10 ms·

Instagram's Million Dollar Bug (2015)

201 points by tslocum 6y ago

julianmcolina 6y ago
Million dollar bug actually sounds like a small amount given the context!
Zee2 6y ago
God, this is frustrating. They essentially cracked Instagram's entire production environment open, and took explicit steps at every turn to stay within the published guidelines, and then they just take his report with zero compensation whatsoever. Insane.
- hh3k0 6y ago
  I wouldn't really blame the guy if he decides to sell the next one on the darknet.
  - curryst 6y ago
    According to free market economics, this is exactly what should happen. Security researches sell their exploits on the dark web until bug bounties rise to the same or higher prices as the dark web will pay. It's crazy that they can find a bug that would cost Instagram 1M+, yet payouts are in the thousands or maybe tens of thousands if you're super lucky. I'm curious if it's illegal to sell exploits. Using them is obviously illegal, but is the transfer of knowledge for money illegal? I.e. I'm not allowed to build an M16, but presumably I could by the schematics for one if I wanted (I've never tried, but I can't imagine possession of them is illegal since they make posters of it and what not).
    - albntomat0 6y ago
      I honestly think this is what free market economics will get us, due to the high barriers to selling on the black market (ethically, legally, and logistically). The bug bounty targets with high payouts from the company line up roughly with the ones with high payouts on Zerodium etc. As I stated elsewhere in the thread, I'm not honestly convinced the fallout from a company being breached is that high, which leads to the current pricing for bug bounties. Twitter stock is massively up from when their incident happened in July. We'll see what happens with SolarWinds.
      - PradeetPatel 6y ago
        As someone who's not in the infosec/cyber industry, what exactly is Zerodium and why is it generally considered a suboptimal buyer?
        albntomat0 6y ago
        Zerodium is one of several companies that buys exploits and sells them to governments. This route supposedly pays more than public bug bounties, but with different secrecy etc requirements.
      - lukeramsden 6y ago
        > I'm not honestly convinced the fallout from a company being breached is that high The market clearly doesn't care, and so neither do executives. What needs to happen is a household company gets exploited/hacked/pwned/whatever so hard that their entire business collapses, maybe not entirely but significantly. Then the market will price these breaches very differently.
    - tshaddox 6y ago
      That seems to depend on some very specific and unusual definition of "free market economics." Usually there is some unspecified assumption of rights (particularly property rights), and actions which violate those rights are not considered to be "free market" interactions. As an obvious example, if you creep around neighborhoods looking for people with valuable property that isn't well-secured against theft, then offer to sell a homeowner the information about the security problems you've discovered, and then sell that information to professional thieves if the homeowner declines, I don't think that would be "exactly what should happen according to free market economics."
  - parliament32 6y ago
    Yup. Then you get things like the Twitter hack a few months ago where a bunch of celebrities were tweeting a crypto scam. I'd bet that wouldn't have happened if bug bounties were paid and reliable enough.
- FriendlyNormie 6y ago
  Imagine being that close to completely destroying one of the most evil companies on earth with a single keystroke and instead of doing that you fall to your knees and suck them off hoping for a pat on the head. Hell is real and I guarantee this guy is going there when he dies.
- paulpauper 6y ago
  but he didn't/ He only gained access because the admins used weak passwords .
- AviationAtom 6y ago
  Important rebuttal: https://web.archive.org/web/20151217232048/https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://web.archive.org/web/20151217232048/https://www.faceb...
- fouc 6y ago
  Technically he used the 1st bug to enter their systems and then escalate access through other security holes or bugs. That's not likely to be accepted by default by most companies. I would assume a default "do not escalate access" unless explicitly asked for.
  - danielblank69 6y ago
    While I can see why that's the case - If a surface breach is patched, any other flaws that could be exploited won't be accessible to an attacker. On the other hand, software is built in layers. If there's an "inside" breach, i.e. I can get from an inner layer to a deeper layer, I would want to know about it. Facebook were idiots to structure their policy this way.
blakesterz 6y ago
I tried a little searching but I can't find anything that says how this all ended. Alex Stamos denied saying anything bad. But then what? It looks like it was all just dropped pretty much as is?
- elliekelly 6y ago
  > But then what? It looks like it was all just dropped pretty much as is? That usually means some money was exchanged and some NDAs were signed.
  - danuker 6y ago
    Why would Facebook NDA paying a researcher? Shouldn't they be shouting it at the top of their lungs?
    - PradeetPatel 6y ago
