9 ms·
Facebook rewarded a 10-year-old for finding Instagram security flaw
- Zeimyth 10y agoIt makes me happy to see people who find and report bugs rather than hiding and exploiting them. I'm sure the monetary incentive doesn't hurt, either.
- pgrote 10y agoAgreed. Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me. Maybe there are more people who sell the exploits and you just don't hear about it as much as people who submit them to the corporations before publicizing them.
- charlesdm 10y agoHe's 10. Who is he going to sell this to? $10,000 is probably a gigantic amount of money to him.
- wnevets 10y agoits a lot money to most people.
- charlesdm 10y agoOf course, but it might be worth $100-200k if sold to a third party. Edit: looks like I was wrong!
- tptacek 10y agoNo, it would be worth much less than $10,000 to anyone else. There is a specific kind of bug that is worth 6 figures on the black market: clientside remote code execution. Somehow, HN has gotten the impression that the going rate for the hardest bugs in the world to reliably weaponize is actually the going rate for all bugs everywhere.
- mwcampbell 10y agoSo you're saying client-side remote code execution bugs are the hardest to reliably weaponize? Do I understand correctly? I figured those bugs would be the easiest to weaponize.
- tptacek 10y agoWe mean different things, and it's me being imprecise. Substitute "generate" for "weaponize".
- k-mcgrady 10y ago>> "Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me." The same reasons people don't steal from shops or commit other crimes: 1. Morals 2. Risk of getting caught and subsequent punishment
- tptacek 10y ago3. Nobody wants to buy Facebook bugs besides Facebook.
- hueving 10y agoYes, this particular class of bug isn't all that useful. If someone started using the exploit it wouldn't be long before a user complained that their comments were being deleted and then Facebook would figure it out in a hurry.
- jsprogrammer 10y agoPresumably an Instagram rival could find it useful. If Instagram comments are gone/disappearing, then a more secure version could gain user-share from Instagram. Edit: Even CNBC is aware of data hacking[0]. Scary to know that people here don't even consider sabotage as a threat-model... [0] http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hacking--data-sabotage.html http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hackin...
- curiousgal 10y agohaha you can't be serious right? I am sorry but I honestly found that amusing. Like Instagram engineers scratching their heads as to why comments are disappearing while there's an up-rise of users and then someone finally decides to create a secure alternative and is upheld as the savior. Realistically though if this an were to become big enough to promote an alternative then Instagram would be all over it and thus fix it within minutes.
- tptacek 10y ago
- tptacek 10y agoI know, right? $10,000! Facebook is worth billions! Think what the black market might pay for a bug that would delete any Instagram comment!
- jsprogrammer 10y agoA bug that allows unauthorized children to delete content from other user's accounts may point to other vulnerabilities, which could have even more value. IIRC FB/Instagram didn't payout on a report that took their entire AWS keys though...
- tptacek 10y agoThere are no Facebook vulnerabilities that have a value any higher than what Facebook is going to pay for them. If Facebook was sending t-shirts instead of writing 4-5 figure checks, these discussions would be more interesting. But that's not what Facebook does. Put it this way: before Facebook started these bounty programs, what do you think the price sheet for Facebook bugs on the "black market" looked like?
- Buge 10y agoWell the NSA tapped into Google's internal datacenter traffic to steal user information. So some vulnerabilities like that might be useful to them. https://cms-images.idgesg.net/images/article/2014/06/googlessl-100310469-orig.jpg https://cms-images.idgesg.net/images/article/2014/06/googles...
- tptacek 10y agoI'm having trouble connecting your first sentence to your second. It sounds a little like saying "so, the US army has M109 Howitzers, so maybe they'd be interested in this 3D-printed zip gun I just made."
- Buge 10y agoI'm not talking about the vulnerability that this kid found. I'm talking about vulnerabilities that would allow access deep into the Facebook infrastructure. I think there are in fact some vulnerabilities the NSA would be willing to pay more than $10k for if it would allow them long term access to a lot of sensitive Facebook data.
- saalweachter 10y agoWhat's the marketplace like? On the seller side, how easy is it to actually get paid? There's no point in trying to sell exploits if you're just going to get cheated, get busted selling to some sort of undercover law enforcement, or just go to a lot of trouble for not a lot of payoff. From a buyer perspective, you need to have a way to verify an exploit, or else you're just buying a pig in a poke. And you need a way to monetize the exploit, or some other motivation. And you really have no way to know how long your exploit will remain functional. (Or, you know, people could be basically good.)
- jsprogrammer 10y agoIs there really information that you can obtain on your own that you can be criminally prosecuted for sharing? On what basis could law enforcement act undercover to trap sellers?
- 2muchcoffeeman 10y agoGP is not talking about just sharing. This is selling information for monetary gain. The buyer of which is also attempting to profit from it.
