5 ms·

Does the $3000 (USD?) bounty seem low to anyone else? Prior to reading the timeline section at the bottom of the post I would have guessed a range of 25k to 50k

Does the $3000 (USD?) bounty seem low to anyone else? Prior to reading the timeline section at the bottom of the post I would have guessed a range of 25k to 50k as a bounty for such a severe vulnerability.

nicolas_t 6y ago
Yes, it's way too low. Seeing companies cheapen out on bug bounties makes me feel less secure about them. It shows that they don't believe in the importance of security, provides less incentives for ethical hackers to find security issues and it means that less ethical hackers will be that much more tempted to use vulnerabilities they've found unethically.
lalos 6y ago
Don't know the range of their bounty program but seems like this exploit is circumstantial on finding a subdomain which was left hanging. Once they registered that subdomain on their own account, this exploit seizes to be effective by third parties so reproducibility is minimal (subdomain can be registered once). Unless you plan to sell the exploit once to one client or just re-use it once at a time by selling access to it (too much trouble, centralized risk).
- kjaftaedi 6y ago
  It's not about reproducibility but severity and value. Offering low bounties for something like this can act as an incentive for people who find something like this to sell it somewhere else. A bug like this would be orders of magnitude more valuable in the wrong hands.
  - psds2 6y ago
    How can a low bounty act as an incentive?
    - kjaftaedi 6y ago
      This attack could have been used to gain access to any Azure account. If you knew that Microsoft would pay you a couple thousand for this and the black market would offer hundreds of thousands of dollars. It could influence a decision to not report the vulnerability to the developer.
      - psds2 6y ago
        I don't see how your explanation shows Microsoft creating the incentive. Your argument seems to amount to "Microsoft is not creating a sufficient disincentive." The problem with creating a sufficient disincentive is that you draw a lot of attention and still run the risk of being outbid when a vulnerability is discovered.
donmcronald 6y ago
Yeah. It seems low to me. The team writing the auth code is probably paid a fortune comparatively. It’s also surprising to see MS has mistakes like that in the auth flow. I know it’s a combo, but still, damn! I don’t know enough about dev.azure.com, but if they could do more than read info, like spin up VMs, then $3k is an insulting joke. Doubly so if there are credit cards attached to those accounts. The idea of someone spinning up resources on my Azure account gives me nightmares. It’s also worth noting the combo here is really nasty because DNS takeover means you could send phishing emails from a legit sub domain. What’s the damage to MS if someone nefarious had found that and launched a huge phishing campaign?
- dividuum 6y ago
  It's highly recommended to not allow wildcards in the redirect_to values within OAuth2 for that reason: It's just too easy to create flaws like this one. Additionally on https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url https://docs.microsoft.com/en-us/azure/active-directory/deve..., Microsoft itself recommends to avoid them: "Wildcard URIs, such as https://*.contoso.com https://*.contoso.com, are convenient but should be avoided. Using wildcards in the redirect URI has security implications."
  - donmcronald 6y ago
    That’s why I said I was surprised. I just can’t understand how anyone, let alone what I assume is a team, could write auth code without reading the spec to see what every parameter does. Even if you weren’t paying attention I feel like you shouldn’t miss that one, right? Is that full stack overflow development where some one is copying and pasting things they don’t understand?
    - user5994461 6y ago
      The recommendation is ignoring the reality of the world. How can developers handle authentication when authentication is not allowed on their company domains? Measures like filtering/whitelisting are always pushed back in my experience because it's legitimately preventing developers to support authentication.
realchucknorris 6y ago
i opened the comments section to ask the exact same question. wondering how many hours did he put on this.

nicolas_t 6y ago

Yes, it's way too low. Seeing companies cheapen out on bug bounties makes me feel less secure about them. It shows that they don't believe in the importance of security, provides less incentives for ethical hackers to find security issues and it means that less ethical hackers will be that much more tempted to use vulnerabilities they've found unethically.

lalos 6y ago

Don't know the range of their bounty program but seems like this exploit is circumstantial on finding a subdomain which was left hanging. Once they registered that subdomain on their own account, this exploit seizes to be effective by third parties so reproducibility is minimal (subdomain can be registered once). Unless you plan to sell the exploit once to one client or just re-use it once at a time by selling access to it (too much trouble, centralized risk).

kjaftaedi 6y ago
It's not about reproducibility but severity and value. Offering low bounties for something like this can act as an incentive for people who find something like this to sell it somewhere else. A bug like this would be orders of magnitude more valuable in the wrong hands.
- psds2 6y ago
  How can a low bounty act as an incentive?
  - kjaftaedi 6y ago
    This attack could have been used to gain access to any Azure account. If you knew that Microsoft would pay you a couple thousand for this and the black market would offer hundreds of thousands of dollars. It could influence a decision to not report the vulnerability to the developer.
    - psds2 6y ago
      I don't see how your explanation shows Microsoft creating the incentive. Your argument seems to amount to "Microsoft is not creating a sufficient disincentive." The problem with creating a sufficient disincentive is that you draw a lot of attention and still run the risk of being outbid when a vulnerability is discovered.

donmcronald 6y ago

Yeah. It seems low to me. The team writing the auth code is probably paid a fortune comparatively. It’s also surprising to see MS has mistakes like that in the auth flow. I know it’s a combo, but still, damn! I don’t know enough about dev.azure.com, but if they could do more than read info, like spin up VMs, then $3k is an insulting joke. Doubly so if there are credit cards attached to those accounts. The idea of someone spinning up resources on my Azure account gives me nightmares. It’s also worth noting the combo here is really nasty because DNS takeover means you could send phishing emails from a legit sub domain. What’s the damage to MS if someone nefarious had found that and launched a huge phishing campaign?

dividuum 6y ago
It's highly recommended to not allow wildcards in the redirect_to values within OAuth2 for that reason: It's just too easy to create flaws like this one. Additionally on https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url https://docs.microsoft.com/en-us/azure/active-directory/deve..., Microsoft itself recommends to avoid them: "Wildcard URIs, such as https://*.contoso.com https://*.contoso.com, are convenient but should be avoided. Using wildcards in the redirect URI has security implications."
- donmcronald 6y ago
  That’s why I said I was surprised. I just can’t understand how anyone, let alone what I assume is a team, could write auth code without reading the spec to see what every parameter does. Even if you weren’t paying attention I feel like you shouldn’t miss that one, right? Is that full stack overflow development where some one is copying and pasting things they don’t understand?
  - user5994461 6y ago
    The recommendation is ignoring the reality of the world. How can developers handle authentication when authentication is not allowed on their company domains? Measures like filtering/whitelisting are always pushed back in my experience because it's legitimately preventing developers to support authentication.

realchucknorris 6y ago

i opened the comments section to ask the exact same question. wondering how many hours did he put on this.