13 ms·

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook i

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

ghayes 11y ago
I suspect most whitehat researchers would be happier to report this vulnerability and make a nice legal reward, then delve into a black hat market for selling a vulnerability. Seems pretty win-win in this case.
- at-fates-hands 11y ago
  Unless your name is Kevin Mitnick. Then you set up a business and play middlemen in selling them to anybody who wants to pony up for it. "When we have a client that wants a zero-day vulnerability for whatever reason, we don’t ask, and in fact they wouldn’t tell us,” Mitnick tells WIRED in an interview. “Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” http://www.wired.com/2014/09/kevin-mitnick-selling-zero-day-exploits/ http://www.wired.com/2014/09/kevin-mitnick-selling-zero-day-...
  - eklavya 11y ago
    How is this legal?
    - SturgeonsLaw 11y ago
      Because he's selling to governments, who operate under the "it's not illegal when we do it" principle.
      - yuncun 11y ago
        What if it's the Chinese government that's buying, would it suddenly turn illegal?
    - lawnchair_larry 11y ago
      Why wouldn't it be? Someone looks at a program that they bought and paid for, and sees that it has a mistake. They didn't write the software or put the mistake there. How can it be a crime for them to become aware of behavior in someone else's program? Attacking others who use the software is an entirely different story of course.
- restalis 11y ago
  By reporting the problem to the owner you should assume that it might get fixed before you'll manage to sell it to other interested parties.
arcticfox 11y ago
I agree. This was basically unrestricted access to any Facebook account. What a MASSIVE flaw. And who knows if this was already exploited in the wild? $15k is nothing at all compared to the scale of this issue...
- wallflower 11y ago
  $15k and a likely open FB job offer
  - quadrature 11y ago
    for a bruteforce ?
  - Niksko 11y ago
    > job offer Really? For brute forcing an un-rate-limited endpoint? I doubt it.
    - baddox 11y ago
      I'm sure they might encourage him to interview, but he's not going to get a serious job offer just from this. There's essentially nothing technical or skillful going on here, other than the basic coding ability to do HTTP requests in a loop and the hunch to investigate if subdomains don't rate limit.
      - titanomachy 11y ago
        He was resourceful enough to find a security flaw of the highest severity in the only product of a $300 billion dollar company. A hole that was somehow missed by said company's own security auditors, who collectively are probably paid many millions of dollars per year entirely to look for such holes. So that's something. But you're right, he might have just got lucky. The one fish in a school of 100,000 who finds the hole in the net probably isn't smarter than all the other fish. But that just strengthens the argument that companies should reward very generously for these exploits, because increasing the number of white-hats looking for them is a good way to ensure that they get found by one.
mabbo 11y ago
During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this: > Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys to the kingdom to a major social network. (https://news.ycombinator.com/item?id=10756159 https://news.ycombinator.com/item?id=10756159) Expected payout = (Probability of reward * size of reward) +/- any additional value I put into who I'm selling it to. If I have an exploit that gives me a lot of access to Facebook (or any other large company) I have to run that formula for each entity that might pay me for it- Facebook, the NSA, the Chinese Military, and so on down the list. Facebook is offering high probability for a lower payout. The NSA might step up their game and start offering ten times as much, or make it more clear that they will indeed pay you for it (not that I have any proof they'd do such a thing). Make no mistake, Facebook has probably done this math very carefully when choosing a bounty.
- baddox 11y ago
  From this article I get the impression that the bounty wasn't even known before hand. It doesn't seem like a very careful consideration from Facebook, and I would expect it to be "too low" if they're choosing the amount after someone has already disclosed the bug.
- ktRolster 11y ago
  In other words, if you wanted to game the odds, you'd start by offering it on the black market, then if there were no takers after X number of days, offer it to Facebook?
  - tptacek 11y ago
