3 ms·
I disagree. I can imagine tons of parties that would pay good money for access to Facebook's legal admin panel. Without knowing exactly what's in there, one cou
by tschwimmer 6y ago
I disagree. I can imagine tons of parties that would pay good money for access to Facebook's legal admin panel. Without knowing exactly what's in there, one could imagine lawsuit filings, documents and data that have been put aside during a legal hold, C&Ds sent to people doing things Facebook doesn't like, etc. What can you do with this data? Well, probably embarrass Facebook badly by exposing all sorts of confidential discussions. You might be able to pull an invoice scam by harvesting vendor information and sending a bunch of fake invoices to be paid. You might find other unsecured information that allows you to escalate your access. One can only imagine.
Sure, the economic value of the root password to the NAS for Joe's Carwash is quite low but I suspect even the low level systems at high profile companies is worth tons (I'd guess millions) of dollars to the right (wrong people).
- tptacek 6y agoYou can disagree, but you're wrong. The kinds of people who watch dark marketplaces for exploits are not dreaming of the super interested information they can get off a random backoffice system. One time, about 15 "bug bounties are a ripoff" threads ago, someone actually made a non-ironic case for a high valuation for logout CSRF bugs. A competing image service could employ it to ruthlessly log users out, degrading service and jacking up their own signups. A logout CSRF. That's the kind of logic we're talking about here. Nobody buys these kinds of bugs speculatively.