7 ms·

What are you talking about? Facebook is not a "high value target" and "this bug would not cause Facebook much damage"? For example, if you wanted to monetize i

What are you talking about? Facebook is not a "high value target" and "this bug would not cause Facebook much damage"? For example, if you wanted to monetize it, I have to imagine TMZ (or someone even less scrupulous) would pay a lot of money for dumps of A-list celeb and athlete Facebook accounts. You don't think Facebook having "The Fappening Part 2" on their hands is worth more than $15k to prevent? Or having every US Government FB account simultaneously posting ISIS propaganda? The PR for any number of scenarios like those would be an absolute nightmare for Facebook.

dsacco 11y ago
Your comment does not reflect how vulnerability sales work in the real world. In the real world, vulnerabilities are sold to blackhat groups who want to make a profit by attacking as many websites as possible. Generally, these websites will have valuable credit card or other information that can be stolen from a compromised server. Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target. The idea that TMZ would pay a significant amount of money for this is a Hollywood plot, nothing more. Vulnerabilities are not valued highly just because you can come up with a contrived scenario in which it would be valuable to someone for some reason. This is a market, and like any other market there are buyers and sellers who dictate supply and demand.
- bcook 11y ago
  >Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target. That statement is just plain wrong. With over a billion Facebook users, surely some of them are high-value targets.
  - JetSpiegel 11y ago
    But what can you really do with the Facebook login of, say Obama? Not provoking WW3, that's for sure. The only thing you can realistically create is a PR kerfuffle for Facebook, but considering the way to spread it would be (wait for it) on Facebook itself, there's not much money is this.
    - bcook 11y ago
      I think you are vastly underestimating the power of social engineering.
    - georgeglue1 11y ago
      You simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. If done intelligently, this is incredibly difficult to trace. There is risk (rather than a straight-up sale), but the expected returns are probably an order of magnitude higher.
      - argonaut 11y ago
        Given that the risk is you go to jail, I'm not so sure.
        bcook 11y ago
        I thought most blackhat activities already implied the threat of jail-time...
      - nemothekid 11y ago
        >You simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. It would likely be far cheaper and easier to execute something like this via social engineering than using an actual exploit. I'm reminded of the time Twitter user @m had his handle stolen because Apple gave up some personal info. Given that there are likely 100s if not 1000s of FB users who may have access to Bloomberg/AP/NYTimes official page, figuring out in an automated fashion of who can be easily socially engineered isn't likely worth 15k.
  - tptacek 11y ago
    He's not wrong, you're just misunderstanding him. He's not saying there aren't "valuable" or "interesting" Facebook accounts. He's saying that there aren't enough Facebook accounts with immediate drop-in value to an existing and lucrative criminal enterprise to create a competitive market for Facebook bugs.
    - bcook 11y ago
      I would agree, being that I cannot immediately detail how these Facebook accounts might be useful, but any information is useful, especially credentials. (Valuable != "immediate drop-in value")? So, he's saying the accounts aren't valuable, but they have value? The subtlety is lost on me...
      - tptacek 11y ago
        Lots of things have utility but no liquidity.
        bcook 11y ago
        The info is useful, but not sellable? The two seem deeply intertwined. If I can prove usefulness, I can sell it. Actually, you say the info has "a use"... does that not directly imply worth?
        tptacek 11y ago
        That's an especially ironic argument to try to make on this particular site.
        bcook 11y ago
        Is that a retort or simply an unrelated observation? Edit: My intent was to understand your perspective (and argue...), but this comment goes over my head, and it seems as though it was a thinly veiled insult.
- jsprogrammer 11y ago
