5 ms·
> The dude's in high school and finds stuff like this? As someone who once got a $500 bug bounty from Facebook in high school, I'll have to say that this is no
by judofyr 6y ago
> The dude's in high school and finds stuff like this?
As someone who once got a $500 bug bounty from Facebook in high school, I'll have to say that this is not so surprising. Finding these bugs is 10% knowing about attack vectors (CSRF, XSS etc.) and 90% spending time trying them out in various forms in all the places you can think of. In school (especially if you're already doing well there) you often have lots of spare time and not so many others way of earning money. And with just a few years of experience with programming/computers there are far quicker ways to earn money.
It's still super impressive work by the author of course!! They are extremely talented! I'm not trying to dismiss what they accomplished; just commenting on the strange dynamic of software security research.
- vmception 6y agoAlso its worth considering that all these applications get updated like every week, so something that was ruled out in the past can be exploitable now.
- paulpauper 6y agoThis is not just finding bugs but coding and dev., work. I too found bugs in fakebook but they never paid me, but they did fix them.
- ipaddr 6y agoI found many bugs over the years. Never reported any and they were available when I needed them later. Disclosing sounds like a good idea until you realize they hold all of the power. You tell them something is broken they fix it and they get to decide if they want to pay you and how much. The holes into private photos remained open for years. I'm glad no one disclosed.
- montenegrohugo 6y agoJust to clarify: you exploited said hole to access private photos of other people without their consent or knowledge?
- ipaddr 6y agoWhat agreement they had with facebook I am unaware of. But facebook seemed to treat them as public. Facebook and access have always been confusing and this is setup on purpose. Some photos show up in feeds some are available to other group members. Photos you think are private are private until someone else you know is tagged in them.
- deleted 6y ago[deleted]
- breakingcups 6y agoI not only have an ethical issue with what you just said, I also question the wisdom in disclosing your illegal activities on a public forum.
- megous 6y agoFinding a bug and not reporting it is not illegal. The rest is assumptions.
- ipaddr 6y agoI wouldn't assume illegal activities occurred. Did you know facebook had an easy to access search feature for key employees to view anyone's private profile. All very legal. As for the ethnical issues. I'm not sure I buy in. At one point typing profilename/photos showed you everyones albums private or not with a small picture. You needed access to go further. That's more of a facebook design decision. At least one private photo and the any album name were purposely not private.
- MattSayar 6y agoPlus just being curious. I once found an exploit in a large IAM vendor's multifactor auth flow by just playing around with the Inspect tool in my browser. I told my customer success manager and they fixed it. Too bad there was no bounty :(
- vxNsr 6y agoThe bounty was you not having to deal the someone else exploiting it and your org having to deal with the fall out.