9 ms·
Disclosing the Primary Email address for each Facebook user
- everly 10y agoSeems like you should have gotten more than $5k. Great work and nice write-up.
- elastic_church 10y agoRight, the slack group is probably a much bigger gold mine so this was probably lower hanging fruit for the occasional easy liquidity
- jaytaylor 10y agoI had the same thought. Seems like the value of such an exploit could be a lot more than $5k to the right people in the open market. The macro effect is that when someone with lower moral/ethical standards discovers such an exploit it's more likely the find will end up being sold for more money and ultimately used maliciously in the wild. The more $fb pays the greater the incentive will be for shady people to responsibly report it to $fb. Relying on good samaritans doesn't seem like a sustainable or particularly responsible solution to taking care of those trusting the Facebook platform to not leak their private information.
- icebraining 10y agoSeems like the value of such an exploit could be a lot more than $5k to the right people in the open market. Probably not. What would the buyer do with it? It's probably very hard to mass scrape FB (rate limiting would kick in), and there are other ways of getting a specific email address.
- jaytaylor 10y agoIt's about more than just email addresses. This is the policy applied to all exploits for their entire platform.
- icebraining 10y agoHow so? They paid a $15k bounty earlier this year.
- jaytaylor 10y agoPerhaps it's my mistake then, apologies. I didn't know it was a variable rate!
- disiplus 10y agoi think its fair. all you will get is the email somebody used to sign in to facebook, and if you tried to do this at mass im sure you would trigger some automated system. if you really want to target somebody particular there you can get the email address of that person. i have my gmail account from 2004, and at this point, it is resold million times. all it takes is somebody that i communicated with to do something stupid like allow some app to scan the contact book and my email is in the wild.
- Jake232 10y agoThis bug could have been used to make so much money. 1. Find a group on Facebook of users you're interested in. 2. Do this bug to get all of their emails. 3. Building a lookalike audience from these emails. Goldmine.
- blowski 10y agoIf only you could build a valuable product with nothing more than a list of email addresses.
- Raphmedia 10y agoFrom experience, a lot of online stores newsletter have up to 40% click rate if not more.
- hardwaresofton 10y agoIs this sarcasm? Is this not one of the main strategies in lead generation? Linking email addresses to facebook accounts to groups they're involved in and developing target markets for certain users and selling those lists (ex. gamers) to less-than-reputable and maybe even reputable marketing companies seems like it could be profitable... Maybe I'm naive?
- stingraycharles 10y agoThis is absolutely correct, there is a huge market for email lists, and even more so for highly targeted ones.
- Alan01252 10y agoWho said anything about building a product. 1. Find niche on facebook 2. Find appropriate nice product with affiliate scheme 3. Harvest Emails 4. Send email with product ( low conversion, but who cares? ) 5. Repeat
- a_imho 10y ago
- jankotek 10y agoThere are more bugs. Wrong password page will reveal facebook user associated with an email..
- TheGrumpyBrit 10y agoSo will just searching for the email while you're logged in. I believe that's expected behaviour.
- gondo 10y agotyping an email address into facebook search will reveal facebook user. that is not a secret
- zulln 10y agoI doubt it will happen if the user has chosen to hide their email?
- csydas 10y agoFacebook's Wrong Password page has a bunch of weird behavior that, as a lay person, I disagree with. Entering an old password into Facebook will tell you as such [1]. I can't really think of a practical attack for this towards facebook, but I'm really weary of any system that reveals information about passwords, even though I somewhat feel I'm being overly paranoid. Password recycling just seems to be too prevalent to allow me to ignore this, even though it seems impractical to me. I guess I just don't like that it reveals password information. Enough failed logins automatically sends a temporary login pin to the email on file. Again, I feel that in a practical sense this isn't a big issue since if you can get access to the email that has the login pin you also likely have access to the victim's machine that is already logged in, but it still feels like a weird practice to automatically generate temporary credentials without being asked. [1] - http://i.imgur.com/J7YTJqY.png http://i.imgur.com/J7YTJqY.png
- tedunangst 10y agoConfirmation of old password isn't such a big deal. If you are concerned that a password was shared with another site and not changed, the attacker has an easier test: use the password at the other site. On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right." I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.
- chiefalchemist 10y agoSlightly off topic but you can search FB by using a phone number, kinda like reverse lookup.
- djsumdog 10y agoat one time you could search by e-mail address, but that was removed years ago.
- xadhominemx 10y agoI think you still can?
- rbritton 10y agoYou can, so long as the privacy setting "Who can look you up using the email address you provided?" is set to a value that exposes it.
- shp0ngle 10y agoCan we please skip this dance "I think this Facebook bug is worth more than XY dollars" next time, thanks.
- daveguy 10y agoDid I miss it? I don't see anywhere the author said "I think this facebook bug is worth more than XY dollars". It is obviously worth more than the $5,000 bounty given to someone willing to exploit it. Being able to harvest the email address of any arbitrary Facebook user would be worth much more than $5,000. If bug bounty hunters are making a calculation of whether to report or sell on the black market, a bug like this would fetch a very large price. I hope people don't add shades of gray, or stripes of black, to their hats with the discrepancies that are regularly reported.
- dawgyg 10y agoEven at $5000 this set a personal high payout record for me. The easy legal money is better than taking a risk in a grey area such as selling exploits on the darknet. May not be as profitable this way, but I have no complaints and an extra 5k 2 days before xmas is a hell of a gift imo.
- benbristow 10y agoAlso karma compared to selling the exploit to dodgy people on the darknet.
- dawgyg 10y agoExactly. And with my past it is much better to stick to the right side and not venture into grey areas. Prison is not fun, so would really like to avoid it more in the future.
- daveguy 10y agoHah. That's why I pointed out that you weren't one of those who complained about the payout. I just found it odd that someone would say they didn't want that to be discussed. I think it's an important part of the discussion. I definitely agree -- easy legal money is always preferable to sketchy darknet money.
- zeroer 10y agoFacebook doesn't even have my primary email address.
- camiller 10y agoNot sure why you are getting downvoted, but... Same for me, facebook only has a spamgourmet address for me, and that address is set to only forward email from the facebook domain. Anyone else emailing it is just sending bits into the ineffable aether.
- zulln 10y agoI would set it up to forward everything, and stop that first when it get abused. Now you potentially miss emails sent to that adress if there were to use another adress to send emails with no clear gain.
- camiller 10y agoI always set them up so the first 20 email get forwarded. I'll notice if I stop getting notifications for friends and families birthdays.
- anigbrowl 10y agoWhy would you equate 'the primary email address' with your primary email address rather than the one FB thinks of as the primary? You're like a guy who sees a sign saying 'beware of pickpockets' and boasts about how he's smarter than that because he keeps his money in his shoe.
- zeroer 10y ago> You're like a guy who sees a sign saying 'beware of pickpockets' and boasts about how he's smarter than that because he keeps his money in his shoe. That's a beautiful analogy (and spot on). I'm stealing it.
- 10y ago
- deleted 10y ago[deleted]
- dimino 10y agoYou censor an email address in the image but not in the URL. Don't know of any other way than posting here to contact you.
- an_account_name 10y agoIt appears to be the researcher's own address. Also, the censoring in the image is Facebook's, not the researcher's - this discrepancy is exactly the bug they're disclosing.