  Your claim was about the severity of the bug. It all really depends on how fast FB can service the requests and how long it takes for them to notice and shut it down. Push your priority list off to a worldwide farm and watch the accounts pop out. How long until FB would have it shut down and the affected accounts locked out?
  - tptacek 11y ago
    The problem is that there's no half life. The bug dies instantaneously once discovered. It's not like 3/4 of the Internet runs "old Facebook" because they forgot to update it.
    - jsprogrammer 11y ago
      Sure, but in the time before the accounts are locked out all of their data may have been exfiltrated and mirrored around the world. It won't matter if everyone can get the latest version of Facebook if no one is willing to use it anymore.
- arcticfox 11y ago
  > Hollywood plot, nothing more. The first example that comes to mind, "an organised trade in confidential personal information" https://en.wikipedia.org/wiki/News_International_phone_hacking_scandal https://en.wikipedia.org/wiki/News_International_phone_hacki... Just because this isn't the typical mass vulnerability SQL injection or XSS attack on a major framework doesn't mean it's basically worthless ($15k or less). The amount of damage that could be done to Facebook's reputation is enormous, not to mention the value of the information that could be stolen.
  - tptacek 11y ago
    The black market does not put a high price on damaging Facebook's reputation.
- jonesb6 11y ago
  You know what people put into Facebook chats? Obligatory quote from Kanye's newest album 'The Life of Pablo': " I had a cousin that stole my laptop that I was fuckin' bitches on Paid that nigga 250 thousand just to get it from him "
  - tptacek 11y ago
    You know what people put into Instant Bloomberg chats? Go try to sell an IBB bug.
    - deleted 11y ago
      [deleted]
- blablablame 11y ago
  Step one: short a million on Apple shares Step two: hack into Tim Cook's account (no idea if he uses FB) Step three: publish rant about Apple rotten ideoligies/he quits Step four: see APPL lose value for a day until this shit is sorted Step five: profit Or something like that
  - edanm 11y ago
    Step 6 - go to jail. Step 7 - get out of jail and decide doing far less risky illegal stuff has a better expected payout.
tptacek 11y ago
He's right, and you are indeed recapitulating a discussion that has happened a zillion times on HN before. At some point (maybe I haven't read far enough down on the thread), The Grugq will chime in and confirm it, just in case you were doubting it. This isn't specific to Facebook; it's a common misapprehension of how bugs are valued for all SaaS companies. People don't pay top dollar for speculative bugs. I'm sure there's some horrible market somewhere for stolen celebrity photos, but it generates a pittance compared to the people who harvest and exploit popped desktop computers. It's not enough to imagine some way you could profit from the bug, for the same reason that you can't make 100 million dollars simply by coming up with the idea for an interesting startup. A viable exploit is just one part of the technical and business work that goes into profiting from a vulnerability. All the work, together, has to add up to less than the value of the exploit. Moreover: pretty much nobody is planning out elaborate criminal enterprises based on Facebook bugs, because every one of those bugs takes a different form, has a different likelihood of discovery, and has a different payoff.
- arcticfox 11y ago
  The bizarre part here is that Facebook is competing against a market that the security researcher is not allowed to participate in by law. Facebook sets the price, not the market. That's why the speculative value of a bug should be relevant, not the practical value. If this guy were allowed to openly market his bug to all parties, it would be guaranteed to be worth much more than $15k. The price to Facebook is totally arbitrary. They could pay this guy $10 and it would still be fair under your position, because it's better than the alternative of committing a felony by finding someone to outbid Facebook.
  - tptacek 11y ago
    That's almost true. If Fb bid only $10, you could see bidding simply for the right to (a) announce the bug or (b) post a hash and lord it over Fb. There's a vanity value for some of these bugs that probably goes into the hundreds of dollars. But the rest of your point? Yep. Sounds about right. Though I don't think it's quite fair to say that "Fb sets the price, not the market", since Fb is the market for these bugs.

