10 ms·

Facebook paid $4.5K for disclosure of my user account exploit

117 points by yvoschaap2 13y ago

general_failure 13y ago
I think many of the comments are just saying 'do not work for free. if you work for free, do not expect big rewards'. I have to agree with that. So, OP don't take it personally. All good work on your part but do not expect too much for free work. That's the way the world rolls.
skizm 13y ago
I'm not sure about the law in these situations. What happens if a hacker (right now let's not label them black or white hat just yet) decides to tell Facebook that hey know of an exploit which can gain access to anyone's account given an email address. This is a monumental bug, obviously. Is the hacker allowed to negotiate a price and then withhold the info if his demands are not met? Or is this against the law? I would guess as long as they doesn't use the exploit or sell it to some 3rd party (nefarious or otherwise) then they should be safe, right?
- tptacek 13y ago
  Nothing happens. He has the option of doing that. He can probably even use it as a negotiating tactic; without "force, violence, or fear", extortion probably doesn't come into the picture†, and my (IANAL) understanding is that courts read the "fear" thing narrowly, like, "fear or force or violence". What he probably can't do is threaten to sell the vulnerability to "black hats"; you can't threaten to commit a crime unless you're paid a protection fee. † Source: model jury instructions
yvoschaap2 13y ago
I posted a more detailed description of the exploit: http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays_45k_for_disclosure_of_my_complete/ca9ehfe http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays...
Sujan 13y ago
What's the point/argument of this article? That 4.5k is not enough money? (serious question, not hating)
- mischanix 13y ago
  The other market would pay orders of magnitude more for such an exploit.
  - tptacek 13y ago
    Do you know that or are you just assuming that there's an effective black market for all kinds of vulnerabilities, and not just drive-by clientsides?
    - mischanix 13y ago
      My bad, I didn't read further. I assumed this was server-side. After reading, 4.5k sounds right from Facebook, and while I'd imagine the other market price to be higher, I don't think it'd be above 3x, much less 10x, without something special (e.g. high-profile user data) accompanying it.
      - tptacek 13y ago
        It is serverside (most web app vulnerabilities are). I'm suggesting serversides are worth much less than clientsides.
        mischanix 13y ago
        What I meant is that the user needed to load a flash payload and be logged in properly. The data harvesting happens client-side. The vulnerability itself is server-side, yes, but computers are faster at copying data than engineers are at figuring out what's going wrong. The data you could potentially harvest with an exploit like this, given good planning and enough time to affect a large amount of people, is definitely worth quite a bit of money. This vulnerability could even have helped to make a very convincing phishing attack, which, again, properly executed, leads to very valuable data. It's not remote execution, but I still think it's valuable.
readme 13y ago
$4.5k for spec work isn't that bad. They could've paid $0. With that said, I keep my facebook account only for testing applications.
- amirmc 13y ago
  But perhaps now there's a signalling problem. If you find an exploit of a similar nature you can expect a mid-four figure sum from FB. Now if you're feeling less than white-hatty you can wonder how much more you can get elsewhere. It's easy to say that FB could have paid $0 but if people knew that, it would make "responsible disclosure" even less likely to happen.
  - readme 13y ago
    "Responsible disclosure" shouldn't be up to a financial incentive. It's up to the law and basic ethics. The real choice is between a 4.5k bonus or a subpoena. If you want to try the other path, go ahead....
    - crazypyro 13y ago
      Actually its a legal gray area. The prosecution would have to prove that you knew that you were selling to known criminals. This means you would have to sell to someone that literally told you what they are going to use it for.
      - readme 13y ago
        Interesting. I think we can agree the alternative is the wrong choice, though. Shouldn't have assumed the law was sound in this area... Given that it's not usually sound in any..
jrochkind1 13y ago
I think many people reading this get a sort of uncomfortable feeling thinking about 'white hat' security researchers receiving bounties for disclosure -- it sounds a bit like extortion, especially when people talk about "wondering how much more you can get elsewhere." But at the same time, the reality is that we're in somewhat of a security crisis. Businesses responsible for the security and privacy of our personal information and identities are clearly not in fact capable of protecting those on their own. (In part because it is a very hard task). They need help. And they're not going to get enough help purely from unpaid volunteers. In a more reasonable world, the government would have armies of 'white hat' hackers trying to find security holes (they surely do), and then _telling the effected about them_ (they definitely don't, they keep them instead for their own use). Because that would result in increased security for us all, isn't that in theory the mission of police agencies, increasing our security?
- tekacs 13y ago
  Unfortunately or fortunately, I think much of the world would disagree with you and argue that such behaviour would be 'meddling' and gross overstepping by the government, right now. Perhaps this sort of governmental 'help' would be possible in the future, but right now it seems that such behaviour would almost certainly result in cries that we had entered into a police state. :/ Edit: he notes that when he says 'we', you and I are almost certainly not in the same nation state. :P shrug