      From my experience working in the PR and media industry, this NDA appears to serve a key purpose: It discourages engagements/discussions on social media platforms, thus hastening this incident into irrelevancy to mainstream media, thus protecting the brand reputation and key shareholders of FB. Security findings are never good for the share price. Therefore it is crucial for the company to take control of the narrative when possible.
    - yaur 6y ago
      From Facebook's POV the researcher behaved badly and rewarding that behavior without an NDA will encourage other researchers to behave badly.
TravisLS 6y ago
Previous discussion (5 years ago): https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194
- wdr1 6y ago
  Alex's response is no longer available. (His link to his Facebook post is dead.) Anyone have a mirror?
  - darknavi 6y ago
    Here is a cached version on Wayback Machine: https://web.archive.org/web/20161218181922/https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://web.archive.org/web/20161218181922/https://www.faceb...
vittore 6y ago
Are there any means inside IG/FB to let engineers (or employees in general) hold company/managers accountable in cases like this?
thaumasiotes 6y ago
This speaks to a couple of issues that bothered me while working in bug bounty triage. > Alex informed my employer (as far as I am aware) that I had found a vulnerability, and had used it to access sensitive data. He then explained that the vulnerability I found was trivial and of little value, and at the same time said that my reporting and handling of the vulnerability submission had caused huge concern at Facebook. [my emphasis] There is this conceptual separation between the severity of the issue and the impact. Simplifying things much further than the situation described in the piece, you could have an admin account with the password "password". This is a stupid issue. The fix is to change the admin password. How much of a bounty should be paid for this report? One school of thought is that the value of the report is related to what you can accomplish by exploiting it. This is clearly the right approach if you're assessing the issue's value to an attacker. It has some problems in the bug bounty context -- a major one is that it feels subjectively unfair to the company! They don't want to pay 100x more for the same vulnerability just because, this time, it happened to have more sensitive stuff behind it. Another is that, as here, you often see a chain of vulnerabilities, all of which are of very little consequence in isolation, but they happen to combine into something much greater than the sum of the parts. (I recall a published writeup, which I can no longer find, in which one important step was a logout CSRF. Nobody cares about those.) The policy of "stop investigating as soon as you find anything" rules out this kind of "whole is greater than the sum of the parts" finding by definition. > Playing By The Rules > Microsoft (in my opinion), has done the best job of explaining exactly how far they would like a researcher to take a vulnerability. Google and Yahoo imply that you should report a vulnerability immediately, but do not clarify how far you should go in determinining impact. Tumblr, on the other hand, puts in writing the policy of just about every bounty program. The better your PoC shows impact, the more you are likely to get paid. Further, the better a researcher can understand and describe impact, the more likely they are to receive a greater reward. This bothers me from a fairness perspective. I have personally seen essentially the same report on different pages of a webapp get paid out differently because the researchers provided different speculation about what might be possible using their exploit. The guy who got paid less was careful about following the rules, asking for guidance about exactly what and how he could investigate, and then he only claimed what he was able to demonstrate. The guy who got paid more had a more generic claim that "this demonstrates SQLi, and writing to the database might be possible". I could not establish whether writing to the database was in fact possible for the same reason the first guy (and the second guy) didn't try -- it might have been unacceptably disruptive to the company. So I passed the speculation through, and the payout ended up being higher. The lesson here is, "claim the moon and the stars." But I feel that means the ecosystem is unhealthy; that's not what I think the lesson should be. Companies always say they will investigate the full impact of a vulnerability when you follow the protocol they urge of "as soon as you find something, report it and don't try to escalate". But this is nearly impossible to do even if you're trying in good faith. --- Sometimes you're not trying in good faith. I have also seen what is exactly the same issue paid out differently depending on the category the researcher files it under. Many programs publish payout schedules by category. In this case, the schedule contained a mix of technical category types ("XSS") and functional category types ("account takeover"). One researcher found a way to present an issue in a low-paying technical category as a high-paying functional category. I repeatedly noted in my reports to the company that this researcher was getting paid quite a lot more for the same vulnerability than other researchers who didn't know about the loophole. This state of affairs never changed; I assume the main concern was maintaining the relationship with the loophole guy. But obviously, this sort of thing directly falsifies the claim that "we will investigate the full impact of the issue you report and pay out appropriately."
