3 ms·
$10,000? Not to diminish what this child did in any way, but that is 4x what the person received who obtained access to Static site content Source code SSL k
by danjoc 10y ago
$10,000? Not to diminish what this child did in any way, but that is 4x what the person received who obtained access to
Static site content
Source code
SSL key pairs
iOS and Android app signing keys
iOS push notification keys
Email server credentials
Twitter, Facebook, Tumblr, Foursquare, and Flickr API keys
http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php
- onewaystreet 10y agoBecause he broke the rules: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
- danjoc 10y agoI believe that particular opinion has been discussed to death here before, so I won't address it. The point I was trying to make is the market value seems wildly different from what Facebook pays out. The pricing gives me the impression that Facebook's bug bounty program is more concerned with public relations than it is about improving Facebook security.