  - Retric 13y ago
    I don't see it a much different from the fire chef telling you how many people can occupy your building. FAA inspecting aircraft matence schedules, FDA inspecting a slughterhouse, the fed keeping track of a banks balancesheets or thousands of other areas where private companies interests are not aligned with the public.
    - taf2 13y ago
      There are and will be growing pains as this becomes reality... for example, there would be unintended consequences one might even imagine one such as: " you get fined for hosting ogv videos because they're deemed unsafe and the FCC decides you should be fined per video that is not an MPEG format... after all these unsafe video's hurt people real people " So, yeah the government could be a good vehicle for helping to secure our internet, but it could also have unintended consequences of preventing growth and innovation under the guise of "security" e.g "fear"
joetech 13y ago
$4.5k is decent. Were you expecting to get rich? There are contests where you can rake in much larger amounts, and you could make a killing forming a penetration team if money is the issue.
- yvoschaap2 13y ago
  Yes, 4,5k is decent. But put that in perspective of type of data and content Facebook exposed of its billion users. And personally if Facebook's says "no maximum reward" (https://www.facebook.com/whitehat https://www.facebook.com/whitehat) I was expecting something different for a complete account access exploit.
  - ceejayoz 13y ago
    The $4.5k is intended as a "thank you" card, not a paycheck.
  - msellout 13y ago
    Perhaps they didn't think it could be weaponized, so to speak. Accessing one account at a time isn't as big a deal as systematically accessing many accounts. Even if your exploit could do so, they may have safeguards against such robotic access.
minimax 13y ago
What is the actual black market value of an exploit like this? Is it in the realm of $4,500?
- tptacek 13y ago
  I think it's tricky to assess. There's a lot of support for the idea of high black-market prices for drive-by clientside remote code execution. Those vulnerabilities have a long half-life (because of the latency of patching) and maximal value to attackers (collect zombies, snarf payment card information, &c). Neither is true of website vulnerabilities. For a vulnerability that can be instantly eradicated, everywhere, as soon as the target finds out it exists? There might not be much of a market at all. (I don't know).
  - tinco 13y ago
    I think if you market this as a way into any private account, think celebrities, politicians, etc. You could catch quite a price if you wait for the right buyer. Think about what shady gossip newspapers pay paparazzi for breaking laws to get intimate pictures. In the right hands this exploit could be worth tons.
    - tptacek 13y ago
      If you say so. I'm sure somebody will buy anything. But the idea that there's an easily-tapped market for Facebook vulnerabilities, similar to the one for browser vulnerabilities? Like I said, I don't know. But I'm skeptical.
      - msellout 13y ago
        How would you sell the exploit? Your buyer would want to verify it works before buying, but then you've already given it away. It's not like you could enforce a contract on this.
        rcconf 13y ago
tptacek 13y ago
$4500 sounds about right for this vulnerability.
- calinet6 13y ago
  Sounds pretty generous, actually. They could have given nothing and he would have simply written a slightly more angry blog post; like they really care.
- waterside81 13y ago
  Since you're a security pro, why do you think this is the right amount? Because of the ease/difficulty in exploiting it? How much damage could have been done to FB's credibility if this guy had been malicious? I suppose it's damned if you do, damned if you don't.
  - tptacek 13y ago
    It's just about what Google pays for auth bypass on sensitive servers. "How much damage could have been done" doesn't really enter into the calculation. I'm not seeing how anyone's damned here.
    - deleted 13y ago
      [deleted]
- gbrindisi 13y ago
  Genuine question: how much would have you charged if facebook hired you to perform a pentest or a vuln assessment?
  - tptacek 13y ago
    The same as we charge everyone else? In fact, big companies often pay less, not more, since they can buy in bulk.
- CJefferson 13y ago
  In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.
ig1 13y ago
Churchill: "Madam, would you sleep with me for five million pounds?" Socialite: "My goodness, Mr. Churchill... Well, I suppose... we would have to discuss terms, of course... " Churchill: "Would you sleep with me for five pounds?" Socialite: "Mr. Churchill, what kind of woman do you think I am?!" Churchill: "Madam, we've already established that. Now we are haggling about the price” You're either a black/grey hat or a white hat. Either you're a white hat and believe selling to malicious hackers is fundamentally wrong and you wouldn't do it at any price, or you're a black hat waiting for the right price. The purpose of reward schemes is to reward white hats, not to compete with the bad guys for the black hat discoveries.
- droopyEyelids 13y ago
  Of course, your whole philosophy assumes everyone looks at the world in terms of Good Guys and Bad Guys, and has the same idea about who they are that you do.
  - imissmyjuno 13y ago
    Rather, his philosophy assumes that if you are a white hat you cannot be concerned about a reward. In reality white hats simply have enough moral compass to not place the exploit into wrong hands, which doesn't mean they don't care about a reward. By this rationale lawyers, for instance, should not be setting a price on their time when they believe defending a particular case will be doing a good Good Deed.
