5 ms·

Bug Bounty Ethics

minimaxir 11y ago
> Wes was not happy with the amount we offered him Wait, how does that work? Are there negotiations involved in Bug Bounties? But there's no leverage once the bug has been exposed!
- fredgrott 11y ago
  wait they offered him money and when he did not bow down to facebook they harass him through his employer? Talk about ethical lapse big time
  - andylei 11y ago
    they offered him money because it is a bug bounty program
- tptacek 11y ago
  They're bounties. You aren't selling the bug. It's like that on every bug bounty program; very few of them will give you line-item prices for bugs by bug class.
- ryanlol 11y ago
  By saying "I'm unhappy with the amount". It's not like he has much to bargain with, but there's nothing stopping him from expressing his displeasure.
  - Nadya 11y ago
    Possible non-disclosure of a future discovery based on being "shorted" for a past discovery. It's nothing solid, but it is something to worry about.
- jessriedel 11y ago
  I think the disagreement is over which bounty should be awarded, which hinged on whether to classify the bug as original (or something).
staunch 11y ago
He's spinning what happened, now that his actions are public. It's not like the reporter wasn't responding to his emails. Alex Stamos only called the guy's boss to intimidate, bully, and threaten him with legal action. He admits what he did but thinks it wasn't wrong and won't apologize. His sense of ethics seem to be one-sided. Someone needs to call Zuckerberg to let him know about the aggressive and unethical behavior of his employee.
- deleted 11y ago
  [deleted]
ryanlol 11y ago
>At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. This is pretty questionable, and seems more like a hastily made up excuse. If Alex wasn't acting with malicious intent then the logical approach would've been to ask the researcher if he's operating on behalf of synack.
- Artemis2 11y ago
  Especially that Alex does not mention lawyering up at any point in his post. That's something that Wes reported though: "Alex then stated that he did not want to have to get Facebook's legal team involved, but that he wasn't sure if this was something he needed to go to law enforcement over." (from the original blog post).
- kecks 11y ago
  It seems pretty transparant that it's spin on "maybe this jerk will stop bothering us if we mess with his main source of income". This guy was definitely acting in bad faith when he called the guy's boss and not the guy himself first.
- nikcub 11y ago
  Yes it is complete bullshit. This account is full of minimizing Facebook's role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works). > His account on our portal mentions Synack as his affiliation Note 'his account' here is just his Facebook account. So you can rewrite that line as 'his Facebook account lists him as employed at Synack' > he has interacted with us using a synack.com email address That would be a crazy new precedent if we use email addresses as authority > and he has written blog posts that are used by Synack for marketing purposes. having written blog posts is even crazier. Were Alex genuine in thinking this was Synack he would have copied Wes on the email and/or he would have asked him. He straight up went behind his back and over his head. Facebook had a bounty program that was very respected and operated well. I don't understand how they've completely fucked this up and turned it into a pissing contest. Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with. This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake. I really, really don't get this. edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real/public name. avoid blowback, everyone gets it at least once.
Mandatum 11y ago
He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. I agree the researcher shouldn't have escalated/pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from "so-so" to "holy shit". Whether this policy for disabling pivoting is realistic/a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn't hesitate, however FB can't have people crawling around their internal network, potentially breaking or leaking user information. The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+. EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says: > Intentional exfiltration of data is not authorized by our bug bounty program However the ToS only talks about USER data. AWS S3 keys aren't included we can assume. This is a tricky situation.
- ryanlol 11y ago
  > that in itself breaks their ToS for the bug bounty program Except it doesn't?
  - Mandatum 11y ago
    Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
    - ryanlol 11y ago
      Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
      - Mandatum 11y ago
        You're actually correct. I think this situation is a bit more complicated than it seems at first. Updated original reply.
kecks 11y ago
The discussion on the researcher's blog post: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
dang 11y ago
This is the same story as https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194, and the same story should not be both at #1 and #2. Normally the thing we do with rapidly developing stories, i.e. when a new post adds significant information, is bury the previous thread and leave the new one up. But my sense is that people wouldn't prefer that in this case, and since the current post is already being discussed in (edit: at the top of) the other thread, we'll leave that one up instead.
- kecks 11y ago
  Oh, I haven't spotted moderation in action before. Does this mean this thread will be merged into the old one? Or will it be removed?
  - dang 11y ago
    Normally we do that, but the specific comments in this thread wouldn't make sense in the other one. So it's probably not a good idea this time. The obvious solution is to support aggregating related URLs, and we will do that eventually, but there are other things that need to be done first (I don't just mean that have higher priority, but that are literal prerequisites). In the meantime, it's partial manual fixes for the lot of us.
- sqren 11y ago
  It seems this post has now been removed from the front page. I understand your reasons for not wanting to have two similar discussions simultaneously. However, the two posts paint two different sides of the same story. How are people going to read this side of the story if it's been hidden?
  - dang 11y ago
    The top subthread there links to this post, and the top several subthreads are substantive defences of its position. Anyone who wants to read the other side of the story will have little trouble finding it.
kderbe 11y ago
How come this article has fallen off the front page so quickly? It's on page 7 now, even with nearly 100 points in under an hour's time.
- dang 11y ago
  https://news.ycombinator.com/item?id=10755361 https://news.ycombinator.com/item?id=10755361
deleted 11y ago
[deleted]
paddlepop 11y ago
I'm struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more to be gained after he had those API keys - for any other researcher its game over, you won. As far as I'm concerned anything that happens to you after that point is of your own making
onestone 11y ago
"the bug, which is less critical than several other public reports that we have rewarded and celebrated" The bug lead to full access to critical data, and possibly to full control of their servers. It's interesting what these other "more critical" bugs were. "Not very original" != "not critical". Alex seems to imply these are equivalent.
mcphage 11y ago
I don't quite get Facebook's position here. This guy demonstrated that all of Instagram's data is publicly accessible. By jerking him around, they are resting a lot of money on their belief that he's not a black hat hacker. If they were wrong, they're looking at the mother of all data leaks. Would they want to tread a least somewhat gently with him, instead of treating him like he is black hat? I mean, luckily for them he's not, but what if they were wrong?

