5 ms·

Is there something in here we're missing? Someone finds exploit, gets the bounty, facebook fixes and we have a timeline. Sounds like the system worked... are

Is there something in here we're missing? Someone finds exploit, gets the bounty, facebook fixes and we have a timeline. Sounds like the system worked... are we looking for something else here?

abhisuri97 8y ago
I don't think there's much to see here...it is a cool bug though that doesn't require a super high level understanding of security to figure out. But a 6-9 month time to fix seems really long (also I would have thought a $1000 bug bounty is low for this type of exploit...but then again I'm not in this space too much to know the average rewards).
- DanFeldman 8y ago
  Being charitable here, it may be that this exploit showed a breakage in their internal API security process, or an edge case previously unhandled. Perhaps FB had to run an internal audit to find any other endpoints effected by this bug. Buggy endpoints then need to get fixed, tickets get sent out, but with a low priority because this is a low priority bug, and voilà, 6-9 months.
  - abeyer 8y ago
    One could also question whether they used the lure of a bounty to keep someone quiet while they let customers (aka advertisers) continue to benefit for an extra 9 months at the expense of the users. I guess you'd have to consider Facebook's track record in terms of how charitable vs. cynical you want to be in interpreting their actions.
    - baroffoos 8y ago
      Couldn't facebook just provide some secret service for identifying users behind the scenes that regular devs can not access?
- jcims 8y ago
  The thing to also keep in mind is that the bug bounty teams are typically centralized and not embedded within the product teams of the services being reported on. They certainly get prioritized attention, but there are still layers of communication to report the issue, follow up with devs or reporter if there are questions or difficulties reproducing the issue, prioritize the issue, fix the bug and deploy to prod. Not to say that’s the way it is at Facebook, just what I’ve seen in the past.
userxyz135 8y ago
It's common in the bug bounty community to write about how you found the bug and how the reporting process went.
dpwm 8y ago
> are we looking for something else here? No. But some people, myself included, are interested in this sort of thing. It's also interesting to see the timescales of the fix. Posts like this demonstrate that the system worked, albeit perhaps a bit slower than we'd like to imagine. Whilst the reports of bug hunting apparently within the scope of the bug bounty resulting in a legal team responding with a false dichotomy between an NDA or prosecution are particularly juicy, it's also nice to hear about the cases where that isn't the outcome.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
paxys 8y ago
Who is complaining about anything? It's a nice article about a neat little exploit, and the process to find it.

Is there something in here we're missing? Someone finds exploit, gets the bounty, facebook fixes and we have a timeline. Sounds like the system worked... are we looking for something else here?

abhisuri97 8y ago

I don't think there's much to see here...it is a cool bug though that doesn't require a super high level understanding of security to figure out. But a 6-9 month time to fix seems really long (also I would have thought a $1000 bug bounty is low for this type of exploit...but then again I'm not in this space too much to know the average rewards).

DanFeldman 8y ago
Being charitable here, it may be that this exploit showed a breakage in their internal API security process, or an edge case previously unhandled. Perhaps FB had to run an internal audit to find any other endpoints effected by this bug. Buggy endpoints then need to get fixed, tickets get sent out, but with a low priority because this is a low priority bug, and voilà, 6-9 months.
- abeyer 8y ago
  One could also question whether they used the lure of a bounty to keep someone quiet while they let customers (aka advertisers) continue to benefit for an extra 9 months at the expense of the users. I guess you'd have to consider Facebook's track record in terms of how charitable vs. cynical you want to be in interpreting their actions.
  - baroffoos 8y ago
    Couldn't facebook just provide some secret service for identifying users behind the scenes that regular devs can not access?
jcims 8y ago
The thing to also keep in mind is that the bug bounty teams are typically centralized and not embedded within the product teams of the services being reported on. They certainly get prioritized attention, but there are still layers of communication to report the issue, follow up with devs or reporter if there are questions or difficulties reproducing the issue, prioritize the issue, fix the bug and deploy to prod. Not to say that’s the way it is at Facebook, just what I’ve seen in the past.

userxyz135 8y ago

It's common in the bug bounty community to write about how you found the bug and how the reporting process went.

dpwm 8y ago

> are we looking for something else here? No. But some people, myself included, are interested in this sort of thing. It's also interesting to see the timescales of the fix. Posts like this demonstrate that the system worked, albeit perhaps a bit slower than we'd like to imagine. Whilst the reports of bug hunting apparently within the scope of the bug bounty resulting in a legal team responding with a false dichotomy between an NDA or prosecution are particularly juicy, it's also nice to hear about the cases where that isn't the outcome.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

paxys 8y ago

Who is complaining about anything? It's a nice article about a neat little exploit, and the process to find it.