6 ms·

I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He eithe

by Grue3 8y ago

I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something. Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)

tptacek 8y ago
That's not at all the whole story.
- sterlind 8y ago
  Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
  - tptacek 8y ago
    The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
    - sterlind 8y ago
      The researcher's blog contains a reasonable rebuttal of Alex's write-up: >In the case of Facebook, the rules can be seen at https://www.facebook.com/whitehat https://www.facebook.com/whitehat. There is no rule which states what to do when a vulnerability is discovered, but there are several which imply that my testing was valid. These include: Report a bug that could ... enable access to a system within our infrastructure Remote Code Execution Privilege Escalation Provisioning Errors We both agree the initial RCE was in-scope. The researcher reported the RCE immediately, then reported the privilege escalation by weak user passwords, then reported the API key escalation. Moreover, you're factually incorrect about the "fit of pique." The researcher stopped poking around immediately after receiving the email; he simply continued before Facebook contacted him. When Alex said, Please be mindful that taking additional action after locating a bug violates our bounty policy. There was no reference whatsoever to that policy in the official Bug Bounty guidelines. Alex fibbed. Indeed, how is a canonically "in-scope" privilege escalation supposed to work if researchers are to stop at the first bug? Lastly, if Facebook's idea of defense-in-depth is a master API key to all Instagram S3 buckets, accessible from a simple diagnostic panel, any bug bounty program is merely window-dressing.
      - blazespin 8y ago
        Not to mention the part where he engaged the researchers boss who was completely not a part of this research.
        tptacek 8y ago
        If you read Stamos' post more carefully, he explains exactly why he did that, and given that his alternative was to engage Facebook legal directly, the researcher should probably be glad that's what ended up happening.
      - tptacek 8y ago
        Look, this is Hacker News, I know you can come up with 1,000 different random arguments for why Facebook was wrong and this guy was right. What I can tell you with confidence is that if you did what this researcher did as a contract pentester, you'd get your firm permanently fired from Facebook (or virtually any other major site you might have been testing), and would probably be immediately fired yourself. What he did was very much outside the norm for testing sites. Remember, he didn't simply pivot. He back-pocketed credentials, didn't tell anyone he had them, and used them later to hit out-of-scope systems. Nobody is OK with that.

by Grue3 8y ago

tptacek 8y ago

That's not at all the whole story.

sterlind 8y ago
Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation. If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.
- tptacek 8y ago
  The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty. There's a whole thread on HN about this. Here's Alex Stamos' writeup: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
  - sterlind 8y ago
    The researcher's blog contains a reasonable rebuttal of Alex's write-up: >In the case of Facebook, the rules can be seen at https://www.facebook.com/whitehat https://www.facebook.com/whitehat. There is no rule which states what to do when a vulnerability is discovered, but there are several which imply that my testing was valid. These include: Report a bug that could ... enable access to a system within our infrastructure Remote Code Execution Privilege Escalation Provisioning Errors We both agree the initial RCE was in-scope. The researcher reported the RCE immediately, then reported the privilege escalation by weak user passwords, then reported the API key escalation. Moreover, you're factually incorrect about the "fit of pique." The researcher stopped poking around immediately after receiving the email; he simply continued before Facebook contacted him. When Alex said, Please be mindful that taking additional action after locating a bug violates our bounty policy. There was no reference whatsoever to that policy in the official Bug Bounty guidelines. Alex fibbed. Indeed, how is a canonically "in-scope" privilege escalation supposed to work if researchers are to stop at the first bug? Lastly, if Facebook's idea of defense-in-depth is a master API key to all Instagram S3 buckets, accessible from a simple diagnostic panel, any bug bounty program is merely window-dressing.
    - blazespin 8y ago
      Not to mention the part where he engaged the researchers boss who was completely not a part of this research.
      - tptacek 8y ago
        If you read Stamos' post more carefully, he explains exactly why he did that, and given that his alternative was to engage Facebook legal directly, the researcher should probably be glad that's what ended up happening.
    - tptacek 8y ago
      Look, this is Hacker News, I know you can come up with 1,000 different random arguments for why Facebook was wrong and this guy was right. What I can tell you with confidence is that if you did what this researcher did as a contract pentester, you'd get your firm permanently fired from Facebook (or virtually any other major site you might have been testing), and would probably be immediately fired yourself. What he did was very much outside the norm for testing sites. Remember, he didn't simply pivot. He back-pocketed credentials, didn't tell anyone he had them, and used them later to hit out-of-scope systems. Nobody is OK with that.