6 ms·
Summarizing what I've seen here in analogy form: Researcher: "I found a way to unlock your door" Facebook: "Thanks, here's $2500. We've now fixed the prob
by biot 11y ago
Summarizing what I've seen here in analogy form:
Researcher: "I found a way to unlock your door"
Facebook: "Thanks, here's $2500. We've now fixed the problem."
Researcher: "Oh, BTW when I unlocked your door I rifled through
your stuff and found your passport, your banking details, and a
lot of personal information. I've kept copies of these. I also
found the keys to your car and looked inside, where I found a box
in the trunk. That box contained sensitive documents including an
employee badge / proximity card. I used this card to gain access
to your workplace. In doing this, I also managed to get into the
janitor's closet which had a set of keys. I used these keys to
get access to the complete building and took a look at all the HR
files and rifled through a bunch of corporate contracts."
Facebook: <gobsmacked>
Researcher: "Can I have my million bucks now?"
Where the researcher stepped over the line is using the door attack to escalate further attacks. It's little different than finding a way to reliably impersonate Mark Zuckerberg's credentials in such a way that others will 100% believe it. That finding is worthy of a reward. But then using that vulnerability to social engineer others to reveal passwords, using that as a launching point for mounting further attacks is going way too far.
- flgr 11y agoExcept that for a company as big as Facebook your security provisions probably shouldn't stop right at the front door.
- adrianmacneil 11y agoAlso note that the second part of this conversation happened over a month after the original report.
- bloaf 11y agoOh by the way, when I looked in your open front door, I noticed all your computer terminals had their passwords written on post-it notes by their monitors, and the big safe in the back room had its key hanging right next to it on a chain.
- deleted 11y ago[deleted]
- repn001 11y agoI saw it more like: Researcher: "I found a way to unlock your door" Facebook: "Thanks, here's $2500. We've now fixed the problem." Researcher: "Ohh hey about that bug. Turns out that door, if the guys from the Ashley Madison breach found first, your entire company would lose billions in market cap, you and all your friends would no longer have jobs, and the trust placed in your company by the public would be so eroded that there's a good chance it would no longer exist." Facebook: "Well this is embarrassing. Our boss found out and talked to your boss, the subject of lawyers and law enforcement may have been mentioned in an effort to keep this info getting to the public, and when this failed, he made a highly visible blog post discrediting your professional conduct" Researcher: <gobsmacked> You can make the case for misconduct on both sides but I'm more inclined to side with the researcher. If you define bugs and the associated bounty by the amount of possible damage it could cause, this one would definitely be 'catastrophic'. And Facebook would still be none the wiser if he hadn't dug deeper.
- niutech 11y agoSorry, but being a multi-billion company, pledging $1M bounty and giving only $2500 for a serious bug which could lead to taking control of the whole Instagram is greedy. I can understand why the researcher didn't stop there.