typenil 6y ago
Ah nice. Facebook resorts to intimidating bug bounty participants acting in good faith by threatening them through their employer instead of talking. Can't say I'm surprised, given the level of ethics Facebook exhibits at every conceivable level.
- LukasReschke 6y ago
  Disclaimer: I was a Security Engineer on the FB Security Team until last month and was also involved in the Bug Bounty Program :-) That's not how Facebook treats Bug Bounty Participants. By far, it's one of the better programs in terms of payouts, fairness, and triage time on critical issues. Just a recent example: a bug bounty hunter reported unexpired CDN links. After internal research, FB figured out to chain this into a Remote Code Execution and paid out 80k USD to the researcher. (https://www.facebook.com/BugBounty/posts/approaching-the-10th-anniversary-of-our-bug-bounty-programby-dan-gurfinkel-secur/4087540111260184/ https://www.facebook.com/BugBounty/posts/approaching-the-10t...) That said, I wasn't there in 2015, so I only know the story from some stories. (which portray the story a tad different) - Even if it were true, I haven't seen such treatment in the last three years at FB.
  - danuker 6y ago
    Fool me once, shame on you.
  - oofbey 6y ago
    I think FB's greatest achievements is convincing their employees that their jobs are actually good for society, or at least neutral. Plenty of good people working there who seem honestly confused about how their jobs lead to so corruption and downfall of our society.
    - fnbr 6y ago
      Upton Sinclair got this right almost 100 years ago- “It is difficult to get a man to understand something, when his [RSUs depend] on his not understanding it.” Of course, I also work at a FAANG, so people in glass houses and all that...
deleted 6y ago
[deleted]
umvi 6y ago
Any closure on this? Did FB ever make amends? Surely there are some FB security employees on HN.
paxys 6y ago
This was discussed at length when it was first submitted here 5 years ago. The researcher found a (known) exploit, claimed $2500, then a month later used internal details he gathered (and saved) from the first exploit to breach the system further to demand a bigger payout.
- spoonjim 6y ago
  They didn't change the credentials that had been hacked? God I wish the hacker had sold the vuln to North Korea.
  - paulpauper 6y ago
    Real life is not like the movies, in which a floppy disk of info is exchanged for a suitcase of money in a dark alley or in a boardroom. Blackhats typically find that there is little market for their info, especially before the advent of bitcoin being popular. yeah, you cracked a bunch of selfie pics. What can you do with it. not much.
    - chrissnell 6y ago
      He had signing keys for the Instagram app and the *.instagram.com keypair. Do you think that's not valuable and dangerous?
      - vuciv1 6y ago
        sorry, can you explain what the signing keys and keypair would allow someone to do?
        dgrin91 6y ago
        Would allow you to make an app that steals all your info and release it as if it was the latest app from instagram.
        6y ago
paulpauper 6y ago
There is no real bug besides the ruby RCE thing. Cracking weak passwords is not eligible. Sorry. I can see why Facebook denied him a remittance but their approach of contacting his employer was wrong.
- ufmace 6y ago
  Not a "bug" in terms of incorrect code. But if I worked there, I'd sure like to know that 1. There were older versions of apps with config files stored in S3 that contained AWS keypairs for roles with wide open access 2. That such keypairs existed in the first place and were used on servers - probably no service role with such wide access should exist, and even if it did, it ought to be caught by routine audits for overpermissioned roles, and also old keypairs should be retired and rotated regularly 3. That a whole bunch of private key material basically encompassing the keys to the Instagram castle were stored in S3 buckets
paulpauper 6y ago
The problem with bug bounties is they are one-sided, against the researcher. The conditions of bounties typically stipulate that any attempt at negotiation can be interpreted as extortion, so it is either take it or leave it.
- LukasReschke 6y ago
  How else would you phrase someone telling you "I have this bug and will exploit it if you don't pay me X amount" vs. "I think the impact is bigger because of Y"? For me, the first sounds quite clearly like extortion. The first case would get you likely in trouble. The second case would routinely cause a further review in any decent program, and if there's any merit to it, you get a higher bounty. Nobody is forced to participate in any bug bounty program. If people feel the reward is too low, they should not partake.
  - deeviant 6y ago
    > How else would you phrase someone telling you "I have this bug and will exploit it if you don't pay me X amount" Hello Strawman! > The second case would routinely cause a further review in any decent program We literally just read a example of how a big corp responds to #2. Do you think it was a 1 of?
    - LukasReschke 6y ago
