9 ms·

I've always wondered, aren't these types of bug investigations illegal? Aren't the investigators concerned about criminal prosecution? Not being snarky; I'm ask

I've always wondered, aren't these types of bug investigations illegal? Aren't the investigators concerned about criminal prosecution? Not being snarky; I'm asking sincerely.

heavyset_go 6y ago
In the US, yes. Unauthorized access and computer trespass is often felonious. People have gone to prison for logging into an email account by guessing the password.
snazz 6y ago
Facebook allows people hunting for bugs to find them on approved subdomains following their bug bounty policy.
detaro 6y ago
Places with a bug bounty program typically publicly state rules for what they think is ok for a researcher to do, specifically to avoid that problem. Without permission like that, yes, such an investigation can quickly move into legally dangerous areas, and not all companies have gotten the idea that if someone is willing to tell you about a problem you want them on your side, threatening or suing them just means the next time someone finds something you're not told. (of course that's not a free-for-all for researchers, if you start actually poking in private data or hack actual peoples accounts that's a problem)
deleted 6y ago
[deleted]
KMnO4 6y ago
Generally companies prefer if you find bugs and disclose them before malicious parties find and exploit them. Most websites have a “responsible disclosure” policy. If you can’t find this linked on their main page, you can often find it at /security.txt or /.well-known/security.txt [0]: https://securitytxt.org/ https://securitytxt.org/ [1]: https://facebook.com/security.txt https://facebook.com/security.txt
- czbond 6y ago
  I'd suggest "most" is liberal. A few is more likely.... most corporates take it as an offense (someone may be fired, only the most enlightened of CISO's in progressive orgs treat it as anything but heresy). In SilVal - sure, a higher number because they can get it. Everyone else treats these types of issues as "guilty before proven innocent"
jcims 6y ago
In general you are on shaky legal ground. However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that you can operate within to discover vulnerabilities within their products or infrastructure in exchange for some kind of recognition or award. The terms of Facebooks bounty are here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat Based on a cursory glance and the fact that this individual was awarded in their program, it appears they operated by the book. Prosecuting activity that happens outside of these parameters has definitely happened in the past and will continue. It's not always a cut and dried decision. It can be difficult/expensive to effectively prosecute and you may find a lot of social backlash depending on the nature and impact of the activity.
- bredren 6y ago
  Yes. Most competent tech companies permissibly allow “security research” like this. If you are genuinely trying to find exploits in good faith, and are acting within the parameters spelled out in their bug bounty program, it’s all good. You also may get paid. This blog entry sort of dramatized what happened for clicks. I actually think it’s unwise to characterize any exploit like this, because it adds a PR dimension consumer companies just don’t want or need. It sort of creates a sense of adversarial relationship which isn’t really what FB is after. But it sounds like a risky endeavor put this way and probably helps get retweets attention in the short term.
  - jcims 6y ago
    Totally agree with your perspective here. There's security research and there's bug prospecting. Both have streaks of narcissists and showboaters but the latter seems to be thick with them. (edit: to clarify b/c this can easily be interpreted otherwise, I'm not calling the writer of this article either of those. The headline is a bit of cheap clickbait but the article is a good walkthrough of their mindset)
    - markdown 6y ago
      > There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, then you can call your work "security research". Bug bounty programs are mainly targeted at bug prospectors. > Both have streaks of narcissists and showboaters but the latter seems to be thick with them. Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others.
curiousgal 6y ago
Many of these guys are based in Third World countries, it's more complicated to go after them over petty stuff.
- Cyph0n 6y ago
  This has nothing to do with it. See sibling comments for the actual reason: Facebook and other companies typically allow this kind of security research, as long as the intent is not malicious and the researcher operates within some boundaries.
  - curiousgal 6y ago
    This has everything to do with it. It is much easier for pentesters to do their job when they don't have to walk on eggshells. Any U.S. based pentester would always think twice before logging in a compromised system.
ikiris 6y ago
Would you rather someone find it and report it to you, or sell it on the dark web / exploit it? Making this kind of research illegal only makes sure the end result is always the latter.
ecesena 6y ago
Check out HackerOne or BugCrowd. Companies have programs with details on what’s allowed vs not, responsibly report and optionally share findings after they’re fixed.

