6 ms·

The real question is did you rotate the keys (and do further hardening, I hope!) because of the vuln report Wes made? If so, than you should be grateful for h

The real question is did you rotate the keys (and do further hardening, I hope!) because of the vuln report Wes made? If so, than you should be grateful for his work pointing out your mistaken single point of failure via AWS S3 security and you should have rewarded him handsomely.

bigiain 11y ago
I can't work out how to not make this sound almost infinitely cynical, but their ssl key expires in 13 days - they only had to shut him up for another few weeks and they could have pretended they weren't currently MITM-able: https://www.instagram.com https://www.instagram.com Not Valid After: Thursday, 31 December 2015 11:00:00 pm Australian Eastern Daylight Time Maybe they'll upgrade it to something better than: Signature algorithm SHA1withRSA WEAK
- agrot3ra 11y ago
  Does this have anything to do with the SHA1 sunset on 31 December?
  - bigiain 11y ago
    That'll be why the key expires on Dec 31 even though it was only issued back in April. It doesn't explain why Instagram has been happily using a known-compromised wildcard ssl key for two weeks now. Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...
    - Phlarp 11y ago
      >Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO... No, I don't wonder about this at all.
  - secalex 11y ago
    Different key, dude. We rotated what was exposed.
    - kuschku 11y ago
      Do you believe that after this chain of events anyone still believes your company? Additionally, I hope that the EU data privacy official is going to take a look at this, as it shows that Facebook improperly secured their systems, and not even properly handled the disclosure of exploits. EDIT: Clarification, replaced plural you with direct names and better pronouns.
      - dang 11y ago
        > Do you believe that after this chain of events anyone still believes you? Personal attacks, which this crosses into, are not allowed on Hacker News. Please comment civilly or not at all.
        kuschku 11y ago
        I am not talking about the person, but the company. And I am sorry, but after these acts the company has taken, the little bit of trust that was left in the company is gone. I am sorry if it sounded like a personal attack, that was not intended.
        blazespin 11y ago
        OH COME ON Dang, Alex called up Wes's employer and threatened him with criminal charges and then had the balls to lie about it in his facebook post that he didn't "Threaten". Are you seriously defending this??
        dang 11y ago
        Asking HN users to be civil defends nothing except civility. There's a relevant general point here though. Reactions like this, and many others in this thread, are reflexive. That's really not what this site is for. Good comments for HN aren't reflexive, they're reflective. Practicing that distinction is the most important thing for being a contributor here, and it's orthogonal to one's actual views.
  - droopybuns 11y ago
    outstanding question.
deleted 11y ago
[deleted]
adrianmacneil 11y ago
If he had reported the keys along with the original submission, I think it's safe to assume they probably would have rewarded him handsomely. Instead, he sat on the keys for over a month, and in the meantime used them to download everything he could find onto his personal computer. Simply testing that the keys were live and disclosing this immediately would have been more than enough proof of a bug here. Edit: downvoters - please explain how using keys to access production systems for over a month without disclosing is acceptable white-hat behavior?
DullDeveloper 11y ago
They said they did rotate the keys.
jacurtis 11y ago
I think that is the key right there. It seems like the sensu.instagram.com was simply firewalled at first and the AWS keys were not changed. He was then awarded the bounty for reporting this bug. Afterward he demonstrated that the AWS keys were another vulnerability, and it wasn't until after reporting this, that the AWS keys were rotated. To me, this demonstrates that had Wes not reported the AWS keys, then Facebook would never have rotated them. I would argue that the fact Facebook found need to take action to resolve Wes' third vulnerability submission, could be considered an admission to its legitimacy as a bug. Therefore concluding that the bug is indeed worthy of a bounty.

bigiain 11y ago

I can't work out how to not make this sound almost infinitely cynical, but their ssl key expires in 13 days - they only had to shut him up for another few weeks and they could have pretended they weren't currently MITM-able: https://www.instagram.com https://www.instagram.com Not Valid After: Thursday, 31 December 2015 11:00:00 pm Australian Eastern Daylight Time Maybe they'll upgrade it to something better than: Signature algorithm SHA1withRSA WEAK

agrot3ra 11y ago
Does this have anything to do with the SHA1 sunset on 31 December?
- bigiain 11y ago
  That'll be why the key expires on Dec 31 even though it was only issued back in April. It doesn't explain why Instagram has been happily using a known-compromised wildcard ssl key for two weeks now. Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...
  - Phlarp 11y ago
    >Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO... No, I don't wonder about this at all.
- secalex 11y ago
  Different key, dude. We rotated what was exposed.
  - kuschku 11y ago
    Do you believe that after this chain of events anyone still believes your company? Additionally, I hope that the EU data privacy official is going to take a look at this, as it shows that Facebook improperly secured their systems, and not even properly handled the disclosure of exploits. EDIT: Clarification, replaced plural you with direct names and better pronouns.
    - dang 11y ago
      > Do you believe that after this chain of events anyone still believes you? Personal attacks, which this crosses into, are not allowed on Hacker News. Please comment civilly or not at all.
      - kuschku 11y ago
        I am not talking about the person, but the company. And I am sorry, but after these acts the company has taken, the little bit of trust that was left in the company is gone. I am sorry if it sounded like a personal attack, that was not intended.
      - blazespin 11y ago
        OH COME ON Dang, Alex called up Wes's employer and threatened him with criminal charges and then had the balls to lie about it in his facebook post that he didn't "Threaten". Are you seriously defending this??
        dang 11y ago
        Asking HN users to be civil defends nothing except civility. There's a relevant general point here though. Reactions like this, and many others in this thread, are reflexive. That's really not what this site is for. Good comments for HN aren't reflexive, they're reflective. Practicing that distinction is the most important thing for being a contributor here, and it's orthogonal to one's actual views.
- droopybuns 11y ago
  outstanding question.

deleted 11y ago

[deleted]

adrianmacneil 11y ago

If he had reported the keys along with the original submission, I think it's safe to assume they probably would have rewarded him handsomely. Instead, he sat on the keys for over a month, and in the meantime used them to download everything he could find onto his personal computer. Simply testing that the keys were live and disclosing this immediately would have been more than enough proof of a bug here. Edit: downvoters - please explain how using keys to access production systems for over a month without disclosing is acceptable white-hat behavior?

DullDeveloper 11y ago

They said they did rotate the keys.

jacurtis 11y ago

I think that is the key right there. It seems like the sensu.instagram.com was simply firewalled at first and the AWS keys were not changed. He was then awarded the bounty for reporting this bug. Afterward he demonstrated that the AWS keys were another vulnerability, and it wasn't until after reporting this, that the AWS keys were rotated. To me, this demonstrates that had Wes not reported the AWS keys, then Facebook would never have rotated them. I would argue that the fact Facebook found need to take action to resolve Wes' third vulnerability submission, could be considered an admission to its legitimacy as a bug. Therefore concluding that the bug is indeed worthy of a bounty.