      I was part of "big corp" for the past three years and was involved in many bug bounty reports. A reasonable claim like "I think this should be higher because XYZ" gets investigated and, if justified, higher bounties issued. This blog post seems a bit one-sided and doesn't correlate to the facts that I have heard. I wasn't there at the time being so I don't know the truth. But that blog post seems not quite 100% to be it. What I have seen, however, in the past years, is that some people omit facts or misrepresent things to get some press. So I am quite a cynic on blog posts like this :-)
      - albntomat0 6y ago
albntomat0 6y ago
(my comment is on the overall trend, as the specifics on this incident are complex) The issues with bug bounties as a whole is the market is skewed. For any work done by a bug bountier, there is exactly one legitimate buyer, who gets to make a significant judgement call on the value of the work done. Furthermore, this value is decided upon after the work has been completed, and has been provided to the company. In what other industries is this the case? Alternatively, triagers have a whole pile of crap to wade through, to get to the useful material. Furthermore, it really is hard to place an accurate monetary value on a bug that's responsibly reported, and patched. This is in part due to unclear monetary results from being breached. What precisely is the monetary loss from the recent MS Teams bug that was reported but not exploited vs the incidents this year at Twitter and SolarWinds? Having had some involvement in the bug bounty arena as a reporter, I have to say I'm a big fan of those companies that open up all of their reports after a fix period of time. This allows them to build trust with those who look into their products, and develop a reputation for being prompt and consistent.
- arwhatever 6y ago
  > Furthermore, this value is decided upon after the work has been completed, and has been provided to the company. In what other industries is this the case? Those "mail us your gold" ads on TV.
  - underwater 6y ago
    Hospitals do this, but backwards. The service provider gets to set the price.
    - arcticbull 6y ago
      Basically only in America, though. Elsewhere the situation where someone gets into a car wreck, goes to hospital and then gets told how broke they are now just doesn't exist. In much of the rest of the world, the health system sets and publishes the rates - and guarantees payment to service providers. The doctors perform the services, and then submit for renumeration directly to the health system. The patients, well, they're sick and don't have to worry about any of it.
fireattack 6y ago
Off topic, but there is a bug on Instagram that has been bothered me for quite a while. On web (not sure about the app), if your language is Japanese, for any profile that has 0 following, it will show "Following: 0" as "フォロー中NaN人". A screenshot for the lazy: https://i.imgur.com/rTGXe3T.png https://i.imgur.com/rTGXe3T.png Of course this is a rather minor issue, but it still feels weird to me that one of the most popular website/service in the world would have this kind of bug live so long (and yes, I have reported it multiple times).
- elboru 6y ago
  My Kindle says “2GB gratis de 3GB” (in Spanish) which doesn’t make any sense, instead it should say “2GB libres de 3GB” (2GB free of 3GB). Free can be translated to either “libre” or “gratis”, libre is as in freedom, gratis is free as in beer. I can’t understand how the most popular reading device would have that kind of mistake in one of the most common languages in the world.
  - fireattack 6y ago
    Hah, "free" is often translated wrong into Chinese too for the same reason.
  - forrestconnors 6y ago
    They likely do i18n like other companies, and just outsource it to someone for cheap, and never fix translation errors.
- darepublic 6y ago
  Maybe these bugs involved English speaking devs copy and pasting out of spreadsheets.
rg2004 6y ago
Is it legal to start an auction to sell an exploit, never close on it, then use that as the price point to negotiate a bounty?
NiceWayToDoIT 6y ago
So, to summarize, you go to bank and you say "your back door is vulnerable can you check", instead of checking and giving you some kind of praise, they call police to beat the hell out of you... This is exactly sort of thing that will make community of white hackers stop caring, and leave open door to foreign agency malicious hackers to do as they please. I would like to know what was really going inside of their heads, was someone internally trying to steal the thunder, was it vanity/pride, was it lack of funds?!, was it fear?
- NiceWayToDoIT 6y ago
  By the way while reading this, I was expecting happy ending, something nice to start the day, but, alas, this is almost like a heavy Russian drama, starts with light tone and ends so depressive I would rather go back to bed crawling under the blanker and into fetal position.
- fouc 6y ago
  I think the issue was he went into the back door, and then found a key, and then started unlocking more doors. In other words, he used the initial bug to escalate access into their systems. Which is pretty obvious a no-no.
  - rrobukef 6y ago
    Why? He jimmied a lock. A bank should not use a padlock. He found a key and found a dead end... oh no, in the dusty closet there was another lost key. That one shouldn't be there... wait the old key opens everything? Oh no. Privilege escalation is explicitly allowed by facebook. He escalated.

