4 ms·

He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. I agree the researcher shouldn't have escalated/pivoted once th

He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. I agree the researcher shouldn't have escalated/pivoted once they had access, that in itself breaks their ToS for the bug bounty program. However in doing so the vuln went from "so-so" to "holy shit". Whether this policy for disabling pivoting is realistic/a bit of a cop-out from the vendor is arguable. In the real world an attacker wouldn't hesitate, however FB can't have people crawling around their internal network, potentially breaking or leaking user information. The researcher, with all of his experience (incl a 24K bount payout from MS) should be aware of the above. However less ethically inclined hackers would have sold this access for $100K+. EDIT: User ryanlol has made a good point, I thought they included fucking around within the server to break ToS. But their page does not indicate that. From the article it says: > Intentional exfiltration of data is not authorized by our bug bounty program However the ToS only talks about USER data. AWS S3 keys aren't included we can assume. This is a tricky situation.

ryanlol 11y ago
> that in itself breaks their ToS for the bug bounty program Except it doesn't?
- Mandatum 11y ago
  Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
  - ryanlol 11y ago
    Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
    - Mandatum 11y ago
      You're actually correct. I think this situation is a bit more complicated than it seems at first. Updated original reply.
- franjkovic 11y ago
  I'd say it does. Not interact with other accounts without the consent of their owners. Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.
  - ryanlol 11y ago
    Obviously that's referring to facebook accounts. Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent. Also, the guy seems to only have verified that the credentials worked.
deleted 11y ago
[deleted]
pvg 11y ago
He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. Or, he got in touch with the company he thought the researcher was affiliated with, to discuss what he felt was a very serious issue without involving lawyers. The classic outrage case is when a big company starts sending scary letters signed by lawyers, first thing. Maybe we should be less outraged when someone goes out of his way to be reasonable.
- Mandatum 11y ago
  He brought up both lawyers and law enforcement in that phone call. Come on, dude.
  - pvg 11y ago
    He didn't. Also, he made a phone call and made every effort to give the benefit of the doubt to someone who, perhaps not maliciously and through naiveté, did something very silly and then made it even sillier by making it look hard to distinguish from extortion. The best possible outcome there would have been a grumpy letter from lawyers asking him to sign an affidavit he's destroyed all the data he picked up. The worst would have been people in suits packing away his every computing device at 4 am. None of this happened and it seems the main reason it didn't is 'Alex Stamos is not a dick and Facebook lets him not be a dick'. That's a good outcome, by any measure.
kecks 11y ago
He might've just got hashes from those private keys, for proof. It's not clear if he actually took all these keys. To me this would seem like a responsible, easy and realistic way of proving you could've taken the keys if you were malicious. The whole point is kinda moot, seeing how they did not have proper auditing and can't know if the keys were taken either way.
Mandatum 11y ago
I am really disappointed at Facebook for their stance in this situation. The blog post written by Alex reaches far too into the personal attack territory. > We were surprised because he did not mention these actions in his previous correspondence with us. Painting a picture/creating a narrative, poor us, we're surprised. > it was reasonable to believe that Wes was operating on behalf of Synack Filling in affiliations, or using a company address during parts of communication could very well have been out of detailing legitimacy as well as convenience. You can not, and should not infer a researcher operates on behalf of their company when reporting a bug, and as a CSO and someone who acts as a security researcher you KNOW that we always distance ourselves from our workplace when reporting or talking about security. > Wes to set a precedent that anybody can exfiltrate unnecessary amounts of data Logging in, grabbing keys but not touching user data is most certainly not breaking your ToS. Yet you paint it as unethical here. Where do you draw the line? Internal network names? Internal IP's, passwd files? > one of my engineers involved in this issue once found a great (and in his case, original) RCE Really, "and in his case, original"? Come on, act professional you're presenting one of the largest companies in the world. > we have no evidence that Wes or anybody else accessed any user data DING! DING! DING! Yet using terms like "intentional exfiltration of data" to draw grey areas that convenience you. They've definitely screwed the pooch on this one.

ryanlol 11y ago

> that in itself breaks their ToS for the bug bounty program Except it doesn't?

Mandatum 11y ago
Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.
- ryanlol 11y ago
  Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.
  - Mandatum 11y ago
    You're actually correct. I think this situation is a bit more complicated than it seems at first. Updated original reply.
franjkovic 11y ago
I'd say it does. Not interact with other accounts without the consent of their owners. Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.
- ryanlol 11y ago
  Obviously that's referring to facebook accounts. Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent. Also, the guy seems to only have verified that the credentials worked.

deleted 11y ago

[deleted]

pvg 11y ago

He phoned the researcher's CEO and subtly threatened legal action. This is spin at it's finest. Or, he got in touch with the company he thought the researcher was affiliated with, to discuss what he felt was a very serious issue without involving lawyers. The classic outrage case is when a big company starts sending scary letters signed by lawyers, first thing. Maybe we should be less outraged when someone goes out of his way to be reasonable.

Mandatum 11y ago
He brought up both lawyers and law enforcement in that phone call. Come on, dude.
- pvg 11y ago
  He didn't. Also, he made a phone call and made every effort to give the benefit of the doubt to someone who, perhaps not maliciously and through naiveté, did something very silly and then made it even sillier by making it look hard to distinguish from extortion. The best possible outcome there would have been a grumpy letter from lawyers asking him to sign an affidavit he's destroyed all the data he picked up. The worst would have been people in suits packing away his every computing device at 4 am. None of this happened and it seems the main reason it didn't is 'Alex Stamos is not a dick and Facebook lets him not be a dick'. That's a good outcome, by any measure.

kecks 11y ago

He might've just got hashes from those private keys, for proof. It's not clear if he actually took all these keys. To me this would seem like a responsible, easy and realistic way of proving you could've taken the keys if you were malicious. The whole point is kinda moot, seeing how they did not have proper auditing and can't know if the keys were taken either way.

Mandatum 11y ago

I am really disappointed at Facebook for their stance in this situation. The blog post written by Alex reaches far too into the personal attack territory. > We were surprised because he did not mention these actions in his previous correspondence with us. Painting a picture/creating a narrative, poor us, we're surprised. > it was reasonable to believe that Wes was operating on behalf of Synack Filling in affiliations, or using a company address during parts of communication could very well have been out of detailing legitimacy as well as convenience. You can not, and should not infer a researcher operates on behalf of their company when reporting a bug, and as a CSO and someone who acts as a security researcher you KNOW that we always distance ourselves from our workplace when reporting or talking about security. > Wes to set a precedent that anybody can exfiltrate unnecessary amounts of data Logging in, grabbing keys but not touching user data is most certainly not breaking your ToS. Yet you paint it as unethical here. Where do you draw the line? Internal network names? Internal IP's, passwd files? > one of my engineers involved in this issue once found a great (and in his case, original) RCE Really, "and in his case, original"? Come on, act professional you're presenting one of the largest companies in the world. > we have no evidence that Wes or anybody else accessed any user data DING! DING! DING! Yet using terms like "intentional exfiltration of data" to draw grey areas that convenience you. They've definitely screwed the pooch on this one.