dsacco 11y ago

Your comment does not reflect how vulnerability sales work in the real world. In the real world, vulnerabilities are sold to blackhat groups who want to make a profit by attacking as many websites as possible. Generally, these websites will have valuable credit card or other information that can be stolen from a compromised server. Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target. The idea that TMZ would pay a significant amount of money for this is a Hollywood plot, nothing more. Vulnerabilities are not valued highly just because you can come up with a contrived scenario in which it would be valuable to someone for some reason. This is a market, and like any other market there are buyers and sellers who dictate supply and demand.

bcook 11y ago
>Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target. That statement is just plain wrong. With over a billion Facebook users, surely some of them are high-value targets.
- JetSpiegel 11y ago
  But what can you really do with the Facebook login of, say Obama? Not provoking WW3, that's for sure. The only thing you can realistically create is a PR kerfuffle for Facebook, but considering the way to spread it would be (wait for it) on Facebook itself, there's not much money is this.
  - bcook 11y ago
    I think you are vastly underestimating the power of social engineering.
  - georgeglue1 11y ago
    You simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. If done intelligently, this is incredibly difficult to trace. There is risk (rather than a straight-up sale), but the expected returns are probably an order of magnitude higher.
    - argonaut 11y ago
      Given that the risk is you go to jail, I'm not so sure.
      - bcook 11y ago
        I thought most blackhat activities already implied the threat of jail-time...
    - nemothekid 11y ago
      >You simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. It would likely be far cheaper and easier to execute something like this via social engineering than using an actual exploit. I'm reminded of the time Twitter user @m had his handle stolen because Apple gave up some personal info. Given that there are likely 100s if not 1000s of FB users who may have access to Bloomberg/AP/NYTimes official page, figuring out in an automated fashion of who can be easily socially engineered isn't likely worth 15k.
- tptacek 11y ago
  He's not wrong, you're just misunderstanding him. He's not saying there aren't "valuable" or "interesting" Facebook accounts. He's saying that there aren't enough Facebook accounts with immediate drop-in value to an existing and lucrative criminal enterprise to create a competitive market for Facebook bugs.
  - bcook 11y ago
    I would agree, being that I cannot immediately detail how these Facebook accounts might be useful, but any information is useful, especially credentials. (Valuable != "immediate drop-in value")? So, he's saying the accounts aren't valuable, but they have value? The subtlety is lost on me...
    - tptacek 11y ago
      Lots of things have utility but no liquidity.
      - bcook 11y ago
        The info is useful, but not sellable? The two seem deeply intertwined. If I can prove usefulness, I can sell it. Actually, you say the info has "a use"... does that not directly imply worth?
        tptacek 11y ago
        That's an especially ironic argument to try to make on this particular site.
        bcook 11y ago
        Is that a retort or simply an unrelated observation? Edit: My intent was to understand your perspective (and argue...), but this comment goes over my head, and it seems as though it was a thinly veiled insult.
jsprogrammer 11y ago
Your claim was about the severity of the bug. It all really depends on how fast FB can service the requests and how long it takes for them to notice and shut it down. Push your priority list off to a worldwide farm and watch the accounts pop out. How long until FB would have it shut down and the affected accounts locked out?
- tptacek 11y ago
  The problem is that there's no half life. The bug dies instantaneously once discovered. It's not like 3/4 of the Internet runs "old Facebook" because they forgot to update it.
  - jsprogrammer 11y ago
    Sure, but in the time before the accounts are locked out all of their data may have been exfiltrated and mirrored around the world. It won't matter if everyone can get the latest version of Facebook if no one is willing to use it anymore.
arcticfox 11y ago
> Hollywood plot, nothing more. The first example that comes to mind, "an organised trade in confidential personal information" https://en.wikipedia.org/wiki/News_International_phone_hacking_scandal https://en.wikipedia.org/wiki/News_International_phone_hacki... Just because this isn't the typical mass vulnerability SQL injection or XSS attack on a major framework doesn't mean it's basically worthless ($15k or less). The amount of damage that could be done to Facebook's reputation is enormous, not to mention the value of the information that could be stolen.
- tptacek 11y ago
  The black market does not put a high price on damaging Facebook's reputation.
jonesb6 11y ago
You know what people put into Facebook chats? Obligatory quote from Kanye's newest album 'The Life of Pablo': " I had a cousin that stole my laptop that I was fuckin' bitches on Paid that nigga 250 thousand just to get it from him "
- tptacek 11y ago
  You know what people put into Instant Bloomberg chats? Go try to sell an IBB bug.
  - deleted 11y ago
    [deleted]
blablablame 11y ago
Step one: short a million on Apple shares Step two: hack into Tim Cook's account (no idea if he uses FB) Step three: publish rant about Apple rotten ideoligies/he quits Step four: see APPL lose value for a day until this shit is sorted Step five: profit Or something like that
- edanm 11y ago
  Step 6 - go to jail. Step 7 - get out of jail and decide doing far less risky illegal stuff has a better expected payout.

tptacek 11y ago

He's right, and you are indeed recapitulating a discussion that has happened a zillion times on HN before. At some point (maybe I haven't read far enough down on the thread), The Grugq will chime in and confirm it, just in case you were doubting it. This isn't specific to Facebook; it's a common misapprehension of how bugs are valued for all SaaS companies. People don't pay top dollar for speculative bugs. I'm sure there's some horrible market somewhere for stolen celebrity photos, but it generates a pittance compared to the people who harvest and exploit popped desktop computers. It's not enough to imagine some way you could profit from the bug, for the same reason that you can't make 100 million dollars simply by coming up with the idea for an interesting startup. A viable exploit is just one part of the technical and business work that goes into profiting from a vulnerability. All the work, together, has to add up to less than the value of the exploit. Moreover: pretty much nobody is planning out elaborate criminal enterprises based on Facebook bugs, because every one of those bugs takes a different form, has a different likelihood of discovery, and has a different payoff.

arcticfox 11y ago
The bizarre part here is that Facebook is competing against a market that the security researcher is not allowed to participate in by law. Facebook sets the price, not the market. That's why the speculative value of a bug should be relevant, not the practical value. If this guy were allowed to openly market his bug to all parties, it would be guaranteed to be worth much more than $15k. The price to Facebook is totally arbitrary. They could pay this guy $10 and it would still be fair under your position, because it's better than the alternative of committing a felony by finding someone to outbid Facebook.
- tptacek 11y ago
  That's almost true. If Fb bid only $10, you could see bidding simply for the right to (a) announce the bug or (b) post a hash and lord it over Fb. There's a vanity value for some of these bugs that probably goes into the hundreds of dollars. But the rest of your point? Yep. Sounds about right. Though I don't think it's quite fair to say that "Fb sets the price, not the market", since Fb is the market for these bugs.