4 ms·

Yes, exactly this. Without escalating an RCE, how would he have been able to expose this absolutely huge flaw? The initial report was inconsequential, but this

by lox 11y ago

Yes, exactly this. Without escalating an RCE, how would he have been able to expose this absolutely huge flaw? The initial report was inconsequential, but this seems like at the very least a much more than $2500 bug. If things like this are considered "unethical" it kind of makes finding million dollar bugs in a bug bounty close to impossible.

joshuahutt 11y ago
I agree. According to Stamos, though, there was no flaw: > The fact that AWS keys can be used to access S3 is expected behavior and would not be considered a security flaw in itself.
- option_greek 11y ago
  If he thinks that is how it should be and nothing needs to be changed then god save their user data. He conveniently missed out the key separation and privilege escalation shown by the researcher.
  - BHSPitMonkey 11y ago
    Yeah, that's like gaining root access on a server and being told "well, the fact that those commands will execute is merely Linux working as designed". Talk about missing the point...
- lovelearning 11y ago
  That surprised me too. Of course, AWS keys can be used to access S3, but I don't see how exposing private AWS keys on a public facing server can be "expected behavior".
onewaystreet 11y ago
He only got $2500 because the bug had already been reported by others. Most programs pay nothing in that case.
- msravi 11y ago
  Then the first one to report it should have been paid a lot more than the $2500. The fact is that FB didn't understand the impact of the bug, and it needed Wes to show them how severe the bug was. And once they knew how severe it was, they ought to have acknowledged the severity and paid him a lot more.
wepple 11y ago
I feel that privilege escalation/lateral movement is implicitly discluded from almost all bug bounty programs, most researchers know that. It's a really grey area beyond an initial 'access bug', so it pays not to go there. Otherwise, where should Wes have stopped? keep proving more vulnerabilities until he's downloaded their code? or got private photos of Zuckerbergs kid? Just to show that it is indeed a serious bug?

by lox 11y ago

joshuahutt 11y ago

I agree. According to Stamos, though, there was no flaw: > The fact that AWS keys can be used to access S3 is expected behavior and would not be considered a security flaw in itself.

option_greek 11y ago
If he thinks that is how it should be and nothing needs to be changed then god save their user data. He conveniently missed out the key separation and privilege escalation shown by the researcher.
- BHSPitMonkey 11y ago
  Yeah, that's like gaining root access on a server and being told "well, the fact that those commands will execute is merely Linux working as designed". Talk about missing the point...
lovelearning 11y ago
That surprised me too. Of course, AWS keys can be used to access S3, but I don't see how exposing private AWS keys on a public facing server can be "expected behavior".

onewaystreet 11y ago

He only got $2500 because the bug had already been reported by others. Most programs pay nothing in that case.

msravi 11y ago
Then the first one to report it should have been paid a lot more than the $2500. The fact is that FB didn't understand the impact of the bug, and it needed Wes to show them how severe the bug was. And once they knew how severe it was, they ought to have acknowledged the severity and paid him a lot more.

wepple 11y ago

I feel that privilege escalation/lateral movement is implicitly discluded from almost all bug bounty programs, most researchers know that. It's a really grey area beyond an initial 'access bug', so it pays not to go there. Otherwise, where should Wes have stopped? keep proving more vulnerabilities until he's downloaded their code? or got private photos of Zuckerbergs kid? Just to show that it is indeed a serious bug?