The Circle of Unfixable Security Issues

Not every security issues can be fixed. There exist (what I call) "unfixable" bugs, where you can always argue and shift the goal posts. The idea is to only report these kind of issues to create an endless stream of bug bounty money!

hackerone reports:

Chapters:
00:00 - Intro
00:30 - Denial of Service with loooong passwords
03:18 - Invalid vs. Valid DoS Reports
05:11 - Deployment Differences
06:54 - Denial of Service vs. Bruteforce Protection
09:27 - IP Rate-Limiting "fix"
12:06 - Locking User Accounts?
13:59 - The Circle of Unfixable Security Issues
15:25 - Vulnerability vs. Weakness
16:49 - The Cybersecurity Industry
19:03 - Conclusion: Cybersecurity vs. Hacking
21:34 - Outro

=[ ❤️ Support ]=

=[ 🐕 Social ]=

[DragonStoneCreations]

A important point: Most programs mention DOS reports are not eligible for bounty. So do read the policy before spending your time guys!

[hhhhhhhhhhhhhhhhhhhhhh]

I've tried reporting a DoS to a company which literally just involves sending a request to their API with a deeply nested array as the request body, which wasn't accepted, making me all the more mad seeing these bogus reports getting accepted and receiving a bounty..

[MechMK]

From personal experience, DoS vulnerabilities are usually addressed if and when they become an actual issue. There is no point in defending against theoretical scenarios, especially if they are rather contrived.

[BalintCsala]

So what you're saying is instead of looking for bugs in code, look for bugs in the bug bounty programs

[gcm]

It's up to the program's to adapt their policy. If DoS is in the policy, the bug hunter has no fault in reporting.

[vix]

Wait, has LiveOverflow just found an exploit in the bounty system? Is this a vulnerability that should be fixed?

[bimalpandey]

12:30 I thought there was in intruder in my house dude. scared the s out of me.

[prakharx]

12:33 and 12:36 literally scared for a second, just thought that the background sound comes from my device.

[demotedcder]

Alex from TCM Security recommended this channel in one of his live streams, and he's right; the content here is excellent; thanks for sharing liveoverflow.

[izbromz]

@liveoverflow I am a pentester and for me there is a distinction between DOS 'attack by single ip' and DDOS 'attack by multiple ips'. If I see that I can render the server unavailable for other users simply by using one machine I will report it as an issue. To me it is unacceptable since a single machine should not have the ability to affect other users of the platform. Especially when it comes paired with a function that sends email or a SQL store since there is absolutely no reason why a legitimate user would need to inject 5000 calendar items in 1 minute time for example. It's not about complete protection but its about putting up boundries.

[leumasme]

11:06 you're brushing off a legitimate report here. The report says that IPv6 rate limiting is not properly implemented, rate-limiting the single IP instead of the subnet. The IPv6 spec requires that each device can select its ip itself from a /64 subnet (at least). That is 2x the bit size of the whole ipv4 space, more IPs than you could ever use, making this way of IPv6 rate-limiting ineffective. IPv6 needs to be IP-Ratelimited/Banned differently from ipv4.

[korockinout]

Thanks for this and your HospitalRun video; it is great to expose these issues that are potentially working against improving the state of infosec.

[homelabsmart]

Bug Report: WTF is that voice at 12:33

[impostorsyndrome]

It's funny how these people say "there is money in hacking, it's easy", but then fail to mention that all that money is pretty much unreachable from people at the start. All the veterans claim it by running automatization bots. This is the same with web bug bounties. Unless you're advanced level, you really don't have a chance.

[bosstowndynamics]

IMHO there's an additional factor that needs to be considered - in at least some cases it would be difficult to exclude these bogus DoS reports without also excluding important security flaws from a bug bounty program, and even if the fixes for these trivial attacks cost more than just buying some bandwidth that extra cost might still be worth it to a project in order to catch those actually sinister bugs.

[timseguine]

Glad you mentioned threat models. One of the most annoying things that happens regularly in my job is we get messages that we need to "fix" CVEs related to third party dependencies. Normally we just end up patching the software even if there is no actual attack vector for the CVE to be relevant to our software because that's easier than analyzing and documenting why it is irrelevant. Same thing applies to most findings from penetration tests.

[excitedbox]

a video to impress laymen with no clue. max string length setting for the input form? problem fixed. Second problem is a self own/dev skill issue. Don't use sleep to rate limit.Limit user actions.

[itsanantsingh]

I thought it would be some normal video because of the title but being honest, this was one of the most informative video I've watched.

[justbendev]

Sleeping is a dumb solution for me, why not just check with a redis DB and just drop requests, why sleep and hang the process ?
That's how i would do it because i'am so used to writing non blocking code for Single core microcontrollers usually we avoid a blocking state at all cost to avoid "wasting" cycles.

[vincviertytaccount]

I think the tradeoff between "bandwidth needed to send a long password" and "time server needs to compute hash" can be modified to the attackers advantage by using compression. If compression is possible at the TLS layer (which it shouldn't be anyways, CRIME is a thing), this is very easy, but depending on the way the password is transfered to the server, you may be able to use HTTP compression.