- shawabawa3 13y ago
  > Either you're a white hat and believe selling to malicious hackers is fundamentally wrong and you wouldn't do it at any price, or you're a black hat waiting for the right price. That sentence is such a false dichotomy it's hard for me to take you seriously. Is it evil to want to feel appreciated for your work? The message facebook is sending is that they honestly don't care if you find huge, potentially costly security holes in their software and go out of your way to let them no. edit: It seems from reading other comments $4500 is actually quite reasonable. I was basing my comment on the author saying it was a "paltry fee".
benjamincburns 13y ago
Pricing 101: Goal: Get as much as you can from the thing that you're selling. Purchase Negotiation 101: Goal: Pay as little as possible for the thing you're buying. To me what's funny about this is that if Facebook didn't pay the author at all, we probably wouldn't be reading this blog post right now.
ronaldx 13y ago
$4.5k is surely a small amount of money if they had employed someone to do this kind of work. However, since you the work was done for free the author had sunk the time and risked getting $0 for it. Even if the author is inclined to go black hat, there's a lot more (likely illegal) work to be done for author to extract value from it. As such, $4.5k is a good deal for the author - Facebook offered it knowing that and author accepted it knowing that. I don't think this remotely reflects Facebook's true value of privacy (although this admittedly may not be high). Facebook's only potential loss by making this offer is that it may make it slightly less likely for talented people to work externally on white hat exploits.
melvinmt 13y ago
It's very simple. If you had a certain price in mind, negotiate the price first, before delivering the service.
- SpikeGronim 13y ago
  IANAL, but saying "pay me because I have a 0day exploit against your business" is often construed as extortion. You can end up in jail for that. Consult your lawyer before negotiating like this.
Irregardless 13y ago
Less money = less incentive = fewer disclosures = less secure. Facebook is abusing the good will of white hats by offering such trivial sums, and they're reducing the security of their platform in the process. They have how many $100k+ engineers who couldn't find this? And how much does the average security breach cost per record, $100-$200? This exploit alone could have exposed them to millions in losses at that cost. This is what turns white hats into black hats, and I wouldn't blame the guy for selling his next exploit rather than disclosing it. A famous guy once said "we create our own demons". And then the guy in Iron Man 3 said it. And now I'm saying it.
- khafra 13y ago
  On the other hand, I feel significantly more secure on facebook than on paypal.
- tptacek 13y ago
  "Trivial sums"? This is squarely in line with what Google pays for vulnerabilities. Who is paying drastically more for website flaws? And, because you think the thank-you Facebook offered was too low, you wouldn't blame him for selling vulnerabilities to criminals? Really? Selling vulnerabilities to criminals is itself a crime.
  - napoleond 13y ago
    Selling vulnerabilities to criminals is itself a crime. 'daeken seems to disagree with you[0]. Is he correct, or is the "to [proven] criminals" in your statement important? 0. https://news.ycombinator.com/item?id=5799382 https://news.ycombinator.com/item?id=5799382
    - tptacek 13y ago
      Simply selling vulnerabilities isn't criminal (it's a bit of a grey area, but if I didn't have ethical issues with the practice, it's so far onto the "safe" edge of the spectrum that I'd be fine with assuming the risk.) Selling vulnerabilities to people you know to be criminals, or to people a prosecutor can convince a jury a reasonable person would have known to be criminal, probably is a crime.
vinhboy 13y ago
These bounties should be thought of more as an "award" than a "reward". In this case, the author has received a great honor for his cleverness.
cadab 13y ago
I've been paid as part of their white hat program, $4.5k doesnt seem that high compared to what i was paid for my 'exploit'. I picked up $1k for finding a bug in their event invitations, a user could add friends to a private event when using a mobile phone. The fact that his exploit was getting actual private data from people, i'd of thought he'd of been paid more. Thats not to say $4.5k isnt a lot of money, its a very nice reward.
epenn 13y ago
...intrigued by the bold sentence on Facebook's security researcher page "There is no maximum reward" I went out and started giving Facebook's code another peak. I'm not surprised that you feel this wasn't enough since it appears the reward is your motivation for finding an exploit in the first place. The reward shouldn't be viewed as payment for services rendered, but rather as a gesture of good will for performing your duty of responsible disclosure. Without the disclosure of whitehat hackers, like I did, these exploits can also become available to dubious parties who could wreak (digital) havoc. If you are truly a white hat then you aren't motivated by money. You are principally motivated by wanting to make the world a better, safer place. Since you're well-versed in computer security, that motivation will propel you to apply that knowledge to the web (or really to any vulnerability) when the opportunity presents itself. If the reward is your motivation then at best this makes you a grey hat. You did the right thing, but for the wrong reasons. Note that for the following I'm not saying you personally will necessarily do this; but it would be easy from that position to start treating the group of people who you're willing to disclose a vulnerability to as a marketplace. Facebook will pay $4,500? Fair enough. L33tBotNetHaxz0r will pay $20,000? Done. If you're someone who possesses the skill to discover security vulnerabilities, I think it's important to think through what your real motivations are. Is it for the rush capturing the flag? Is it for the money? Is it to help people? Your actions can affect many, so act wisely. Edit: I should clarify that I mean that money can't be the principal motivation for a white hat hacker. I believe it's fine as a secondary motivation. I give an example in another comment below.
