4 ms·

You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and a

by Dr_tldr 11y ago

You can read the story from a few months back to find that Facebook apparently has an unstated but non-repudiated policy of threatening to involve the FBI and actually doing reputational damage to researchers who they feel cross a (poorly described and enforced) line: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194 In this case, they (correctly) went the other way, which creates even more uncertainty. Given this pattern of inconsistent enforcement mixed with threats, I would feel genuinely unsafe reporting a security vulnerability to Facebook except under very specific conditions. That's probably not what they're going for, but that's the environment they're creating.

boredpudding 11y ago
It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.
- baby 11y ago
  Agree with this, getting in is enough, going further is malicious at best.
  - lern_too_spel 11y ago
    Under those rules, it's not possible to verify reginaldo's claim that this machine is cut off from more valuable data.
    - baby 10y ago
      You don't need to verify these claims. You found a critical vulnerability, you are not the only one.
  - frostymarvelous 10y ago
    How then do we assess the extent of the vulnerability? As Wes proved, a simple looking RCE can lead to a huge breach of security due to failures in other areas. I agree that limits must be established, but also, these must not end research so abruptly as they can lead to further information. One might argue this is unethical, but a black hat doesn't care either way.
    - baby 10y ago
      > How then do we assess the extent of the vulnerability? It's already a critical vulnerability. Unless you want to assign numbers to the infinity, which is ridiculous.
      - frostymarvelous 10y ago
        Yet we know not all critical vulnerabilities are created equal. That's why some get a 10k payout and others get a 2.5k.
        mamon 10y ago
        This is assessed based on how hard it was to elevate your access rights (whether it requires physical access, user cooperation, etc.), not on how much damage you can do - because once you elevated your rights the possible damage is unlimited.
        frostymarvelous 10y ago
        Except in that case, he unearthed another completely unrelated vuln. I agree that some actions are u ethical, but does that really matter so much when a black hat is unethical anyways? The fact that he reported meant he was harbored no malicious intent. How is collecting logins better than that? Seriously? This is completely malicious if you ask me. Moreover, we must not judge each case strictly to the same rule, but with a measure of consideration of the circumstances as well.
- Dr_tldr 10y ago
  But in this case, they specifically said that the researchers were unable to escalate. How does he know? Either the researchers violated the rules by trying and failing, or they didn't try and he's simply lying to make himself look better. By your reasoning and their policy, those are the only two possibilities. What are we supposed to conclude from this? Under the current rules and assuming the description of what happened is accurate, it would seem you'll potentially be punished for establishing the full extent of a breach, unless it's not so bad, in which case you're rewarded for failing. In addition to being illogical and unfair, it also incentivizes OpSec to delude themselves and everyone else about their true security risks.
  - frostymarvelous 10y ago
    Accurate. In the other case, they threatened because he proved the vuln was much much greater, infact I call it a billion dollar bug,and wanted to cover it up. This time they're proudly telling us because the attempts failed or were not made at all.

by Dr_tldr 11y ago

boredpudding 11y ago

It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.

baby 11y ago
Agree with this, getting in is enough, going further is malicious at best.
- lern_too_spel 11y ago
  Under those rules, it's not possible to verify reginaldo's claim that this machine is cut off from more valuable data.
  - baby 10y ago
    You don't need to verify these claims. You found a critical vulnerability, you are not the only one.
- frostymarvelous 10y ago
  How then do we assess the extent of the vulnerability? As Wes proved, a simple looking RCE can lead to a huge breach of security due to failures in other areas. I agree that limits must be established, but also, these must not end research so abruptly as they can lead to further information. One might argue this is unethical, but a black hat doesn't care either way.
  - baby 10y ago
    > How then do we assess the extent of the vulnerability? It's already a critical vulnerability. Unless you want to assign numbers to the infinity, which is ridiculous.
    - frostymarvelous 10y ago
      Yet we know not all critical vulnerabilities are created equal. That's why some get a 10k payout and others get a 2.5k.
      - mamon 10y ago
        This is assessed based on how hard it was to elevate your access rights (whether it requires physical access, user cooperation, etc.), not on how much damage you can do - because once you elevated your rights the possible damage is unlimited.
        frostymarvelous 10y ago
        Except in that case, he unearthed another completely unrelated vuln. I agree that some actions are u ethical, but does that really matter so much when a black hat is unethical anyways? The fact that he reported meant he was harbored no malicious intent. How is collecting logins better than that? Seriously? This is completely malicious if you ask me. Moreover, we must not judge each case strictly to the same rule, but with a measure of consideration of the circumstances as well.
Dr_tldr 10y ago
But in this case, they specifically said that the researchers were unable to escalate. How does he know? Either the researchers violated the rules by trying and failing, or they didn't try and he's simply lying to make himself look better. By your reasoning and their policy, those are the only two possibilities. What are we supposed to conclude from this? Under the current rules and assuming the description of what happened is accurate, it would seem you'll potentially be punished for establishing the full extent of a breach, unless it's not so bad, in which case you're rewarded for failing. In addition to being illogical and unfair, it also incentivizes OpSec to delude themselves and everyone else about their true security risks.
- frostymarvelous 10y ago
  Accurate. In the other case, they threatened because he proved the vuln was much much greater, infact I call it a billion dollar bug,and wanted to cover it up. This time they're proudly telling us because the attempts failed or were not made at all.