4 ms·

He received $5,000 for remote code execution on a server in a separate VLAN and containing no user data. Barring another vulnerability to commit something like

He received $5,000 for remote code execution on a server in a separate VLAN and containing no user data. Barring another vulnerability to commit something like server-side request forgery across the VLAN, that significantly reduces the actual severity of the vulnerability. You wouldn't be able to chain this execution to impact user accounts or other Facebook servers. You also wouldn't be able to exfiltrate sensitive user data. Realistically, what you'd have is a very privileged server for phishing attacks. The severity of security vulnerabilities should be judged on their context, not on their classification or category.

Grue3 8y ago
I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)
- tptacek 8y ago
  That's not at all the whole story.
  - sterlind 8y ago
    Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
    - tptacek 8y ago
      The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
      - sterlind 8y ago
        The researcher's blog contains a reasonable rebuttal of Alex's write-up: >In the case of Facebook, the rules can be seen at https://www.facebook.com/whitehat https://www.facebook.com/whitehat. There is no rule which states what to do when a vulnerability is discovered, but there are several which imply that my testing was valid. These include: Report a bug that could ... enable access to a system within our infrastructure Remote Code Execution Privilege Escalation Provisioning Errors We both agree the initial RCE was in-scope. The researcher reported the RCE immediately, then reported the privilege escalation by weak user passwords, then reported the API key escalation. Moreover, you're factually incorrect about the "fit of pique." The researcher stopped poking around immediately after receiving the email; he simply continued before Facebook contacted him. When Alex said, Please be mindful that taking additional action after locating a bug violates our bounty policy. There was no reference whatsoever to that policy in the official Bug Bounty guidelines. Alex fibbed. Indeed, how is a canonically "in-scope" privilege escalation supposed to work if researchers are to stop at the first bug? Lastly, if Facebook's idea of defense-in-depth is a master API key to all Instagram S3 buckets, accessible from a simple diagnostic panel, any bug bounty program is merely window-dressing.
        blazespin 8y ago
        Not to mention the part where he engaged the researchers boss who was completely not a part of this research.

Grue3 8y ago

I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)

tptacek 8y ago
That's not at all the whole story.
- sterlind 8y ago
  Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
  - tptacek 8y ago
    The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
    - sterlind 8y ago
      The researcher's blog contains a reasonable rebuttal of Alex's write-up: >In the case of Facebook, the rules can be seen at https://www.facebook.com/whitehat https://www.facebook.com/whitehat. There is no rule which states what to do when a vulnerability is discovered, but there are several which imply that my testing was valid. These include: Report a bug that could ... enable access to a system within our infrastructure Remote Code Execution Privilege Escalation Provisioning Errors We both agree the initial RCE was in-scope. The researcher reported the RCE immediately, then reported the privilege escalation by weak user passwords, then reported the API key escalation. Moreover, you're factually incorrect about the "fit of pique." The researcher stopped poking around immediately after receiving the email; he simply continued before Facebook contacted him. When Alex said, Please be mindful that taking additional action after locating a bug violates our bounty policy. There was no reference whatsoever to that policy in the official Bug Bounty guidelines. Alex fibbed. Indeed, how is a canonically "in-scope" privilege escalation supposed to work if researchers are to stop at the first bug? Lastly, if Facebook's idea of defense-in-depth is a master API key to all Instagram S3 buckets, accessible from a simple diagnostic panel, any bug bounty program is merely window-dressing.
      - blazespin 8y ago
        Not to mention the part where he engaged the researchers boss who was completely not a part of this research.