- deleted 13y ago
  [deleted]
- jonahx 13y ago
  >If you are truly a white hat then you aren't motivated by money Says who? People who would never commit a criminal cyber-act are still allowed to care about money.
  - epenn 13y ago
    I never said they weren't allowed to care about money in general; only that it shouldn't be their primary motivation for disclosing a security vulnerability. Even if it is, I'm not saying that makes them a bad person either; only that they can't use the white hat label as the author did in my second quote.
maddddddddddddd 13y ago
#FUCKAZUCK
Gobitron 13y ago
Much of the conversation here centers around the value of reporting to Facebook vs. selling to black hat. This is the wrong paradigm to view this issue through. Taking the view that selling to blackhats is ALWAYS wrong, it may still make sense for Facebook to pay significantly more to find vulnerabilities in their system. A less vulnerable system is one with a competitive advantage, and I think Facebook is missing an opportunity to tout their security credentials. Let's take a back of the envelope calculation. Say instead of $4,500, they paid each of the 66 people who submitted a vulnerability $50,000. And since we're not halfway through 2013 yet, let's assume that in total 150 people will submit valid security holes to FB this year. That's $7.5 million dollars paid out. Now, once word of a $50k payout gets out, say 10x the number of people try to find vulnerabilities, and the success rate increases linearly. So Facebook pays $75 million a year. What are the benefits of this program? I'd say you get a few major benefits vs. the current situation: 1. You will definitely convert some blackhats away from exploiting FB data in exchange for $50k legally obtained 2. You convert a lot of people currently looking for security exploits in Google, Amazon, etc... to searching for FB vulnerabilities. 3. As a result you have a much more secure platform. 4. You can leverage these payments through media and PR to legitimately show that you care about security. 5. You combat competitors by touting a more secure platform. $75 million is not small change when you look at FB's operating income, but it's not going to break the bank either. The point is that it may well be a rational decision on FB's part to offer significantly more and it has nothing to do with the black hat market value of the exploit.
- pkfrank 13y ago
  This assumes a linear relationship between (Bounty for vulnerabilities) :: (Identified outstanding vulnerabilities) Presumably, one would see diminishing returns in the ability to find "low hanging fruit" exploits, and thus the economics @ a $50k pay-out would be even more attractive for Facebook.
  - kbenson 13y ago
    It's a market. As the vulnerabilities become harder to find, Facebook will have to increase the payout to continue to find takers, if they view it as a worthwhile investment (they may decide that since vulnerabilities are harder to find the program has less merit, which I would disagree with).
mag00 13y ago
Hi - I built Facebook's Bug Bounty program with a few other FB folks. There's a couple things I want to add to the conversation about how we look at rewards. (Also, in 2009 it was just myself and a couple others running our disclosure program. It wasn't even bounties at that point. We'll get you a shirt, you can pretty much just blame me for that.) 1. We don't compete with the bug market, so our rewards will not look like market prices. It's true that "Bad Guys" would pay enormous amounts for a bug. They also pay a premium for the criminal risk being taken, and for the opportunity to exploit it which will theoretically make them a lot of money. However, we're good guys and we don't plan on profiting from bugs. 2. You, the researcher, are safe to post and talk about the vulnerability you found when Facebook is held to the disclosure policy. If your bug is extra-awesome, we'll sometimes send a bunch of reader traffic your way from our bug bounty page. This has shown to be worth a lot to researchers. Several of our bounty hunters have started companies, gotten jobs, became internet famous from this program and value this more than any bounty. 3. We are pretty lenient on what qualifies as a bug, which means we have a higher volume of payments to researchers than you might expect. If a researcher showed amazing skill in finding something that didn't actually turn out to be a bug, we'll probably reward them anyway because we want them to keep trying. We are pretty lenient on duplicates as well. If we see that someone truly discovered a bug independently (and also showed significant skill discovering it) then they'll probably get a reward too. The theory here is that we want more responsible disclosures instead of pissed off researchers. Overall I don't want to argue with the amount we rewarded here, but show that we're doing a lot of stuff that's benefiting a lot of researchers. We're one of the first companies to launch a bounty program, and most of the researchers you have listed would probably say they think we're doing pretty well. Not too many companies have a bug bounty program, and I'm really proud of ours! :)

