaps then he should perceive and do what he would have done if it was not permitted anyways.

Go find another vulnerability, develop an exploit for it, and earn that $15k.

Otherwise, consider his mistake a $15,000 lesson.

More like $15k lesson. I'm not sure if Pwn2Own can really be considered a "white hat" activity - CanSecWest is a white-hat convention for security professionals, yes, but given the way people act for Pwn2Own, it's

You Know...

[CrazyDuke]

If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

Re:You Know...

[adisakp]

If google cut me a check for 1337 for infosec work, I'd want to keep it in my job portfolio for when potential clients or employers ask for a reference. ...just saying.

Some banks like JP Morgan Chase [usatoday.com] now let you "deposit" a check by iPhone by taking a picture of the check.

You could keep the original check in your portfolio while getting the cash as well :-)

Re:

[jdpars]

Pushing hard for a promotion, aren't you?

Re:

[mysidia]

You could keep the original check in your portfolio while getting the cash as well :-)

Hm... aren't you supposed to destroy it or mail it in, after you do that? Makes one wonder what would happen if you then had later 'lost' that "deposited" check, and someone else with a similar name as yours picked it out of the trash and tried to have it paid...

Re:

[houstonbofh]

Probably being busted for bank fraud? OK, only if actually caught...

Re:

[larry bagina]

I wonder what would happen if I "smashed your head in" with a "baseball bat" and then "took" your "wallet".

Re:

[Weedhopper]

With USAA, the app tells me to write VOID across the front. It might also tell me to destroy the check, but I'm not sure. It certainly doesn't tell me to mail the thing in.

Re:

[mjwx]

Most banks will permit you to keep a cheque once it's been cashed, especially a commemorative cheque. At worst they'll write "cleared" or some such on there to indicate it's been used.

Re:1337

[Anonymous Coward]

Does anybody else think the amount of money he received is interesting?

(Glances at thread.) Pretty much everyone else, yeah.

Re:

[Anonymous Coward]

"What is $666 multiplied by 2, as calculated on a Pentium computer?"

Re:

[zill]

I think "w000000000sh" is more appropriate in this case.

Re:

[segin]

I believe it's a crack at the floating point division bug on the original Pentium processor. Don't take it seriously.

Re:1337

[Pseudonym Authority]

But more importantly, 1337% of pi is....... ~42

Re:

[dakameleon]

Goddamn, it actually is. How about that.

Re:

[houstonbofh]

OK. The statement was funny. The response was a riot! :)

Re:

[mcavic]

Does anybody else think the amount of money he received is interesting?

Yes, I noticed that. Surely it's intentional.

Re:

[houstonbofh]

Yeah... He needs to quite being an eleetist snob and tell us! (No it is not spelled wrong)

Re:

[abednegoyulo]

Though 600613 is unrealistic, I think it would be much better

Re:

[dlgeek]

6006.13 isn't so bad for an important bug.

Slightly over 2 shares....

[olsmeister]

Should have just given him a couple of shares of stock.

Poor post title

[DuranDuran]

Get thee behind me, Satan - a better post title would have mentioned that Google actually rewarded the researcher's honesty. This is a great outcome for everyone, including Android users.

Re:

[drinkypoo]

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

Re:

[metacell]

Or if you're a lawyer.

Re:

[drinkypoo]

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

Or if you're a lawyer.

[-1, Redundant]

Re:

[Paul1969]

I've never understood why you'd instruct the father of buggery to get behind you. Unless you're into that kind of thing. Really, REALLY into it.

You know where that quote comes from, right? Right?
Spoken by one Jesus Christ, according to a book called the Bible.
Yeah, we all knew Jesus was pretty "light in the loafers."

Re:

[drinkypoo]

You know where that quote comes from, right? Right?

Yes, from someone who wasn't there whose words have been [often deliberately] poorly translated at least three times over.

Possibility..

[OopsIDied]

This might also have been a good decision money-wise if someone else had found the bug but decided to save it for the pwn2own contest. Instead of risking getting $0 by being beat by someone else, he got a still respectable $1,337 relatively stress-free. (Note, I have no idea how small the chance that someone else had actually found the same bug and decided to save it for the contest is)

Re:

[arth1]

... or someone else might have discovered it and disclosed it in any other way. Including (but not limited to) bugtraq/cert/mitre/fulldisclosure, or even exploiting the bug, after which AV software detects it.
To me, all of those seem far more likely.

Speed is of the essence, because black hats won't wait until the vendor has a fix, or the researcher can publish in the best paying venue. Disclose early, disclose often.

Misleading headline

[Prien715]

It's ~$14K, not $15K. He did get paid for finding the exploit -- just not as much as he could have. $Lost = $Received - $Possible. And props for anyone who thinks that's Perl rather than simply labeling my units;)

Re:

[Rysc]

Lost = Had - Have

Missed = Possible - Received

So

Lost = 0 - 1337

Therefore he lost -1337, aka he gained.

PROFIT!

[zill]

1. Report bug
2. Receive $1337
3. Complain about not getting the $15000 for public attention
4. Google caves in to public pressure and awards him $15000
5. Receive $16337 in total