I've always wondered, aren't these types of bug investigations illegal? Aren't the investigators concerned about criminal prosecution? Not being snarky; I'm asking sincerely.

heavyset_go 6y ago

In the US, yes. Unauthorized access and computer trespass is often felonious. People have gone to prison for logging into an email account by guessing the password.

snazz 6y ago

Facebook allows people hunting for bugs to find them on approved subdomains following their bug bounty policy.

detaro 6y ago

Places with a bug bounty program typically publicly state rules for what they think is ok for a researcher to do, specifically to avoid that problem. Without permission like that, yes, such an investigation can quickly move into legally dangerous areas, and not all companies have gotten the idea that if someone is willing to tell you about a problem you want them on your side, threatening or suing them just means the next time someone finds something you're not told. (of course that's not a free-for-all for researchers, if you start actually poking in private data or hack actual peoples accounts that's a problem)

deleted 6y ago

[deleted]

KMnO4 6y ago

Generally companies prefer if you find bugs and disclose them before malicious parties find and exploit them. Most websites have a “responsible disclosure” policy. If you can’t find this linked on their main page, you can often find it at /security.txt or /.well-known/security.txt [0]: https://securitytxt.org/ https://securitytxt.org/ [1]: https://facebook.com/security.txt https://facebook.com/security.txt

czbond 6y ago
I'd suggest "most" is liberal. A few is more likely.... most corporates take it as an offense (someone may be fired, only the most enlightened of CISO's in progressive orgs treat it as anything but heresy). In SilVal - sure, a higher number because they can get it. Everyone else treats these types of issues as "guilty before proven innocent"

jcims 6y ago

In general you are on shaky legal ground. However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that you can operate within to discover vulnerabilities within their products or infrastructure in exchange for some kind of recognition or award. The terms of Facebooks bounty are here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat Based on a cursory glance and the fact that this individual was awarded in their program, it appears they operated by the book. Prosecuting activity that happens outside of these parameters has definitely happened in the past and will continue. It's not always a cut and dried decision. It can be difficult/expensive to effectively prosecute and you may find a lot of social backlash depending on the nature and impact of the activity.

bredren 6y ago
Yes. Most competent tech companies permissibly allow “security research” like this. If you are genuinely trying to find exploits in good faith, and are acting within the parameters spelled out in their bug bounty program, it’s all good. You also may get paid. This blog entry sort of dramatized what happened for clicks. I actually think it’s unwise to characterize any exploit like this, because it adds a PR dimension consumer companies just don’t want or need. It sort of creates a sense of adversarial relationship which isn’t really what FB is after. But it sounds like a risky endeavor put this way and probably helps get retweets attention in the short term.
- jcims 6y ago
  Totally agree with your perspective here. There's security research and there's bug prospecting. Both have streaks of narcissists and showboaters but the latter seems to be thick with them. (edit: to clarify b/c this can easily be interpreted otherwise, I'm not calling the writer of this article either of those. The headline is a bit of cheap clickbait but the article is a good walkthrough of their mindset)
  - markdown 6y ago
    > There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, then you can call your work "security research". Bug bounty programs are mainly targeted at bug prospectors. > Both have streaks of narcissists and showboaters but the latter seems to be thick with them. Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others.

curiousgal 6y ago

Many of these guys are based in Third World countries, it's more complicated to go after them over petty stuff.

Cyph0n 6y ago
This has nothing to do with it. See sibling comments for the actual reason: Facebook and other companies typically allow this kind of security research, as long as the intent is not malicious and the researcher operates within some boundaries.
- curiousgal 6y ago
  This has everything to do with it. It is much easier for pentesters to do their job when they don't have to walk on eggshells. Any U.S. based pentester would always think twice before logging in a compromised system.

ikiris 6y ago

Would you rather someone find it and report it to you, or sell it on the dark web / exploit it? Making this kind of research illegal only makes sure the end result is always the latter.

ecesena 6y ago

Check out HackerOne or BugCrowd. Companies have programs with details on what’s allowed vs not, responsibly report and optionally share findings after they’re fixed.