4 ms·

> two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access. Ar

> two competent researchers assessed the system, one of them reported what he found to us and got a good bounty, none of them were able to escalate access. Are they allowed to escalate access, given the bounty rules? Also, isn't the periodic collection of login credentials completely out of scope? What I mean is: once the initial vulnerability was located and the pentester got shell access in the system, shouldn't he have stopped there and reported?

apeace 11y ago
> Are they allowed to escalate access, given the bounty rules? No. From Facebook's responsible disclosure policy [1]: > You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.) Both of the pen testers in this situation broke the rules. Once they found a security issue they exploited it and probed for additional issues (as well as one tester who attempted compromise of sensitive company data by collecting logins). It's good that Facebook doesn't always apply these guidelines to the letter. [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
Dr_tldr 11y ago
You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194 In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.
- boredpudding 11y ago
  It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.
  - baby 11y ago
    Agree with this, getting in is enough, going further is malicious at best.
    - lern_too_spel 11y ago
      Under those rules, it's not possible to verify reginaldo's claim that this machine is cut off from more valuable data.
      - baby 11y ago
        You don't need to verify these claims. You found a critical vulnerability, you are not the only one.
    - frostymarvelous 11y ago
      How then do we assess the extent of the vulnerability? As Wes proved, a simple looking RCE can lead to a huge breach of security due to failures in other areas. I agree that limits must be established, but also, these must not end research so abruptly as they can lead to further information. One might argue this is unethical, but a black hat doesn't care either way.
      - baby 11y ago
        > How then do we assess the extent of the vulnerability? It's already a critical vulnerability. Unless you want to assign numbers to the infinity, which is ridiculous.
        frostymarvelous 11y ago
        Yet we know not all critical vulnerabilities are created equal. That's why some get a 10k payout and others get a 2.5k.

apeace 11y ago

> Are they allowed to escalate access, given the bounty rules? No. From Facebook's responsible disclosure policy [1]: > You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.) Both of the pen testers in this situation broke the rules. Once they found a security issue they exploited it and probed for additional issues (as well as one tester who attempted compromise of sensitive company data by collecting logins). It's good that Facebook doesn't always apply these guidelines to the letter. [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat

Dr_tldr 11y ago

You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194 In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.

boredpudding 11y ago
It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.
- baby 11y ago
  Agree with this, getting in is enough, going further is malicious at best.
  - lern_too_spel 11y ago
    Under those rules, it's not possible to verify reginaldo's claim that this machine is cut off from more valuable data.
    - baby 11y ago
      You don't need to verify these claims. You found a critical vulnerability, you are not the only one.
  - frostymarvelous 11y ago
    How then do we assess the extent of the vulnerability? As Wes proved, a simple looking RCE can lead to a huge breach of security due to failures in other areas. I agree that limits must be established, but also, these must not end research so abruptly as they can lead to further information. One might argue this is unethical, but a black hat doesn't care either way.
    - baby 11y ago
      > How then do we assess the extent of the vulnerability? It's already a critical vulnerability. Unless you want to assign numbers to the infinity, which is ridiculous.
      - frostymarvelous 11y ago
        Yet we know not all critical vulnerabilities are created equal. That's why some get a 10k payout and others get a 2.5k.