- tptacek 10y agoEasy. All the sting operation has to do is make it clear to the seller what the "buyer" "intends" to do with the bug. It doesn't even have to be overt: they could simply say "we are looking to pay $10,000 for a bug that would enable us to download all the private photographs from Justin Bieber's Facebook account".
- deleted 10y ago[deleted]
- noxToken 10y agoIt depends on the information. This only applies to the US, as the laws are probably difference elsewhere. The CFAA[1] is a very vague and broad law that aims to stop people from accessing systems, sending malicious data, etc. It is intentionally written in such a way to be forgiving to the victim since security is hard by default [citation needed]. So even if you found an exploit without using it yourself, you'll probably be charged with aiding and abetting or something similar. [1]: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- tn13 10y agoPeople do. There is an entire underground markets for exploits, hacked user databases/emails, Amazon AWS keys etc.
- phasmantistes 10y agoIf you had this exploit, how would you have monetized it? Do you know who to talk to? Do you know where to go on the darkweb to find the people who know the people who have the money to actually pay you for this? Do you know how to negotiate with them to actually guarantee payment? Do you know how much an exploit which can only delete content -- not generate false content, or access ACL'd content -- is actually worth? Long story short, companies offer guaranteed set-size rewards as a counterpoint to the black market's potential highly variant payouts.
- tptacek 10y agoCompanies like Facebook offer rewards as an incentive to get people to report bugs to them rather than to blog posts. The next highest bidder anywhere in the world for bugs like these is ε.
- rwallace 10y agoDon't underestimate the value of money that's guaranteed instead of a hypothetical possibility, now instead of maybe sometime, yours free and clear instead of legally dodgy, that you can boast to friends and future potential employers about instead of hiding as a shameful secret.
- beardog 10y agoI agree, except I'm pretty sure Facebook and other bug bounty programs don't guarantee payment.
- eric_h 10y agoTrue, but they usually do by the time they say that you will be paid. I think the argument that a black market sale of an exploit won't necessarily be as clear cut is still valid.
- betenoire 10y agoA bird in the hand is better than two in the bush.
- billyhoffman 10y agoDon't underestimate the professional value of disclosing a vulnerability to the company And I don't solely Mean the value of the publicity and the exposure of being public about the disclosure. The security community is surprisingly small. Getting a one off splash story in a rag like Business Insider is nothing compared to building a back and forth with Someone like Alex Stamos.
- eli 10y agoIf I find a wallet on the ground, I try to return it to the owner even if there's no reward and even if I'm not legally obligated to do so. I'd want someone who finds my wallet to do the same.
- rajangdavis 10y agoOff topic, but I once found a Magento SQL database backup from going to a robots.txt page for a company that I will not name. I told them how I was able to get to this file and laid out the other vulnerabilities with their site set up. I had access to all of their customer emails, all of their admin logins, encrypted passwords, and salts. Was able to find git credentials and a whole swathe of information that shouldn't be available... They fixed the issue pretty fast, but what bugs me is that I didn't get a thank you. I wasn't looking to gain anything, but I figure telling someone that their site is exposed warrants some gratitude.
- asimuvPR 10y agoThat's why I: - Stopped reporting anything that is not an issue in the source code of an open source project. I do so in their mailing lists or issue tracker. - Began to treat random internet bug reports with kindness and gratitude.
- ashitlerferad 10y agoThanks for being excellent!
- dogma1138 10y agoI reported an xss in HP's pronq fortify login screen without getting as much as a thank you. Fortify on pronq is their SAAS application security scanner for those who were wondering.
- morganvachon 10y agoThat, and it's great that Facebook offers an incentive to bug hunting, rather than treating the researchers like criminals, as some companies are known to do. I don't care for a lot of what Facebook does and how they do it, but this in particular is awesome of them.
- userbinator 10y agoI don't think it's that simple of a decision, or one that could be generalised to all cases. What if you found an exploit that let you break a widespread form of DRM, access normally paywalled information, or gain control of a device that you rightfully own but the manufacturer locked down against you? It really depends on your moral/philosophical stance, but all the money in the world wouldn't make me report any of those. That's why the idea of someone so young already thinking of becoming a "security researcher" bugs (no pun intended) me, because they all seem to inevitably end up proponents of "security that oppresses" in some form or another. Related: https://en.wikipedia.org/wiki/Hacker_ethic https://en.wikipedia.org/wiki/Hacker_ethic
- ashitlerferad 10y agoA recent manifesto around that: http://pastebin.com/raw/0SNSvyjJ http://pastebin.com/raw/0SNSvyjJ "Leaking documents, expropriating money from banks, and working to secure the computers of ordinary people is ethical hacking. However, most people that call themselves "ethical hackers" just work to secure those who pay their high consulting fees, who are often those most deserving to be hacked."
- deleted 10y ago[deleted]
- topbru 10y agoAny details on how it worked?