117 points by yvoschaap2 13y ago

I think many of the comments are just saying 'do not work for free. if you work for free, do not expect big rewards'. I have to agree with that. So, OP don't take it personally. All good work on your part but do not expect too much for free work. That's the way the world rolls.

skizm 13y ago

I'm not sure about the law in these situations. What happens if a hacker (right now let's not label them black or white hat just yet) decides to tell Facebook that hey know of an exploit which can gain access to anyone's account given an email address. This is a monumental bug, obviously. Is the hacker allowed to negotiate a price and then withhold the info if his demands are not met? Or is this against the law? I would guess as long as they doesn't use the exploit or sell it to some 3rd party (nefarious or otherwise) then they should be safe, right?

tptacek 13y ago
Nothing happens. He has the option of doing that. He can probably even use it as a negotiating tactic; without "force, violence, or fear", extortion probably doesn't come into the picture†, and my (IANAL) understanding is that courts read the "fear" thing narrowly, like, "fear or force or violence". What he probably can't do is threaten to sell the vulnerability to "black hats"; you can't threaten to commit a crime unless you're paid a protection fee. † Source: model jury instructions

yvoschaap2 13y ago

I posted a more detailed description of the exploit: http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays_45k_for_disclosure_of_my_complete/ca9ehfe http://www.reddit.com/r/netsec/comments/1fe9mj/facebook_pays...

Sujan 13y ago

What's the point/argument of this article? That 4.5k is not enough money? (serious question, not hating)

mischanix 13y ago
The other market would pay orders of magnitude more for such an exploit.
- tptacek 13y ago
  Do you know that or are you just assuming that there's an effective black market for all kinds of vulnerabilities, and not just drive-by clientsides?
  - mischanix 13y ago
    My bad, I didn't read further. I assumed this was server-side. After reading, 4.5k sounds right from Facebook, and while I'd imagine the other market price to be higher, I don't think it'd be above 3x, much less 10x, without something special (e.g. high-profile user data) accompanying it.
    - tptacek 13y ago
      It is serverside (most web app vulnerabilities are). I'm suggesting serversides are worth much less than clientsides.
      - mischanix 13y ago
        What I meant is that the user needed to load a flash payload and be logged in properly. The data harvesting happens client-side. The vulnerability itself is server-side, yes, but computers are faster at copying data than engineers are at figuring out what's going wrong. The data you could potentially harvest with an exploit like this, given good planning and enough time to affect a large amount of people, is definitely worth quite a bit of money. This vulnerability could even have helped to make a very convincing phishing attack, which, again, properly executed, leads to very valuable data. It's not remote execution, but I still think it's valuable.

readme 13y ago

$4.5k for spec work isn't that bad. They could've paid $0. With that said, I keep my facebook account only for testing applications.

amirmc 13y ago
But perhaps now there's a signalling problem. If you find an exploit of a similar nature you can expect a mid-four figure sum from FB. Now if you're feeling less than white-hatty you can wonder how much more you can get elsewhere. It's easy to say that FB could have paid $0 but if people knew that, it would make "responsible disclosure" even less likely to happen.
- readme 13y ago
  "Responsible disclosure" shouldn't be up to a financial incentive. It's up to the law and basic ethics. The real choice is between a 4.5k bonus or a subpoena. If you want to try the other path, go ahead....
  - crazypyro 13y ago
    Actually its a legal gray area. The prosecution would have to prove that you knew that you were selling to known criminals. This means you would have to sell to someone that literally told you what they are going to use it for.
    - readme 13y ago
      Interesting. I think we can agree the alternative is the wrong choice, though. Shouldn't have assumed the law was sound in this area... Given that it's not usually sound in any..

jrochkind1 13y ago

I think many people reading this get a sort of uncomfortable feeling thinking about 'white hat' security researchers receiving bounties for disclosure -- it sounds a bit like extortion, especially when people talk about "wondering how much more you can get elsewhere." But at the same time, the reality is that we're in somewhat of a security crisis. Businesses responsible for the security and privacy of our personal information and identities are clearly not in fact capable of protecting those on their own. (In part because it is a very hard task). They need help. And they're not going to get enough help purely from unpaid volunteers. In a more reasonable world, the government would have armies of 'white hat' hackers trying to find security holes (they surely do), and then _telling the effected about them_ (they definitely don't, they keep them instead for their own use). Because that would result in increased security for us all, isn't that in theory the mission of police agencies, increasing our security?

