<story><title>Playstation confirms chain of 5 vulnerabilities on PS4/PS5</title><url>https://hackerone.com/reports/1379975</url></story><parent_chain><item><author>tgsovlerkhgsel</author><text>The disclosure timeline is interesting:&lt;p&gt;- theflow0
submitted a report to PlayStation.
Oct 25th (8 months ago)&lt;p&gt;- PlayStation rewarded theflow0 with a $20,000 bounty.
Nov 12th (7 months ago)&lt;p&gt;- shoshin_cup
PlayStation staff closed the report and changed the status to Resolved.
Apr 4th (3 months ago)&lt;p&gt;- theflow0
requested to disclose this report.
Apr 4th (3 months ago)&lt;p&gt;- sazerac
HackerOne staff agreed to disclose this report.
Jun 10th (9 days ago)&lt;p&gt;I generally refuse to participate in Bug bounty programs through intermediaries like HackerOne, because they severely restrict and delay your ability to disclose. After having been denied a bug bounty for reporting a vulnerability directly, and often spent frustrating amounts of time just trying to get a response even from major companies, I&amp;#x27;ve basically given up completely on bug bounty programs, and will likely go for full disclosure in the future (with a note to the corresponding security team for awareness).&lt;p&gt;For smaller issues, the bounties often don&amp;#x27;t even fairly compensate the (usually significant) effort spent communicating with the security team if you value your time at a competitive hourly rate, and payment is hit or miss. Not worth giving up your right to talk about the issues in exchange.</text></item></parent_chain><comment><author>Mandatum</author><text>Friend just disclosed a 7 vuln chain RCE in a Fortune20 company. Affected all cloud and on-prem versions.&lt;p&gt;They denied it as it was under NDA during a &amp;quot;scheduled&amp;quot; pentest (their client paid them to pentest and they alerted the vendor letting them know they&amp;#x27;d be doing it during a 2 week period like most cloud vendors).&lt;p&gt;For someone to spend weeks developing that many vulnerabilities to get an RCE and then get nothing from the vendor other than &amp;quot;haha technically we don&amp;#x27;t have to pay you&amp;quot; - there is zero reason to not go through agencies that sell to governments (ZDI, Zerodium, etc).&lt;p&gt;You&amp;#x27;ll get paid and now the bug won&amp;#x27;t get patched.&lt;p&gt;Congratulations vendor, you played yourself.</text></comment>
<story><title>Playstation confirms chain of 5 vulnerabilities on PS4/PS5</title><url>https://hackerone.com/reports/1379975</url></story><parent_chain><item><author>tgsovlerkhgsel</author><text>The disclosure timeline is interesting:&lt;p&gt;- theflow0
submitted a report to PlayStation.
Oct 25th (8 months ago)&lt;p&gt;- PlayStation rewarded theflow0 with a $20,000 bounty.
Nov 12th (7 months ago)&lt;p&gt;- shoshin_cup
PlayStation staff closed the report and changed the status to Resolved.
Apr 4th (3 months ago)&lt;p&gt;- theflow0
requested to disclose this report.
Apr 4th (3 months ago)&lt;p&gt;- sazerac
HackerOne staff agreed to disclose this report.
Jun 10th (9 days ago)&lt;p&gt;I generally refuse to participate in Bug bounty programs through intermediaries like HackerOne, because they severely restrict and delay your ability to disclose. After having been denied a bug bounty for reporting a vulnerability directly, and often spent frustrating amounts of time just trying to get a response even from major companies, I&amp;#x27;ve basically given up completely on bug bounty programs, and will likely go for full disclosure in the future (with a note to the corresponding security team for awareness).&lt;p&gt;For smaller issues, the bounties often don&amp;#x27;t even fairly compensate the (usually significant) effort spent communicating with the security team if you value your time at a competitive hourly rate, and payment is hit or miss. Not worth giving up your right to talk about the issues in exchange.</text></item></parent_chain><comment><author>robocat</author><text>From a $ perspective, most bug bounty programs look rather uneconomic to me, which I presume is by design.&lt;p&gt;Bounty programs require a hacker to reveal their secret. That cripples a hacker’s negotiation strength, and the hacker cedes nearly all control (as you point out).&lt;p&gt;Are there any organisations which can authenticate a vulnerability, without the hacker revealing the vulnerability itself?&lt;p&gt;Vulnerability authentication seems like a hard problem:&lt;p&gt;* powerful adversaries will wish to “steal” the vulnerability for themselves,&lt;p&gt;* the hacker will want to remain anonymous,&lt;p&gt;* the hacker needs to believe they will be safe and their vulnerability will not be stolen,&lt;p&gt;* legal, social, and financial incentives would be difficult to align for such an organisation to even exist. In a “safe jurisdiction” three-letter-agency and legal issues would probably be prohibitive (can’t aid extortion etcetera), and in other looser jurisdictions there would be powerful dark threats (far dominating over any legal issues).&lt;p&gt;* in most markets authentication is handled by organisations doing repeat transactions so that their incentive is to be trustworthy. However in this market government or blackhat organisations will want to create fronts or suborn organisations.&lt;p&gt;I guess on the dark markets there are authentication options for black hats. Any links to discussions about that?&lt;p&gt;Can vulnerability authentication be solved for white hats?</text></comment>