201 points by tslocum 6y ago

Million dollar bug actually sounds like a small amount given the context!

Zee2 6y ago

God, this is frustrating. They essentially cracked Instagram's entire production environment open, and took explicit steps at every turn to stay within the published guidelines, and then they just take his report with zero compensation whatsoever. Insane.

hh3k0 6y ago
I wouldn't really blame the guy if he decides to sell the next one on the darknet.
- curryst 6y ago
  According to free market economics, this is exactly what should happen. Security researches sell their exploits on the dark web until bug bounties rise to the same or higher prices as the dark web will pay. It's crazy that they can find a bug that would cost Instagram 1M+, yet payouts are in the thousands or maybe tens of thousands if you're super lucky. I'm curious if it's illegal to sell exploits. Using them is obviously illegal, but is the transfer of knowledge for money illegal? I.e. I'm not allowed to build an M16, but presumably I could by the schematics for one if I wanted (I've never tried, but I can't imagine possession of them is illegal since they make posters of it and what not).
  - albntomat0 6y ago
    I honestly think this is what free market economics will get us, due to the high barriers to selling on the black market (ethically, legally, and logistically). The bug bounty targets with high payouts from the company line up roughly with the ones with high payouts on Zerodium etc. As I stated elsewhere in the thread, I'm not honestly convinced the fallout from a company being breached is that high, which leads to the current pricing for bug bounties. Twitter stock is massively up from when their incident happened in July. We'll see what happens with SolarWinds.
    - PradeetPatel 6y ago
      As someone who's not in the infosec/cyber industry, what exactly is Zerodium and why is it generally considered a suboptimal buyer?
      - albntomat0 6y ago
        Zerodium is one of several companies that buys exploits and sells them to governments. This route supposedly pays more than public bug bounties, but with different secrecy etc requirements.
    - lukeramsden 6y ago
      > I'm not honestly convinced the fallout from a company being breached is that high The market clearly doesn't care, and so neither do executives. What needs to happen is a household company gets exploited/hacked/pwned/whatever so hard that their entire business collapses, maybe not entirely but significantly. Then the market will price these breaches very differently.
  - tshaddox 6y ago
    That seems to depend on some very specific and unusual definition of "free market economics." Usually there is some unspecified assumption of rights (particularly property rights), and actions which violate those rights are not considered to be "free market" interactions. As an obvious example, if you creep around neighborhoods looking for people with valuable property that isn't well-secured against theft, then offer to sell a homeowner the information about the security problems you've discovered, and then sell that information to professional thieves if the homeowner declines, I don't think that would be "exactly what should happen according to free market economics."
- parliament32 6y ago
  Yup. Then you get things like the Twitter hack a few months ago where a bunch of celebrities were tweeting a crypto scam. I'd bet that wouldn't have happened if bug bounties were paid and reliable enough.
FriendlyNormie 6y ago
Imagine being that close to completely destroying one of the most evil companies on earth with a single keystroke and instead of doing that you fall to your knees and suck them off hoping for a pat on the head. Hell is real and I guarantee this guy is going there when he dies.
paulpauper 6y ago
but he didn't/ He only gained access because the admins used weak passwords .
AviationAtom 6y ago
Important rebuttal: https://web.archive.org/web/20151217232048/https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://web.archive.org/web/20151217232048/https://www.faceb...
fouc 6y ago
Technically he used the 1st bug to enter their systems and then escalate access through other security holes or bugs. That's not likely to be accepted by default by most companies. I would assume a default "do not escalate access" unless explicitly asked for.
- danielblank69 6y ago
  While I can see why that's the case - If a surface breach is patched, any other flaws that could be exploited won't be accessible to an attacker. On the other hand, software is built in layers. If there's an "inside" breach, i.e. I can get from an inner layer to a deeper layer, I would want to know about it. Facebook were idiots to structure their policy this way.

blakesterz 6y ago

I tried a little searching but I can't find anything that says how this all ended. Alex Stamos denied saying anything bad. But then what? It looks like it was all just dropped pretty much as is?

elliekelly 6y ago
> But then what? It looks like it was all just dropped pretty much as is? That usually means some money was exchanged and some NDAs were signed.
- danuker 6y ago
  Why would Facebook NDA paying a researcher? Shouldn't they be shouting it at the top of their lungs?
  - PradeetPatel 6y ago
    From my experience working in the PR and media industry, this NDA appears to serve a key purpose: It discourages engagements/discussions on social media platforms, thus hastening this incident into irrelevancy to mainstream media, thus protecting the brand reputation and key shareholders of FB. Security findings are never good for the share price. Therefore it is crucial for the company to take control of the narrative when possible.
  - yaur 6y ago
    From Facebook's POV the researcher behaved badly and rewarding that behavior without an NDA will encourage other researchers to behave badly.