    It is unlikely that there is any black market for this bug, or for the RCE that compromised Facebook's crypto secrets. https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173
dsacco 11y ago
This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting. Let's examine the facts: 1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking. 2. A Facebook vulnerability will be patched once it is widely used. Facebook's security team is one of the strongest and most sophisticated of any company, and their processes would quickly catch this once it was used. The total impact of the bug would be negligible. You'd lose the ability to compromise accounts as soon as you tried to do it in any meaningful or lucrative way. 3. A vulnerability in Facebook might last a week before being patched, but a vulnerability in PHP will persist on the internet for years. No matter how many individual sites patch their servers, you'll still be able to pop a lonely server with social security numbers chugging along in a closet somewhere. There really isn't much more to say about this. People claim bounties awarded by Facebook/Google/et al are undervalued every single time a bug bounty hits the front page of HN. Every single time, someone who is in the security industry patiently explains why it's not that valuable. If someone tried to go to a blackhat group or go to the "black-market" (a shadowy, lucrative place that never seems to be very well-defined in these conversations), he would not even be able to find a seller, let alone one who would pay a lot. What do you imagine someone would pay for this on the black-market? They'd need to profit from it. How much profit is worth their time? Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook? The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software. For further reading on bug bounty valuation: https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=8563884 https://news.ycombinator.com/item?id=8563884
- comboy 11y ago
  The point is, it's possible that if he was a black hat, he could have gotten much more for it on the black market. Even if it could only be used once or a few times. Bounties should not only be higher than what you can get on the black market. They should be high enough to make security experts spend their time trying to win them. Given probability of finding a bug with such impact, it is just not worth the time of any decent white hat (in terms of financial gain, sure it's nice to brag about it and that I believe is the biggest motivation). Money wise, for Facebook, it makes zero difference if they pay him that much or 5 times more.
baby 11y ago
this doesn't make any sense, most vulnerability you find on products are "game over" vulnerabilities. It's common. If you would give a billion dollars to every such findings in an audit then you would be pretty quickly calling bankruptcy. Also, I can personally live for a year on that kind of money. But that's another issue. On the other hand, that is maybe what they would have payed for a real audit of a few days/weeks and it's not even sure the vulnerability would have been found (especially considering the size of Facebook). So yeah maybe they also deserve more. I'm mixed.
- tptacek 11y ago
  David is right about this, too. A $50,000 pentest of any major web property is likely to find multiple sev:hi vulnerabilities. By the logic the grandparent comment uses, those audits should cost more like $1.5MM.
pbreit 11y ago
I assume it made its way into the wrong hands (not by the OP) and the amount of damage appears to be zero.
TACIXAT 11y ago
I do security audits and agree completely. My biggest issue is that the researcher is working for free. If nothing is found you just burnt a few weeks, if something is found the payout is usually only a couple grand. If people enjoy doing it, or it makes sense in their currency or situation, awesome. The payouts don't get me excited though. That's the market though. People who think it's too cheap don't play the game, people who think it's good money do.
- dr_zoidberg 11y ago
  In my country, getting paid 15k dollars would mean more than a years worth of sallary of a big infosec company. So it makes complete sense to go in for bug bounties, even if it's "low" payout, or if you spend a lot of time to get one. Like you said, that's our market, but when working on a global scale, you have to consider pretty much everyone.
TrevorJ 11y ago
I think it's designed to be enough to convince would-be hackers to reveal the bug, but not enough to incentivise large amounts of people to sit around all day every day trying to break Facebook for bounties.
awqrre 11y ago
A bidding war between the bad and good guys would be interesting...

