4 ms·
>Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target. That statement is just plain wrong. With
by bcook 11y ago
>Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target.
That statement is just plain wrong. With over a billion Facebook users, surely some of them are high-value targets.
- JetSpiegel 11y agoBut what can you really do with the Facebook login of, say Obama? Not provoking WW3, that's for sure. The only thing you can realistically create is a PR kerfuffle for Facebook, but considering the way to spread it would be (wait for it) on Facebook itself, there's not much money is this.
- bcook 11y agoI think you are vastly underestimating the power of social engineering.
- georgeglue1 11y agoYou simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. If done intelligently, this is incredibly difficult to trace. There is risk (rather than a straight-up sale), but the expected returns are probably an order of magnitude higher.
- argonaut 11y agoGiven that the risk is you go to jail, I'm not so sure.
- bcook 11y agoI thought most blackhat activities already implied the threat of jail-time...
- nemothekid 11y ago>You simply log into the Bloomberg/AP/NYTimes account, post some fake economic or political news, and then call in some options you purchased the week before. It would likely be far cheaper and easier to execute something like this via social engineering than using an actual exploit. I'm reminded of the time Twitter user @m had his handle stolen because Apple gave up some personal info. Given that there are likely 100s if not 1000s of FB users who may have access to Bloomberg/AP/NYTimes official page, figuring out in an automated fashion of who can be easily socially engineered isn't likely worth 15k.
- tptacek 11y agoHe's not wrong, you're just misunderstanding him. He's not saying there aren't "valuable" or "interesting" Facebook accounts. He's saying that there aren't enough Facebook accounts with immediate drop-in value to an existing and lucrative criminal enterprise to create a competitive market for Facebook bugs.
- bcook 11y agoI would agree, being that I cannot immediately detail how these Facebook accounts might be useful, but any information is useful, especially credentials. (Valuable != "immediate drop-in value")? So, he's saying the accounts aren't valuable, but they have value? The subtlety is lost on me...
- tptacek 11y agoLots of things have utility but no liquidity.
- bcook 11y agoThe info is useful, but not sellable? The two seem deeply intertwined. If I can prove usefulness, I can sell it. Actually, you say the info has "a use"... does that not directly imply worth?
- tptacek 11y agoThat's an especially ironic argument to try to make on this particular site.
- bcook 11y agoIs that a retort or simply an unrelated observation? Edit: My intent was to understand your perspective (and argue...), but this comment goes over my head, and it seems as though it was a thinly veiled insult.