5 ms·

"The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit." LAUGH.. Where does it say this? https://www.facebo

"The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit." LAUGH.. Where does it say this? https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/ I think instagram should be asking themselves: Would they rather have an honest researcher report this or North Korean hackers not saying anything and just slurping data? Security Researchers are always going to see things they shouldn't. That's just a fundamental rule. You have to know who your real enemies are and not come down on someone just because they got a little enthusiastic. Wes [edit] is one of the good guys - he went overboard, sure, but he should be rewarded, he should be asked not to go crazy next time, and the rules should be updated. Personally, I think by saying the exploit was trivial shows that the CSO should be fired. If he has to make a phone call, it's not trivial.

foldr 11y ago
>If you give us reasonable time to respond to your report before making any information public, AND MAKE A GOOD FAITH EFFORT TO AVOID PRIVACY VIOLATIONS, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.
- dogecoinbase 11y ago
  I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make that explicit and specific.
  - foldr 11y ago
    Really? The article states: "To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement". How on earth would holding on to that data not be a privacy violation?
    - dogecoinbase 11y ago
      Holding credentials is not violating privacy. It would be possible to use those credentials to violate privacy, but merely having them is not that act.
      - dsacco 11y ago
        Holding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user's password is not a privacy violation unless you use it to gain access to their account.
        enixn 11y ago
        So would you agree that holding the keys to someone's house is also a privacy violation? What if instead of keys, you were holding a set of lockpicks? Would everyone's privacy of home be immediately violated?
        foldr 11y ago
        It's all a question of intent. If you keep the lockpicks so that you can pick locks, then yes. If you're a lockpick collector, then no.
        Gravityloss 11y ago
        I understood it was employee credentials, not customer.
        comex 11y ago
        Holding a manually chosen password can be a privacy violation because it's a small peek into the user's psyche. (I wouldn't say the employee "changeme", "instagram" etc. passwords count, although the act of running a password cracking tool meant that he could have seen a more personal password.) Holding some randomly generated numbers that could be used to access a server is not.
    - Cakez0r 11y ago
- kecks 11y ago
  Whose privacy did Wes violate? Do webservers have data personal to them?
  - daveguy 11y ago
    Privacy in this case is in an infosec context. Not a personal information context. Finding the open/unsecured/unpatched server is a bug. Downloading and testing a password keyring found as a result of that bug is not finding a bug. That is exploiting a bug for additional gain.
    - jsmeaton 11y ago
      Finding a sql injection in a query string is finding a bug. Is using the injection to dump a table exploiting the bug for additional gain? It sounds like you're only allowed to penetrate one layer of a defence in depth system. If you gain access to some edge system that isn't sensitive, I'd assume that would pay little. If you gain access to some core system, I'd assume that would pay lots. Why then are you not allowed to pivot from some nothing system to some larger system? The purpose of bug bounties is to secure your systems. If you only ever secure the first layer, if some malicious actor finds another vector into the same system and there is a really easy pivot in sight (like full access to an S3 account!) then you've lost. If the bug bounty hunter found the escalation though and responsibly reported that, then a potential second vector loses its potency. I'm not a security person at all so I'd like to hear some perspective on my thoughts above. It just seems fairly short sighted to specifically forbid pivoting. FWIW dumping S3 buckets as a white hat does seem wrong to me. Listing them probably ok.

foldr 11y ago

>If you give us reasonable time to respond to your report before making any information public, AND MAKE A GOOD FAITH EFFORT TO AVOID PRIVACY VIOLATIONS, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.

dogecoinbase 11y ago
I certainly wouldn't consider dumping credentials to test for reuse/continued use a privacy violation. If FB wants people not to dump data, they need to make that explicit and specific.
- foldr 11y ago
  Really? The article states: "To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement". How on earth would holding on to that data not be a privacy violation?
  - dogecoinbase 11y ago
    Holding credentials is not violating privacy. It would be possible to use those credentials to violate privacy, but merely having them is not that act.
    - dsacco 11y ago
      Holding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user's password is not a privacy violation unless you use it to gain access to their account.
      - enixn 11y ago
        So would you agree that holding the keys to someone's house is also a privacy violation? What if instead of keys, you were holding a set of lockpicks? Would everyone's privacy of home be immediately violated?
        foldr 11y ago
        It's all a question of intent. If you keep the lockpicks so that you can pick locks, then yes. If you're a lockpick collector, then no.
      - Gravityloss 11y ago
        I understood it was employee credentials, not customer.
      - comex 11y ago
        Holding a manually chosen password can be a privacy violation because it's a small peek into the user's psyche. (I wouldn't say the employee "changeme", "instagram" etc. passwords count, although the act of running a password cracking tool meant that he could have seen a more personal password.) Holding some randomly generated numbers that could be used to access a server is not.
  - Cakez0r 11y ago
kecks 11y ago
Whose privacy did Wes violate? Do webservers have data personal to them?
- daveguy 11y ago
  Privacy in this case is in an infosec context. Not a personal information context. Finding the open/unsecured/unpatched server is a bug. Downloading and testing a password keyring found as a result of that bug is not finding a bug. That is exploiting a bug for additional gain.
  - jsmeaton 11y ago
    Finding a sql injection in a query string is finding a bug. Is using the injection to dump a table exploiting the bug for additional gain? It sounds like you're only allowed to penetrate one layer of a defence in depth system. If you gain access to some edge system that isn't sensitive, I'd assume that would pay little. If you gain access to some core system, I'd assume that would pay lots. Why then are you not allowed to pivot from some nothing system to some larger system? The purpose of bug bounties is to secure your systems. If you only ever secure the first layer, if some malicious actor finds another vector into the same system and there is a really easy pivot in sight (like full access to an S3 account!) then you've lost. If the bug bounty hunter found the escalation though and responsibly reported that, then a potential second vector loses its potency. I'm not a security person at all so I'd like to hear some perspective on my thoughts above. It just seems fairly short sighted to specifically forbid pivoting. FWIW dumping S3 buckets as a white hat does seem wrong to me. Listing them probably ok.