tekacs 13y ago
Unfortunately or fortunately, I think much of the world would disagree with you and argue that such behaviour would be 'meddling' and gross overstepping by the government, right now. Perhaps this sort of governmental 'help' would be possible in the future, but right now it seems that such behaviour would almost certainly result in cries that we had entered into a police state. :/ Edit: he notes that when he says 'we', you and I are almost certainly not in the same nation state. :P shrug
- Retric 13y ago
  I don't see it a much different from the fire chef telling you how many people can occupy your building. FAA inspecting aircraft matence schedules, FDA inspecting a slughterhouse, the fed keeping track of a banks balancesheets or thousands of other areas where private companies interests are not aligned with the public.
  - taf2 13y ago
    There are and will be growing pains as this becomes reality... for example, there would be unintended consequences one might even imagine one such as: " you get fined for hosting ogv videos because they're deemed unsafe and the FCC decides you should be fined per video that is not an MPEG format... after all these unsafe video's hurt people real people " So, yeah the government could be a good vehicle for helping to secure our internet, but it could also have unintended consequences of preventing growth and innovation under the guise of "security" e.g "fear"

joetech 13y ago

$4.5k is decent. Were you expecting to get rich? There are contests where you can rake in much larger amounts, and you could make a killing forming a penetration team if money is the issue.

yvoschaap2 13y ago
Yes, 4,5k is decent. But put that in perspective of type of data and content Facebook exposed of its billion users. And personally if Facebook's says "no maximum reward" (https://www.facebook.com/whitehat https://www.facebook.com/whitehat) I was expecting something different for a complete account access exploit.
- ceejayoz 13y ago
  The $4.5k is intended as a "thank you" card, not a paycheck.
- msellout 13y ago
  Perhaps they didn't think it could be weaponized, so to speak. Accessing one account at a time isn't as big a deal as systematically accessing many accounts. Even if your exploit could do so, they may have safeguards against such robotic access.

minimax 13y ago

What is the actual black market value of an exploit like this? Is it in the realm of $4,500?

tptacek 13y ago
I think it's tricky to assess. There's a lot of support for the idea of high black-market prices for drive-by clientside remote code execution. Those vulnerabilities have a long half-life (because of the latency of patching) and maximal value to attackers (collect zombies, snarf payment card information, &c). Neither is true of website vulnerabilities. For a vulnerability that can be instantly eradicated, everywhere, as soon as the target finds out it exists? There might not be much of a market at all. (I don't know).
- tinco 13y ago
  I think if you market this as a way into any private account, think celebrities, politicians, etc. You could catch quite a price if you wait for the right buyer. Think about what shady gossip newspapers pay paparazzi for breaking laws to get intimate pictures. In the right hands this exploit could be worth tons.
  - tptacek 13y ago
    If you say so. I'm sure somebody will buy anything. But the idea that there's an easily-tapped market for Facebook vulnerabilities, similar to the one for browser vulnerabilities? Like I said, I don't know. But I'm skeptical.
    - msellout 13y ago
      How would you sell the exploit? Your buyer would want to verify it works before buying, but then you've already given it away. It's not like you could enforce a contract on this.
      - rcconf 13y ago

tptacek 13y ago

$4500 sounds about right for this vulnerability.

calinet6 13y ago
Sounds pretty generous, actually. They could have given nothing and he would have simply written a slightly more angry blog post; like they really care.
waterside81 13y ago
Since you're a security pro, why do you think this is the right amount? Because of the ease/difficulty in exploiting it? How much damage could have been done to FB's credibility if this guy had been malicious? I suppose it's damned if you do, damned if you don't.
- tptacek 13y ago
  It's just about what Google pays for auth bypass on sensitive servers. "How much damage could have been done" doesn't really enter into the calculation. I'm not seeing how anyone's damned here.
  - deleted 13y ago
    [deleted]
gbrindisi 13y ago
Genuine question: how much would have you charged if facebook hired you to perform a pentest or a vuln assessment?
- tptacek 13y ago
  The same as we charge everyone else? In fact, big companies often pay less, not more, since they can buy in bulk.
CJefferson 13y ago
In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.

ig1 13y ago

Churchill: "Madam, would you sleep with me for five million pounds?" Socialite: "My goodness, Mr. Churchill... Well, I suppose... we would have to discuss terms, of course... " Churchill: "Would you sleep with me for five pounds?" Socialite: "Mr. Churchill, what kind of woman do you think I am?!" Churchill: "Madam, we've already established that. Now we are haggling about the price” You're either a black/grey hat or a white hat. Either you're a white hat and believe selling to malicious hackers is fundamentally wrong and you wouldn't do it at any price, or you're a black hat waiting for the right price. The purpose of reward schemes is to reward white hats, not to compete with the bad guys for the black hat discoveries.

