5 ms·

I agree. This was basically unrestricted access to any Facebook account. What a MASSIVE flaw. And who knows if this was already exploited in the wild? $15k is

I agree. This was basically unrestricted access to any Facebook account. What a MASSIVE flaw. And who knows if this was already exploited in the wild? $15k is nothing at all compared to the scale of this issue...

wallflower 11y ago
$15k and a likely open FB job offer
- quadrature 11y ago
  for a bruteforce ?
- Niksko 11y ago
  > job offer Really? For brute forcing an un-rate-limited endpoint? I doubt it.
  - baddox 11y ago
    I'm sure they might encourage him to interview, but he's not going to get a serious job offer just from this. There's essentially nothing technical or skillful going on here, other than the basic coding ability to do HTTP requests in a loop and the hunch to investigate if subdomains don't rate limit.
    - titanomachy 11y ago
      He was resourceful enough to find a security flaw of the highest severity in the only product of a $300 billion dollar company. A hole that was somehow missed by said company's own security auditors, who collectively are probably paid many millions of dollars per year entirely to look for such holes. So that's something. But you're right, he might have just got lucky. The one fish in a school of 100,000 who finds the hole in the net probably isn't smarter than all the other fish. But that just strengthens the argument that companies should reward very generously for these exploits, because increasing the number of white-hats looking for them is a good way to ensure that they get found by one.
      - mjs 11y ago
        He's found quite a few different bugs: https://hackerone.com/anand786 https://hackerone.com/anand786 https://www.facebook.com/whitehat/thanks https://www.facebook.com/whitehat/thanks (listed 2015, 2014, 2013)
        rwmurrayVT 11y ago
        Over 20k in bounties in the last year listed, this 15k bounty, and multiple unlisted amounts from Yahoo. I don't think he cares about a job offer from FB too much.
  - jsprogrammer 11y ago
    Clearly this is the kind of role Facebook needs to fill ASAP.
- aurora72 11y ago
  Using a tool 'Burb' spendin time searching "what might be vulnerable" can be worth atmost 15 grands, not a $100.000+ job.
mayneack 11y ago
It's not really unrestricted. Given that this is forcing the password reset, you can't silently do it, right? So anyone exploiting it knows there's a limited number of uses before people notice that their passwords are being reset by not them.
- arcticfox 11y ago
  True, the restriction is that you only get a guarantee of getting in one time. I meant that there are no restrictions on what you can do once you're in. (E.g. a XSS chat hack or something like that would be restricted in that sense)
lavezzi 11y ago
Doesn't Facebook alert the user if it detects suspicious account login activity from an unknown location or IP?
- spyder 11y ago
  The SMS and the e-mail about the password change is already a big alert for the user.

wallflower 11y ago

$15k and a likely open FB job offer

quadrature 11y ago
for a bruteforce ?
Niksko 11y ago
> job offer Really? For brute forcing an un-rate-limited endpoint? I doubt it.
- baddox 11y ago
  I'm sure they might encourage him to interview, but he's not going to get a serious job offer just from this. There's essentially nothing technical or skillful going on here, other than the basic coding ability to do HTTP requests in a loop and the hunch to investigate if subdomains don't rate limit.
  - titanomachy 11y ago
    He was resourceful enough to find a security flaw of the highest severity in the only product of a $300 billion dollar company. A hole that was somehow missed by said company's own security auditors, who collectively are probably paid many millions of dollars per year entirely to look for such holes. So that's something. But you're right, he might have just got lucky. The one fish in a school of 100,000 who finds the hole in the net probably isn't smarter than all the other fish. But that just strengthens the argument that companies should reward very generously for these exploits, because increasing the number of white-hats looking for them is a good way to ensure that they get found by one.
    - mjs 11y ago
      He's found quite a few different bugs: https://hackerone.com/anand786 https://hackerone.com/anand786 https://www.facebook.com/whitehat/thanks https://www.facebook.com/whitehat/thanks (listed 2015, 2014, 2013)
      - rwmurrayVT 11y ago
        Over 20k in bounties in the last year listed, this 15k bounty, and multiple unlisted amounts from Yahoo. I don't think he cares about a job offer from FB too much.
- jsprogrammer 11y ago
  Clearly this is the kind of role Facebook needs to fill ASAP.
aurora72 11y ago
Using a tool 'Burb' spendin time searching "what might be vulnerable" can be worth atmost 15 grands, not a $100.000+ job.

mayneack 11y ago

It's not really unrestricted. Given that this is forcing the password reset, you can't silently do it, right? So anyone exploiting it knows there's a limited number of uses before people notice that their passwords are being reset by not them.

arcticfox 11y ago
True, the restriction is that you only get a guarantee of getting in one time. I meant that there are no restrictions on what you can do once you're in. (E.g. a XSS chat hack or something like that would be restricted in that sense)

lavezzi 11y ago

Doesn't Facebook alert the user if it detects suspicious account login activity from an unknown location or IP?

spyder 11y ago
The SMS and the e-mail about the password change is already a big alert for the user.