6 ms·

He got $5k for an arbitrary remote execution bug? What a rip-off.

0x8BADF00D 8y ago
He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?
- tyleraldrich 8y ago
  You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."
  - jwilk 8y ago
    From the HN guidelines: Please don't insinuate that someone hasn't read an article.
    - Kiro 8y ago
      Not applicable when it's obvious that the poster hasn't read the article, like in this case.
      - dang 8y ago
        It's applicable precisely in that case.
    - Sohcahtoa82 8y ago
      To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.
      - pvg 8y ago
        It's not a hard rule to follow. You can just say 'The article says X'.
- meowface 8y ago
  He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).
  - komali2 8y ago
    Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.
- chias 8y ago
  What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".
  - brainkim 8y ago
    The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.
    - throwawaymath 8y ago
      How are you quantifying that?
throwawaymath 8y ago
He received $5,000 for remote code execution on a server in a separate VLAN and containing no user data. Barring another vulnerability to commit something like server-side request forgery across the VLAN, that significantly reduces the actual severity of the vulnerability. You wouldn't be able to chain this execution to impact user accounts or other Facebook servers. You also wouldn't be able to exfiltrate sensitive user data. Realistically, what you'd have is a very privileged server for phishing attacks. The severity of security vulnerabilities should be judged on their context, not on their classification or category.
- Grue3 8y ago
  I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)
  - tptacek 8y ago
    That's not at all the whole story.
    - sterlind 8y ago
      Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
      - tptacek 8y ago
        The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
meowface 8y ago
I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage. Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.
- tptacek 8y ago
  Where are you pulling that number out of?
  - meowface 8y ago
    Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.
    - tedunangst 8y ago
      But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?
      - meowface 8y ago
        I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.
  - arcticfox 8y ago
    Probably the same rather random place where $5000 got pulled out of in the first place
tptacek 8y ago
Please explain how you would go about valuing this bug.

He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?

tyleraldrich 8y ago
You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."
- jwilk 8y ago
  From the HN guidelines: Please don't insinuate that someone hasn't read an article.
  - Kiro 8y ago
    Not applicable when it's obvious that the poster hasn't read the article, like in this case.
    - dang 8y ago
      It's applicable precisely in that case.
  - Sohcahtoa82 8y ago
    To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.
    - pvg 8y ago
      It's not a hard rule to follow. You can just say 'The article says X'.
meowface 8y ago
He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).
- komali2 8y ago
  Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.
chias 8y ago
What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".
- brainkim 8y ago
  The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.
  - throwawaymath 8y ago
    How are you quantifying that?

throwawaymath 8y ago

He received $5,000 for remote code execution on a server in a separate VLAN and containing no user data. Barring another vulnerability to commit something like server-side request forgery across the VLAN, that significantly reduces the actual severity of the vulnerability. You wouldn't be able to chain this execution to impact user accounts or other Facebook servers. You also wouldn't be able to exfiltrate sensitive user data. Realistically, what you'd have is a very privileged server for phishing attacks. The severity of security vulnerabilities should be judged on their context, not on their classification or category.

Grue3 8y ago
I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)
- tptacek 8y ago
  That's not at all the whole story.
  - sterlind 8y ago
    Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
    - tptacek 8y ago
      The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

meowface 8y ago

I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage. Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.

tptacek 8y ago
Where are you pulling that number out of?
- meowface 8y ago
  Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.
  - tedunangst 8y ago
    But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?
    - meowface 8y ago
      I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.
- arcticfox 8y ago
  Probably the same rather random place where $5000 got pulled out of in the first place

tptacek 8y ago

Please explain how you would go about valuing this bug.