Frankly I think the amount being award by these companies is minuscule when you compare it to the amount of damage this information could have caused Facebook in the wrong hands.

ghayes 11y ago

I suspect most whitehat researchers would be happier to report this vulnerability and make a nice legal reward, then delve into a black hat market for selling a vulnerability. Seems pretty win-win in this case.

at-fates-hands 11y ago
Unless your name is Kevin Mitnick. Then you set up a business and play middlemen in selling them to anybody who wants to pony up for it. "When we have a client that wants a zero-day vulnerability for whatever reason, we don’t ask, and in fact they wouldn’t tell us,” Mitnick tells WIRED in an interview. “Researchers find them, they sell them to us for X, we sell them to clients for Y and make the margin in between.” http://www.wired.com/2014/09/kevin-mitnick-selling-zero-day-exploits/ http://www.wired.com/2014/09/kevin-mitnick-selling-zero-day-...
- eklavya 11y ago
  How is this legal?
  - SturgeonsLaw 11y ago
    Because he's selling to governments, who operate under the "it's not illegal when we do it" principle.
    - yuncun 11y ago
      What if it's the Chinese government that's buying, would it suddenly turn illegal?
  - lawnchair_larry 11y ago
    Why wouldn't it be? Someone looks at a program that they bought and paid for, and sees that it has a mistake. They didn't write the software or put the mistake there. How can it be a crime for them to become aware of behavior in someone else's program? Attacking others who use the software is an entirely different story of course.
restalis 11y ago
By reporting the problem to the owner you should assume that it might get fixed before you'll manage to sell it to other interested parties.

arcticfox 11y ago

I agree. This was basically unrestricted access to any Facebook account. What a MASSIVE flaw. And who knows if this was already exploited in the wild? $15k is nothing at all compared to the scale of this issue...

wallflower 11y ago
$15k and a likely open FB job offer
- quadrature 11y ago
  for a bruteforce ?
- Niksko 11y ago
  > job offer Really? For brute forcing an un-rate-limited endpoint? I doubt it.
  - baddox 11y ago
    I'm sure they might encourage him to interview, but he's not going to get a serious job offer just from this. There's essentially nothing technical or skillful going on here, other than the basic coding ability to do HTTP requests in a loop and the hunch to investigate if subdomains don't rate limit.
    - titanomachy 11y ago
      He was resourceful enough to find a security flaw of the highest severity in the only product of a $300 billion dollar company. A hole that was somehow missed by said company's own security auditors, who collectively are probably paid many millions of dollars per year entirely to look for such holes. So that's something. But you're right, he might have just got lucky. The one fish in a school of 100,000 who finds the hole in the net probably isn't smarter than all the other fish. But that just strengthens the argument that companies should reward very generously for these exploits, because increasing the number of white-hats looking for them is a good way to ensure that they get found by one.

mabbo 11y ago

During the fiasco that was the last white-hat hacker to report he'd hacked Facebook, I posted this: > Bug bounties are supposed to represent a high probability payoff of a lesser amount of money for finding a bug. This is in comparison to going the black hat sales root, where probability of sale might be lower, but the payoff might be higher. I can imagine one or two state actors who might pay top dollar to have keys to the kingdom to a major social network. (https://news.ycombinator.com/item?id=10756159 https://news.ycombinator.com/item?id=10756159) Expected payout = (Probability of reward * size of reward) +/- any additional value I put into who I'm selling it to. If I have an exploit that gives me a lot of access to Facebook (or any other large company) I have to run that formula for each entity that might pay me for it- Facebook, the NSA, the Chinese Military, and so on down the list. Facebook is offering high probability for a lower payout. The NSA might step up their game and start offering ten times as much, or make it more clear that they will indeed pay you for it (not that I have any proof they'd do such a thing). Make no mistake, Facebook has probably done this math very carefully when choosing a bounty.

baddox 11y ago
From this article I get the impression that the bounty wasn't even known before hand. It doesn't seem like a very careful consideration from Facebook, and I would expect it to be "too low" if they're choosing the amount after someone has already disclosed the bug.
ktRolster 11y ago
In other words, if you wanted to game the odds, you'd start by offering it on the black market, then if there were no takers after X number of days, offer it to Facebook?
- tptacek 11y ago
  It is unlikely that there is any black market for this bug, or for the RCE that compromised Facebook's crypto secrets. https://news.ycombinator.com/item?id=11249173 https://news.ycombinator.com/item?id=11249173

