While developers do their best to ensure the programs and apps they make are secure when they’re released, it’s often impossible for a team to find every bug. That’s why bug bounties exist, as a way to reward users who help developers find security flaws in the programs we use every day. It’s also why Rafay Baloch is currently $5,000 richer.
Baloch recently discovered a vulnerability in the way Chrome and Firefox render website addresses, which allowed attackers to send users to spoof websites that appear to be real but are actually elaborate frauds. The vulnerability was caused by the browser’s flipping of web addresses that are written right-to-left, since that’s how some languages, such as Arabic, are read.
According to Baloch’s example, if a user were to input 127.0.0.1/I/http://example.com, the browser would display it as simply http://example.com/i/127.0.0.1, while still sending the user to 127.0.0.1/i/http://example.com. This allowed scam artists to trick users to visiting spoof sites that use the guise of official domains.
According to Baloch the issue will be resolved when Chrome 53 and Firefox 48 are released. In the meantime let Baloch’s windfall be your inspiration. If you’ve got the skill to discover a bug it could pay off in more than just a pat on the back for making the world a better place. It could land you cold hard cash.
