4 ms·

I would tend to agree. Facebook's point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view

by troebr 11y ago

I would tend to agree. Facebook's point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view though. "See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user, and then I'm just one click away from accessing all the instagram pictures I want." Although Facebook's handling of the problem is poor (why didn't the CSO call the author directly to get things squared out? He does not talk to people who are not C*O?), they do have a point. I think the author acted in good faith, but got carried away by his findings unfortunately.

rileymat2 11y ago
"See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user" However, these weak passwords could have been exploited separately as part of an attack. It is fair to call it a new vulnerability, even though it was discovered by exploiting the first vulnerability.
slantedview 11y ago
Exploiting the bug would have been downloading the actual contents of the S3 bucket (the instagram source and other things). He specifically says he did not do that.
- brazzledazzle 11y ago
  He clearly made a big effort not to violate privacy. The problem is that he made their security look like a joke by getting the keys to the kingdom without anyone noticing. Did that big expensive IDS catch him? Nope. Did any of the log watchers babysitting the AWS logs? Nope. One researcher made the CSO look incompetent in the matter of minutes. If he had found a bug with something a developer wrote that would be a different story. What he found was layer after layer of Operations (particularly Security Operations) failures. This is something you hire a CSO to think about (or at least hire/manage others to think about).
- daveloyall 11y ago
  Are we reading the same article? > [...] I queued up several buckets to download, and went to bed for the night. > The next day, I began to go through some of what I'd downloaded, [...]

by troebr 11y ago

rileymat2 11y ago

"See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user" However, these weak passwords could have been exploited separately as part of an attack. It is fair to call it a new vulnerability, even though it was discovered by exploiting the first vulnerability.

slantedview 11y ago

Exploiting the bug would have been downloading the actual contents of the S3 bucket (the instagram source and other things). He specifically says he did not do that.

brazzledazzle 11y ago
He clearly made a big effort not to violate privacy. The problem is that he made their security look like a joke by getting the keys to the kingdom without anyone noticing. Did that big expensive IDS catch him? Nope. Did any of the log watchers babysitting the AWS logs? Nope. One researcher made the CSO look incompetent in the matter of minutes. If he had found a bug with something a developer wrote that would be a different story. What he found was layer after layer of Operations (particularly Security Operations) failures. This is something you hire a CSO to think about (or at least hire/manage others to think about).
daveloyall 11y ago
Are we reading the same article? > [...] I queued up several buckets to download, and went to bed for the night. > The next day, I began to go through some of what I'd downloaded, [...]