+Warwagon MVC Posted October 2, 2013 MVC Share Posted October 2, 2013 Yahoo! Pays! Paltry! $12.50! Bug! Bounty! For! Nasty! Email! Vuln! Yahoo! has paid a bug bounty to security researchers who found a bug that ?allowed any @yahoo.com email account to be compromised simply by sending a specially crafted link to a logged-in Yahoo! user and making him/her clicking on it.? But the bounty was just $US12.50 and came in the form of a voucher that could only be spent in the Yahoo! company store on branded tat. The quote above comes from a canned statement from Switzerland-based security outfit High-Tech Bridge, which says it set out to test the efficacy of bug bounties by seeing if it could find a flaw on Yahoo! The statement says 45 minutes into tests the XSS flaw detailed above showed its ugly head, leading the company to report the vulnerability to Yahoo!, which responded with an email saying the bug was known and so did not qualify for payment. Undeterred, the team sent in another three flaws all of which had the same effect. Yahoo! eventually bit and offered the $US12.50 gift voucher as a bounty. High-Tech Bridge's CEO Ilia Kolochenko has reacted badly to that offer, declaring it ?a bad joke? and opining it ?won?t motivate people to report security vulnerabilities to them, especially when such vulnerabilities can be easily sold on the black market for a much higher price.? http://www.theregister.co.uk/2013/10/01/yahoo_pays_paltry_1250_bug_bounty_for_nasty_email_vuln/ This email vulnerability could explain a lot. Link to comment Share on other sites More sharing options...
Growled Member Posted October 3, 2013 Member Share Posted October 3, 2013 I love big spenders. :D Link to comment Share on other sites More sharing options...
Hum Posted October 6, 2013 Share Posted October 6, 2013 That's more than my dates pay. Link to comment Share on other sites More sharing options...
Recommended Posts