TravisLS 6y ago

Previous discussion (5 years ago): https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194

wdr1 6y ago
Alex's response is no longer available. (His link to his Facebook post is dead.) Anyone have a mirror?
- darknavi 6y ago
  Here is a cached version on Wayback Machine: https://web.archive.org/web/20161218181922/https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://web.archive.org/web/20161218181922/https://www.faceb...

vittore 6y ago

Are there any means inside IG/FB to let engineers (or employees in general) hold company/managers accountable in cases like this?

thaumasiotes 6y ago

This speaks to a couple of issues that bothered me while working in bug bounty triage. > Alex informed my employer (as far as I am aware) that I had found a vulnerability, and had used it to access sensitive data. He then explained that the vulnerability I found was trivial and of little value, and at the same time said that my reporting and handling of the vulnerability submission had caused huge concern at Facebook. [my emphasis] There is this conceptual separation between the severity of the issue and the impact. Simplifying things much further than the situation described in the piece, you could have an admin account with the password "password". This is a stupid issue. The fix is to change the admin password. How much of a bounty should be paid for this report? One school of thought is that the value of the report is related to what you can accomplish by exploiting it. This is clearly the right approach if you're assessing the issue's value to an attacker. It has some problems in the bug bounty context -- a major one is that it feels subjectively unfair to the company! They don't want to pay 100x more for the same vulnerability just because, this time, it happened to have more sensitive stuff behind it. Another is that, as here, you often see a chain of vulnerabilities, all of which are of very little consequence in isolation, but they happen to combine into something much greater than the sum of the parts. (I recall a published writeup, which I can no longer find, in which one important step was a logout CSRF. Nobody cares about those.) The policy of "stop investigating as soon as you find anything" rules out this kind of "whole is greater than the sum of the parts" finding by definition. > Playing By The Rules > Microsoft (in my opinion), has done the best job of explaining exactly how far they would like a researcher to take a vulnerability. Google and Yahoo imply that you should report a vulnerability immediately, but do not clarify how far you should go in determinining impact. Tumblr, on the other hand, puts in writing the policy of just about every bounty program. The better your PoC shows impact, the more you are likely to get paid. Further, the better a researcher can understand and describe impact, the more likely they are to receive a greater reward. This bothers me from a fairness perspective. I have personally seen essentially the same report on different pages of a webapp get paid out differently because the researchers provided different speculation about what might be possible using their exploit. The guy who got paid less was careful about following the rules, asking for guidance about exactly what and how he could investigate, and then he only claimed what he was able to demonstrate. The guy who got paid more had a more generic claim that "this demonstrates SQLi, and writing to the database might be possible". I could not establish whether writing to the database was in fact possible for the same reason the first guy (and the second guy) didn't try -- it might have been unacceptably disruptive to the company. So I passed the speculation through, and the payout ended up being higher. The lesson here is, "claim the moon and the stars." But I feel that means the ecosystem is unhealthy; that's not what I think the lesson should be. Companies always say they will investigate the full impact of a vulnerability when you follow the protocol they urge of "as soon as you find something, report it and don't try to escalate". But this is nearly impossible to do even if you're trying in good faith. --- Sometimes you're not trying in good faith. I have also seen what is exactly the same issue paid out differently depending on the category the researcher files it under. Many programs publish payout schedules by category. In this case, the schedule contained a mix of technical category types ("XSS") and functional category types ("account takeover"). One researcher found a way to present an issue in a low-paying technical category as a high-paying functional category. I repeatedly noted in my reports to the company that this researcher was getting paid quite a lot more for the same vulnerability than other researchers who didn't know about the loophole. This state of affairs never changed; I assume the main concern was maintaining the relationship with the loophole guy. But obviously, this sort of thing directly falsifies the claim that "we will investigate the full impact of the issue you report and pay out appropriately."

typenil 6y ago

Ah nice. Facebook resorts to intimidating bug bounty participants acting in good faith by threatening them through their employer instead of talking. Can't say I'm surprised, given the level of ethics Facebook exhibits at every conceivable level.