> Wes was not happy with the amount we offered him Wait, how does that work? Are there negotiations involved in Bug Bounties? But there's no leverage once the bug has been exposed!

fredgrott 11y ago
wait they offered him money and when he did not bow down to facebook they harass him through his employer? Talk about ethical lapse big time
- andylei 11y ago
  they offered him money because it is a bug bounty program
tptacek 11y ago
They're bounties. You aren't selling the bug. It's like that on every bug bounty program; very few of them will give you line-item prices for bugs by bug class.
ryanlol 11y ago
By saying "I'm unhappy with the amount". It's not like he has much to bargain with, but there's nothing stopping him from expressing his displeasure.
- Nadya 11y ago
  Possible non-disclosure of a future discovery based on being "shorted" for a past discovery. It's nothing solid, but it is something to worry about.
jessriedel 11y ago
I think the disagreement is over which bounty should be awarded, which hinged on whether to classify the bug as original (or something).

staunch 11y ago

He's spinning what happened, now that his actions are public. It's not like the reporter wasn't responding to his emails. Alex Stamos only called the guy's boss to intimidate, bully, and threaten him with legal action. He admits what he did but thinks it wasn't wrong and won't apologize. His sense of ethics seem to be one-sided. Someone needs to call Zuckerberg to let him know about the aggressive and unethical behavior of his employee.

deleted 11y ago
[deleted]

ryanlol 11y ago

>At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. This is pretty questionable, and seems more like a hastily made up excuse. If Alex wasn't acting with malicious intent then the logical approach would've been to ask the researcher if he's operating on behalf of synack.