droopyEyelids 13y ago
Of course, your whole philosophy assumes everyone looks at the world in terms of Good Guys and Bad Guys, and has the same idea about who they are that you do.
- imissmyjuno 13y ago
  Rather, his philosophy assumes that if you are a white hat you cannot be concerned about a reward. In reality white hats simply have enough moral compass to not place the exploit into wrong hands, which doesn't mean they don't care about a reward. By this rationale lawyers, for instance, should not be setting a price on their time when they believe defending a particular case will be doing a good Good Deed.
shawabawa3 13y ago
> Either you're a white hat and believe selling to malicious hackers is fundamentally wrong and you wouldn't do it at any price, or you're a black hat waiting for the right price. That sentence is such a false dichotomy it's hard for me to take you seriously. Is it evil to want to feel appreciated for your work? The message facebook is sending is that they honestly don't care if you find huge, potentially costly security holes in their software and go out of your way to let them no. edit: It seems from reading other comments $4500 is actually quite reasonable. I was basing my comment on the author saying it was a "paltry fee".

benjamincburns 13y ago

Pricing 101: Goal: Get as much as you can from the thing that you're selling. Purchase Negotiation 101: Goal: Pay as little as possible for the thing you're buying. To me what's funny about this is that if Facebook didn't pay the author at all, we probably wouldn't be reading this blog post right now.

ronaldx 13y ago

$4.5k is surely a small amount of money if they had employed someone to do this kind of work. However, since you the work was done for free the author had sunk the time and risked getting $0 for it. Even if the author is inclined to go black hat, there's a lot more (likely illegal) work to be done for author to extract value from it. As such, $4.5k is a good deal for the author - Facebook offered it knowing that and author accepted it knowing that. I don't think this remotely reflects Facebook's true value of privacy (although this admittedly may not be high). Facebook's only potential loss by making this offer is that it may make it slightly less likely for talented people to work externally on white hat exploits.

melvinmt 13y ago

It's very simple. If you had a certain price in mind, negotiate the price first, before delivering the service.

SpikeGronim 13y ago
IANAL, but saying "pay me because I have a 0day exploit against your business" is often construed as extortion. You can end up in jail for that. Consult your lawyer before negotiating like this.

Irregardless 13y ago

Less money = less incentive = fewer disclosures = less secure. Facebook is abusing the good will of white hats by offering such trivial sums, and they're reducing the security of their platform in the process. They have how many $100k+ engineers who couldn't find this? And how much does the average security breach cost per record, $100-$200? This exploit alone could have exposed them to millions in losses at that cost. This is what turns white hats into black hats, and I wouldn't blame the guy for selling his next exploit rather than disclosing it. A famous guy once said "we create our own demons". And then the guy in Iron Man 3 said it. And now I'm saying it.

khafra 13y ago
On the other hand, I feel significantly more secure on facebook than on paypal.
tptacek 13y ago
"Trivial sums"? This is squarely in line with what Google pays for vulnerabilities. Who is paying drastically more for website flaws? And, because you think the thank-you Facebook offered was too low, you wouldn't blame him for selling vulnerabilities to criminals? Really? Selling vulnerabilities to criminals is itself a crime.
- napoleond 13y ago
  Selling vulnerabilities to criminals is itself a crime. 'daeken seems to disagree with you[0]. Is he correct, or is the "to [proven] criminals" in your statement important? 0. https://news.ycombinator.com/item?id=5799382 https://news.ycombinator.com/item?id=5799382
  - tptacek 13y ago
    Simply selling vulnerabilities isn't criminal (it's a bit of a grey area, but if I didn't have ethical issues with the practice, it's so far onto the "safe" edge of the spectrum that I'd be fine with assuming the risk.) Selling vulnerabilities to people you know to be criminals, or to people a prosecutor can convince a jury a reasonable person would have known to be criminal, probably is a crime.

vinhboy 13y ago

These bounties should be thought of more as an "award" than a "reward". In this case, the author has received a great honor for his cleverness.

cadab 13y ago

I've been paid as part of their white hat program, $4.5k doesnt seem that high compared to what i was paid for my 'exploit'. I picked up $1k for finding a bug in their event invitations, a user could add friends to a private event when using a mobile phone. The fact that his exploit was getting actual private data from people, i'd of thought he'd of been paid more. Thats not to say $4.5k isnt a lot of money, its a very nice reward.

epenn 13y ago

...intrigued by the bold sentence on Facebook's security researcher page "There is no maximum reward" I went out and started giving Facebook's code another peak. I'm not surprised that you feel this wasn't enough since it appears the reward is your motivation for finding an exploit in the first place. The reward shouldn't be viewed as payment for services rendered, but rather as a gesture of good will for performing your duty of responsible disclosure. Without the disclosure of whitehat hackers, like I did, these exploits can also become available to dubious parties who could wreak (digital) havoc. If you are truly a white hat then you aren't motivated by money. You are principally motivated by wanting to make the world a better, safer place. Since you're well-versed in computer security, that motivation will propel you to apply that knowledge to the web (or really to any vulnerability) when the opportunity presents itself. If the reward is your motivation then at best this makes you a grey hat. You did the right thing, but for the wrong reasons. Note that for the following I'm not saying you personally will necessarily do this; but it would be easy from that position to start treating the group of people who you're willing to disclose a vulnerability to as a marketplace. Facebook will pay $4,500? Fair enough. L33tBotNetHaxz0r will pay $20,000? Done. If you're someone who possesses the skill to discover security vulnerabilities, I think it's important to think through what your real motivations are. Is it for the rush capturing the flag? Is it for the money? Is it to help people? Your actions can affect many, so act wisely. Edit: I should clarify that I mean that money can't be the principal motivation for a white hat hacker. I believe it's fine as a secondary motivation. I give an example in another comment below.