LukasReschke 6y ago
Disclaimer: I was a Security Engineer on the FB Security Team until last month and was also involved in the Bug Bounty Program :-) That's not how Facebook treats Bug Bounty Participants. By far, it's one of the better programs in terms of payouts, fairness, and triage time on critical issues. Just a recent example: a bug bounty hunter reported unexpired CDN links. After internal research, FB figured out to chain this into a Remote Code Execution and paid out 80k USD to the researcher. (https://www.facebook.com/BugBounty/posts/approaching-the-10th-anniversary-of-our-bug-bounty-programby-dan-gurfinkel-secur/4087540111260184/ https://www.facebook.com/BugBounty/posts/approaching-the-10t...) That said, I wasn't there in 2015, so I only know the story from some stories. (which portray the story a tad different) - Even if it were true, I haven't seen such treatment in the last three years at FB.
- danuker 6y ago
  Fool me once, shame on you.
- oofbey 6y ago
  I think FB's greatest achievements is convincing their employees that their jobs are actually good for society, or at least neutral. Plenty of good people working there who seem honestly confused about how their jobs lead to so corruption and downfall of our society.
  - fnbr 6y ago
    Upton Sinclair got this right almost 100 years ago- “It is difficult to get a man to understand something, when his [RSUs depend] on his not understanding it.” Of course, I also work at a FAANG, so people in glass houses and all that...

deleted 6y ago

[deleted]

umvi 6y ago

Any closure on this? Did FB ever make amends? Surely there are some FB security employees on HN.

paxys 6y ago

This was discussed at length when it was first submitted here 5 years ago. The researcher found a (known) exploit, claimed $2500, then a month later used internal details he gathered (and saved) from the first exploit to breach the system further to demand a bigger payout.

spoonjim 6y ago
They didn't change the credentials that had been hacked? God I wish the hacker had sold the vuln to North Korea.
- paulpauper 6y ago
  Real life is not like the movies, in which a floppy disk of info is exchanged for a suitcase of money in a dark alley or in a boardroom. Blackhats typically find that there is little market for their info, especially before the advent of bitcoin being popular. yeah, you cracked a bunch of selfie pics. What can you do with it. not much.
  - chrissnell 6y ago
    He had signing keys for the Instagram app and the *.instagram.com keypair. Do you think that's not valuable and dangerous?
    - vuciv1 6y ago
      sorry, can you explain what the signing keys and keypair would allow someone to do?
      - dgrin91 6y ago
        Would allow you to make an app that steals all your info and release it as if it was the latest app from instagram.
        6y ago

paulpauper 6y ago

There is no real bug besides the ruby RCE thing. Cracking weak passwords is not eligible. Sorry. I can see why Facebook denied him a remittance but their approach of contacting his employer was wrong.

ufmace 6y ago
Not a "bug" in terms of incorrect code. But if I worked there, I'd sure like to know that 1. There were older versions of apps with config files stored in S3 that contained AWS keypairs for roles with wide open access 2. That such keypairs existed in the first place and were used on servers - probably no service role with such wide access should exist, and even if it did, it ought to be caught by routine audits for overpermissioned roles, and also old keypairs should be retired and rotated regularly 3. That a whole bunch of private key material basically encompassing the keys to the Instagram castle were stored in S3 buckets

paulpauper 6y ago

The problem with bug bounties is they are one-sided, against the researcher. The conditions of bounties typically stipulate that any attempt at negotiation can be interpreted as extortion, so it is either take it or leave it.

LukasReschke 6y ago
How else would you phrase someone telling you "I have this bug and will exploit it if you don't pay me X amount" vs. "I think the impact is bigger because of Y"? For me, the first sounds quite clearly like extortion. The first case would get you likely in trouble. The second case would routinely cause a further review in any decent program, and if there's any merit to it, you get a higher bounty. Nobody is forced to participate in any bug bounty program. If people feel the reward is too low, they should not partake.
- deeviant 6y ago
  > How else would you phrase someone telling you "I have this bug and will exploit it if you don't pay me X amount" Hello Strawman! > The second case would routinely cause a further review in any decent program We literally just read a example of how a big corp responds to #2. Do you think it was a 1 of?
  - LukasReschke 6y ago
    I was part of "big corp" for the past three years and was involved in many bug bounty reports. A reasonable claim like "I think this should be higher because XYZ" gets investigated and, if justified, higher bounties issued. This blog post seems a bit one-sided and doesn't correlate to the facts that I have heard. I wasn't there at the time being so I don't know the truth. But that blog post seems not quite 100% to be it. What I have seen, however, in the past years, is that some people omit facts or misrepresent things to get some press. So I am quite a cynic on blog posts like this :-)
    - albntomat0 6y ago