- ssclafani 10y ago"The problem lay in a private application programming interface (the slice of code allowing certain outside access) that wasn’t properly checking the person deleting the comment was the same one who posted it, the spokesperson added." http://www.forbes.com/sites/thomasbrewster/2016/05/03/facebook-10-year-old-10k-instagram-vulnerability/ http://www.forbes.com/sites/thomasbrewster/2016/05/03/facebo...
- randyrand 10y agoI'm hoping the bug was a little more complicated than just "we forgot to check." That's a pretty dumb mistake to make...
- balls187 10y agoDo you see how the PS3 security system was thwarted?[1] 1: http://www.engadget.com/2010/12/29/hackers-obtain-ps3-private-cryptography-key-due-to-epic-programm/ http://www.engadget.com/2010/12/29/hackers-obtain-ps3-privat...
- randyrand 10y agoYes, dumb mistakes happen often, but that doesn't make them not dumb.
- porter 10y agoAwesome kid, but how was this risk only worth $10k to facebook? Needs a few more zeros behind it.
- porter 10y agono idea why this is getting downvoted.
- tptacek 10y agoBecause it's an extraordinarily silly comment. If Facebook hadn't paid $10,000 for this bug, the next bidder in line would have been unlikely to pay more than $50.
- dfc 10y agoVickrey auctions to the rescue.
- voltagex_ 10y agoPerhaps it's because you're being unrealistic? A version of this comment seems to pop up in every bug bounty related thread.
- blazespin 10y agolol: "In 2015 alone, 210 researchers received $936,000 with an average payout of $1,780."
- teraflop 10y agoMaybe they mean "average per vulnerability", not "average per person".
- azinman2 10y agoPayed out to over 800 researchers? Wow that's a lot of security bugs. I wouldn't have guessed so many were possible. Imagine if they didn't have such a program!
- pbhjpbhj 10y agoDo Facebook face some sort of liability under COPPA for allowing [condoning?] this under 13 yo - I'm presuming without verifiable parental consent prior to use - to use their services? Perhaps the time for Facebook to fight COPPA (for better or worse) is coming soon?
- envy2 10y agoIn this case, seeing as COPPA is a US law and the kid in question is from Finland (and thus likely under Facebook's EU subsidiary), I'm guessing not.
- pbhjpbhj 10y agoAnticipating this objection I looked at some COPPA info briefly (I'm in the UK, in not that familiar with USCs) and it suggested that the jurisdiction was based on location of the controlling company or the servers (either being sufficient) and not location of the children accessing the service. That makes sense as otherwise company's could just use offshore servers and bypass the regulation.
- deleted 10y ago[deleted]
- Asparagirl 10y agoMeanwhile, Apple remains one of the only big tech companies to not have a bug bounty program.
- eyeareque 10y agowhat about cisco, oracle, juniper, fireeye, palo alto, etc.? There are more companies who don't than do, hopefully it changes in the near future though.
- mrep 10y agoYou've forgotten the biggest of them all: Amazon [1]. [1]: I consider them the biggest of them all considering how much of the web is powered by AWS (just imagine if you found an exploit to give you full access to all of AWS), but that's just my opinion.
- altoz 10y agoAnyone else see this headline and thought, "Some government gave them a 10-year-old?"
- zodPod 10y agoYES lol This was my first thought as well! "Facebook awarded a 10 year old"
- ssorallen 10y agoHaha yes, that's exactly how I interpreted it. Removing the "with $10,000" from the actual headline made this a bit ambiguous.
- jonah 10y agoA ten year old with $10,000. ;) That's more money than most kids that age have to their name.
- NovaS1X 10y agoActually yes. I had to read a few times before it clicked.
- partycoder 10y agoThat wouldn't be a real reward, more like a liability.
- ck2 10y agoTrying to remember that other incident, not with facebook, maybe microsoft, where it was a teenager and they wouldn't pay them because they weren't 18+ So good on Facebook (this once). ETA: it was paypal http://seclists.org/fulldisclosure/2013/May/163 http://seclists.org/fulldisclosure/2013/May/163
- danjoc 10y ago$10,000? Not to diminish what this child did in any way, but that is 4x what the person received who obtained access to Static site content Source code SSL key pairs iOS and Android app signing keys iOS push notification keys Email server credentials Twitter, Facebook, Tumblr, Foursquare, and Flickr API keys http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php
- onewaystreet 10y agoBecause he broke the rules: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
- danjoc 10y agoI believe that particular opinion has been discussed to death here before, so I won't address it. The point I was trying to make is the market value seems wildly different from what Facebook pays out. The pricing gives me the impression that Facebook's bug bounty program is more concerned with public relations than it is about improving Facebook security.
- ldom22 10y agojesus when I was 10 years old I was barely programming on actionscript, which is now dead. Now at 28 I can't even make that kind of money in an entire year
- tpallarino 10y agoThat's awesome. Good for this kid.
- satyajeet23 10y agoDamn, facebook paid for a warm fuzzy PR moment. The bug is worth $100.