dsacco 11y ago

This has been discussed many, many times on HN before. This bug would not cause Facebook much damage; in fact, Facebook and Google tend to overpay rewards for bugs for the purposes of goodwill and recruiting. Let's examine the facts: 1. A Facebook vulnerability is dangerous to Facebook. A WordPress vulnerability is dangerous to a quarter of the internet. Facebook is not a high value target, relatively speaking. 2. A Facebook vulnerability will be patched once it is widely used. Facebook's security team is one of the strongest and most sophisticated of any company, and their processes would quickly catch this once it was used. The total impact of the bug would be negligible. You'd lose the ability to compromise accounts as soon as you tried to do it in any meaningful or lucrative way. 3. A vulnerability in Facebook might last a week before being patched, but a vulnerability in PHP will persist on the internet for years. No matter how many individual sites patch their servers, you'll still be able to pop a lonely server with social security numbers chugging along in a closet somewhere. There really isn't much more to say about this. People claim bounties awarded by Facebook/Google/et al are undervalued every single time a bug bounty hits the front page of HN. Every single time, someone who is in the security industry patiently explains why it's not that valuable. If someone tried to go to a blackhat group or go to the "black-market" (a shadowy, lucrative place that never seems to be very well-defined in these conversations), he would not even be able to find a seller, let alone one who would pay a lot. What do you imagine someone would pay for this on the black-market? They'd need to profit from it. How much profit is worth their time? Say they buy it for $20,000. Do you really think someone will derive $20,000 of profit from this before it's caught and patched by Facebook? The only vulnerability worth $15,000 or more is one directly impacting a language, a widely used development library/framework or a widely used piece of software. For further reading on bug bounty valuation: https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=7106953 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9302188 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9040855 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=8563884 https://news.ycombinator.com/item?id=8563884

comboy 11y ago
The point is, it's possible that if he was a black hat, he could have gotten much more for it on the black market. Even if it could only be used once or a few times. Bounties should not only be higher than what you can get on the black market. They should be high enough to make security experts spend their time trying to win them. Given probability of finding a bug with such impact, it is just not worth the time of any decent white hat (in terms of financial gain, sure it's nice to brag about it and that I believe is the biggest motivation). Money wise, for Facebook, it makes zero difference if they pay him that much or 5 times more.

baby 11y ago

this doesn't make any sense, most vulnerability you find on products are "game over" vulnerabilities. It's common. If you would give a billion dollars to every such findings in an audit then you would be pretty quickly calling bankruptcy. Also, I can personally live for a year on that kind of money. But that's another issue. On the other hand, that is maybe what they would have payed for a real audit of a few days/weeks and it's not even sure the vulnerability would have been found (especially considering the size of Facebook). So yeah maybe they also deserve more. I'm mixed.

tptacek 11y ago
David is right about this, too. A $50,000 pentest of any major web property is likely to find multiple sev:hi vulnerabilities. By the logic the grandparent comment uses, those audits should cost more like $1.5MM.

pbreit 11y ago

I assume it made its way into the wrong hands (not by the OP) and the amount of damage appears to be zero.

TACIXAT 11y ago

I do security audits and agree completely. My biggest issue is that the researcher is working for free. If nothing is found you just burnt a few weeks, if something is found the payout is usually only a couple grand. If people enjoy doing it, or it makes sense in their currency or situation, awesome. The payouts don't get me excited though. That's the market though. People who think it's too cheap don't play the game, people who think it's good money do.

dr_zoidberg 11y ago
In my country, getting paid 15k dollars would mean more than a years worth of sallary of a big infosec company. So it makes complete sense to go in for bug bounties, even if it's "low" payout, or if you spend a lot of time to get one. Like you said, that's our market, but when working on a global scale, you have to consider pretty much everyone.

TrevorJ 11y ago

I think it's designed to be enough to convince would-be hackers to reveal the bug, but not enough to incentivise large amounts of people to sit around all day every day trying to break Facebook for bounties.

awqrre 11y ago

A bidding war between the bad and good guys would be interesting...