deleted 13y ago
[deleted]
jonahx 13y ago
>If you are truly a white hat then you aren't motivated by money Says who? People who would never commit a criminal cyber-act are still allowed to care about money.
- epenn 13y ago
  I never said they weren't allowed to care about money in general; only that it shouldn't be their primary motivation for disclosing a security vulnerability. Even if it is, I'm not saying that makes them a bad person either; only that they can't use the white hat label as the author did in my second quote.

maddddddddddddd 13y ago

#FUCKAZUCK

Gobitron 13y ago

Much of the conversation here centers around the value of reporting to Facebook vs. selling to black hat. This is the wrong paradigm to view this issue through. Taking the view that selling to blackhats is ALWAYS wrong, it may still make sense for Facebook to pay significantly more to find vulnerabilities in their system. A less vulnerable system is one with a competitive advantage, and I think Facebook is missing an opportunity to tout their security credentials. Let's take a back of the envelope calculation. Say instead of $4,500, they paid each of the 66 people who submitted a vulnerability $50,000. And since we're not halfway through 2013 yet, let's assume that in total 150 people will submit valid security holes to FB this year. That's $7.5 million dollars paid out. Now, once word of a $50k payout gets out, say 10x the number of people try to find vulnerabilities, and the success rate increases linearly. So Facebook pays $75 million a year. What are the benefits of this program? I'd say you get a few major benefits vs. the current situation: 1. You will definitely convert some blackhats away from exploiting FB data in exchange for $50k legally obtained 2. You convert a lot of people currently looking for security exploits in Google, Amazon, etc... to searching for FB vulnerabilities. 3. As a result you have a much more secure platform. 4. You can leverage these payments through media and PR to legitimately show that you care about security. 5. You combat competitors by touting a more secure platform. $75 million is not small change when you look at FB's operating income, but it's not going to break the bank either. The point is that it may well be a rational decision on FB's part to offer significantly more and it has nothing to do with the black hat market value of the exploit.

pkfrank 13y ago
This assumes a linear relationship between (Bounty for vulnerabilities) :: (Identified outstanding vulnerabilities) Presumably, one would see diminishing returns in the ability to find "low hanging fruit" exploits, and thus the economics @ a $50k pay-out would be even more attractive for Facebook.
- kbenson 13y ago
  It's a market. As the vulnerabilities become harder to find, Facebook will have to increase the payout to continue to find takers, if they view it as a worthwhile investment (they may decide that since vulnerabilities are harder to find the program has less merit, which I would disagree with).

mag00 13y ago

Hi - I built Facebook's Bug Bounty program with a few other FB folks. There's a couple things I want to add to the conversation about how we look at rewards. (Also, in 2009 it was just myself and a couple others running our disclosure program. It wasn't even bounties at that point. We'll get you a shirt, you can pretty much just blame me for that.) 1. We don't compete with the bug market, so our rewards will not look like market prices. It's true that "Bad Guys" would pay enormous amounts for a bug. They also pay a premium for the criminal risk being taken, and for the opportunity to exploit it which will theoretically make them a lot of money. However, we're good guys and we don't plan on profiting from bugs. 2. You, the researcher, are safe to post and talk about the vulnerability you found when Facebook is held to the disclosure policy. If your bug is extra-awesome, we'll sometimes send a bunch of reader traffic your way from our bug bounty page. This has shown to be worth a lot to researchers. Several of our bounty hunters have started companies, gotten jobs, became internet famous from this program and value this more than any bounty. 3. We are pretty lenient on what qualifies as a bug, which means we have a higher volume of payments to researchers than you might expect. If a researcher showed amazing skill in finding something that didn't actually turn out to be a bug, we'll probably reward them anyway because we want them to keep trying. We are pretty lenient on duplicates as well. If we see that someone truly discovered a bug independently (and also showed significant skill discovering it) then they'll probably get a reward too. The theory here is that we want more responsible disclosures instead of pissed off researchers. Overall I don't want to argue with the amount we rewarded here, but show that we're doing a lot of stuff that's benefiting a lot of researchers. We're one of the first companies to launch a bounty program, and most of the researchers you have listed would probably say they think we're doing pretty well. Not too many companies have a bug bounty program, and I'm really proud of ours! :)