Artemis2 11y ago
Especially that Alex does not mention lawyering up at any point in his post. That's something that Wes reported though: "Alex then stated that he did not want to have to get Facebook's legal team involved, but that he wasn't sure if this was something he needed to go to law enforcement over." (from the original blog post).
kecks 11y ago
It seems pretty transparant that it's spin on "maybe this jerk will stop bothering us if we mess with his main source of income". This guy was definitely acting in bad faith when he called the guy's boss and not the guy himself first.
nikcub 11y ago
Yes it is complete bullshit. This account is full of minimizing Facebook's role in this when we all know that contacting the employer was a straight forward intimidation tactic that is unfortunately all to common in infosec (because it works). > His account on our portal mentions Synack as his affiliation Note 'his account' here is just his Facebook account. So you can rewrite that line as 'his Facebook account lists him as employed at Synack' > he has interacted with us using a synack.com email address That would be a crazy new precedent if we use email addresses as authority > and he has written blog posts that are used by Synack for marketing purposes. having written blog posts is even crazier. Were Alex genuine in thinking this was Synack he would have copied Wes on the email and/or he would have asked him. He straight up went behind his back and over his head. Facebook had a bounty program that was very respected and operated well. I don't understand how they've completely fucked this up and turned it into a pissing contest. Just say sorry, forgive the guy for the data download, clarify that it was against the rules anyway, give the guy $20k, apologize for contacting his employer and just get it over with. This way it is just going to drag on for days now and everybody has already forgotten that it was the reporter who made the first mistake. I really, really don't get this. edit: tip to researchers - create a new alias for each bug you report. once the bug is all done and settled claim it under your real/public name. avoid blowback, everyone gets it at least once.

Mandatum 11y ago

He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. I agree the researcher shouldn't have escalated/pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from "so-so" to "holy shit". Whether this policy for disabling pivoting is realistic/a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn't hesitate, however FB can't have people crawling around their internal network, potentially breaking or leaking user information. The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+. EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says: > Intentional exfiltration of data is not authorized by our bug bounty program However the ToS only talks about USER data. AWS S3 keys aren't included we can assume. This is a tricky situation.

ryanlol 11y ago
> that in itself breaks their ToS for the bug bounty program Except it doesn't?
- Mandatum 11y ago
  Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
  - ryanlol 11y ago
    Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
    - Mandatum 11y ago
      You're actually correct. I think this situation is a bit more complicated than it seems at first. Updated original reply.

kecks 11y ago

The discussion on the researcher's blog post: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

dang 11y ago

This is the same story as https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194, and the same story should not be both at #1 and #2. Normally the thing we do with rapidly developing stories, i.e. when a new post adds significant information, is bury the previous thread and leave the new one up. But my sense is that people wouldn't prefer that in this case, and since the current post is already being discussed in (edit: at the top of) the other thread, we'll leave that one up instead.

kecks 11y ago
Oh, I haven't spotted moderation in action before. Does this mean this thread will be merged into the old one? Or will it be removed?
- dang 11y ago
  Normally we do that, but the specific comments in this thread wouldn't make sense in the other one. So it's probably not a good idea this time. The obvious solution is to support aggregating related URLs, and we will do that eventually, but there are other things that need to be done first (I don't just mean that have higher priority, but that are literal prerequisites). In the meantime, it's partial manual fixes for the lot of us.
sqren 11y ago
It seems this post has now been removed from the front page. I understand your reasons for not wanting to have two similar discussions simultaneously. However, the two posts paint two different sides of the same story. How are people going to read this side of the story if it's been hidden?
- dang 11y ago
  The top subthread there links to this post, and the top several subthreads are substantive defences of its position. Anyone who wants to read the other side of the story will have little trouble finding it.

kderbe 11y ago

How come this article has fallen off the front page so quickly? It's on page 7 now, even with nearly 100 points in under an hour's time.

dang 11y ago
https://news.ycombinator.com/item?id=10755361 https://news.ycombinator.com/item?id=10755361

deleted 11y ago

[deleted]

paddlepop 11y ago

I'm struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more to be gained after he had those API keys - for any other researcher its game over, you won. As far as I'm concerned anything that happens to you after that point is of your own making

onestone 11y ago

"the bug, which is less critical than several other public reports that we have rewarded and celebrated" The bug lead to full access to critical data, and possibly to full control of their servers. It's interesting what these other "more critical" bugs were. "Not very original" != "not critical". Alex seems to imply these are equivalent.

mcphage 11y ago

I don't quite get Facebook's position here. This guy demonstrated that all of Instagram's data is publicly accessible. By jerking him around, they are resting a lot of money on their belief that he's not a black hat hacker. If they were wrong, they're looking at the mother of all data leaks. Would they want to tread a least somewhat gently with him, instead of treating him like he is black hat? I mean, luckily for them he's not, but what if they were wrong?