albntomat0 6y ago

(my comment is on the overall trend, as the specifics on this incident are complex) The issues with bug bounties as a whole is the market is skewed. For any work done by a bug bountier, there is exactly one legitimate buyer, who gets to make a significant judgement call on the value of the work done. Furthermore, this value is decided upon after the work has been completed, and has been provided to the company. In what other industries is this the case? Alternatively, triagers have a whole pile of crap to wade through, to get to the useful material. Furthermore, it really is hard to place an accurate monetary value on a bug that's responsibly reported, and patched. This is in part due to unclear monetary results from being breached. What precisely is the monetary loss from the recent MS Teams bug that was reported but not exploited vs the incidents this year at Twitter and SolarWinds? Having had some involvement in the bug bounty arena as a reporter, I have to say I'm a big fan of those companies that open up all of their reports after a fix period of time. This allows them to build trust with those who look into their products, and develop a reputation for being prompt and consistent.

arwhatever 6y ago
> Furthermore, this value is decided upon after the work has been completed, and has been provided to the company. In what other industries is this the case? Those "mail us your gold" ads on TV.
- underwater 6y ago
  Hospitals do this, but backwards. The service provider gets to set the price.
  - arcticbull 6y ago
    Basically only in America, though. Elsewhere the situation where someone gets into a car wreck, goes to hospital and then gets told how broke they are now just doesn't exist. In much of the rest of the world, the health system sets and publishes the rates - and guarantees payment to service providers. The doctors perform the services, and then submit for renumeration directly to the health system. The patients, well, they're sick and don't have to worry about any of it.

fireattack 6y ago

Off topic, but there is a bug on Instagram that has been bothered me for quite a while. On web (not sure about the app), if your language is Japanese, for any profile that has 0 following, it will show "Following: 0" as "フォロー中NaN人". A screenshot for the lazy: https://i.imgur.com/rTGXe3T.png https://i.imgur.com/rTGXe3T.png Of course this is a rather minor issue, but it still feels weird to me that one of the most popular website/service in the world would have this kind of bug live so long (and yes, I have reported it multiple times).

elboru 6y ago
My Kindle says “2GB gratis de 3GB” (in Spanish) which doesn’t make any sense, instead it should say “2GB libres de 3GB” (2GB free of 3GB). Free can be translated to either “libre” or “gratis”, libre is as in freedom, gratis is free as in beer. I can’t understand how the most popular reading device would have that kind of mistake in one of the most common languages in the world.
- fireattack 6y ago
  Hah, "free" is often translated wrong into Chinese too for the same reason.
- forrestconnors 6y ago
  They likely do i18n like other companies, and just outsource it to someone for cheap, and never fix translation errors.
darepublic 6y ago
Maybe these bugs involved English speaking devs copy and pasting out of spreadsheets.

rg2004 6y ago

Is it legal to start an auction to sell an exploit, never close on it, then use that as the price point to negotiate a bounty?

NiceWayToDoIT 6y ago

So, to summarize, you go to bank and you say "your back door is vulnerable can you check", instead of checking and giving you some kind of praise, they call police to beat the hell out of you... This is exactly sort of thing that will make community of white hackers stop caring, and leave open door to foreign agency malicious hackers to do as they please. I would like to know what was really going inside of their heads, was someone internally trying to steal the thunder, was it vanity/pride, was it lack of funds?!, was it fear?

NiceWayToDoIT 6y ago
By the way while reading this, I was expecting happy ending, something nice to start the day, but, alas, this is almost like a heavy Russian drama, starts with light tone and ends so depressive I would rather go back to bed crawling under the blanker and into fetal position.
fouc 6y ago
I think the issue was he went into the back door, and then found a key, and then started unlocking more doors. In other words, he used the initial bug to escalate access into their systems. Which is pretty obvious a no-no.
- rrobukef 6y ago
  Why? He jimmied a lock. A bank should not use a padlock. He found a key and found a dead end... oh no, in the dusty closet there was another lost key. That one shouldn't be there... wait the old key opens everything? Oh no. Privilege escalation is explicitly allowed by facebook. He escalated.