3 ms·
Doesn't Facebook's policy prohibit privilege escalation? The write the following: You do not exploit a security issue you discover for any reason. (This includ
by thezilch 10y ago
Doesn't Facebook's policy prohibit privilege escalation? The write the following:
You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.) [0]
It's no wonder other bounty researchers didn't find further vectors for exploiting their privileges. There was a researcher not too long ago hit by the book for this.
[0] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
- tptacek 10y agoThat's an oversimplification. What actually happened was: a researcher found a serverside bug in a random backend box, got RCE, logged in, scraped and banked all the creds off the box, reported the bug, and then a month later during a dispute used the creds he stored to attack other Fb properties. Dumping directories from machines and banking their creds isn't "escalating privileges". If you did that on a pro red team project, saving the creds to use a month or two later, you'd get fired.
- thezilch 10y agoThe case (or however one wants to construe what or how things really happened) isn't too interesting to me. Do you read FB's whitehat rules of engagement differently? I dug up the mentioned case, and FB's first contact with the researcher included, "Please be mindful that taking additional action after locating a bug violates our bounty policy." Between FB's whitehat policies and that, I'd be pretty sure not to escalate privileges.
- tptacek 10y agoMe too.