6 ms·

Note to security response teams everywhere: Not all vulnerability reporters speak perfect English, nor are they all experienced in writing up details on how to

by tshtf 13y ago

Note to security response teams everywhere: Not all vulnerability reporters speak perfect English, nor are they all experienced in writing up details on how to exploit issues. It is your responsibility to obtain details from reporters, after the initial report, to avoid situations like this. Facebook should give a bug bounty here, due to their lack of due diligence in following up with the initial responses.

Aqueous 13y ago
Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?
- future_grad 13y ago
  I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?
  - taspeotis 13y ago
    Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically. Here are I couple I found: http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247870.aspx http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247... http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...
    - mattmanser 13y ago
      Yeah, but look at what he says in the first link: Before contacting the submitter, we want to be sure that we weren't missing something, but after looking at it from every angle, we still couldn't see what the issue was. ...Stumped, we contacted the submitter. "From what we can tell, the call to system takes place before you call the LoadKeyboardLayout function. Can you elaborate on how this constitutes a vulnerability in the LoadKeyboardLayout function?"
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]
- loceng 13y ago
  Yeah, I wonder why the guy who said "This is not a bug." isn't actually the one getting in trouble. Clearly I understand why not - but then his actions lead to the person reporting to escalate their actions to get attention. If the "This is not a bug." guy actually helped guide the person reporting to the proper, expected actions, then this would have likely gone completely differently.
  - ajross 13y ago
    Surely that person is in trouble, or will be once the relevant bureaucracy gets back on Monday morning. This is just a huge embarassment, and exactly the opposite of proper security analysis. But no one is going to admit that externally until all the internal work has been done.
    - loceng 13y ago
      It's an assumption that they even care or are looking into it. So far the resulted outcome is they are blaming the guy who didn't follow "their rules" (that wouldn't likely have been clear to him due to a language barrier). This should hit mainstream media though - because if that kind of bug exists, what else exists that Facebook doesn't even know about, that's being taken advantage of?
616c 13y ago
And to go further, Facebook has an office in Dubai. [0] Are you telling me if language was not a barrier, they could not find a single Arabic-speaking employee? They could even save money on the collect calls, if Facebook was not an option. And hats off to Khaled. Hebron is not a fun place to grow up, and making it that far, a B.S. that is, is an accomplishment. I grew up with far more privilege and I am still not smart enough to come up with Facebook exploits. [0] https://www.facebook.com/careers/locations/dubai https://www.facebook.com/careers/locations/dubai
- negamax 13y ago
  Primary reason for Dubai office - 0% taxes
  - codeoclock 13y ago
    Secondary reason for Dubai office - "Business" Trips
    - wallzz 13y ago
      why there is no facebook location on Africa , this is racisme
    - homakov 13y ago
      "business" ? dubai ain't no fun
- skeptiskepti 13y ago
  Yes, right. The security team will ask the management to locate an Arabic speaking employee to handle a cryptic email, and do so for every email! That will surely scale. And employees love handling email exceptionally well.
faizanaziz 13y ago
First someone takes the pain of reporting a security flaw instead of exploiting it to help you out. Your answer - 'its not a bug its a feature'
1337biz 13y ago
What surprises me the most is how bad they are handling the incident! The behavior reflects that of a classic old and inflexible corporation that hides some details in their small prints to screw their customers over. It reflects incredibly bad on their relationship with the tech community and I am sure we will see some superficial backpedaling very soon.
- mbesto 13y ago
  > The behavior reflects that of a classic old and inflexible corporation that hides some details in their small prints to screw their customers over. You act as if corporations maliciously "screw their customers over". See the responses below and you'll see that in this specific case FB actually wins out when they pay more to their whitehats. I hate to single out your specific response, but it's comments like this (and the other 90% on this thread) that remind me how very few people on HN have experience with businesses at scale. classic old and inflexible corporation or let's just call them "enterprises" create policies so they can protect the highest number of cases available, but not all of them. It would be silly to think otherwise.
  - 1337biz 13y ago
    Yes, but it is exactly these kind of policies that let enterprises, corporations or organizations look bad. This is like getting PR advise from a lawyer when there is trouble coming your way. Sure, the lawyer will tell you to repeat "no comment" or deny any involvement over and over again. That might be the right strategy in a legal sense and work out fine when nobody is watching. But you are loosing in the court of public opinion when the public perceives your actions as unfair. And denying some kid a few hundred bucks even so he found a legit hack just because he didn't follow some proper corporate policy guideline does definitely reflect negatively on Facebook.
    - mbesto 13y ago
      > Yes, but it is exactly these kind of policies that let enterprises, corporations or organizations look bad. And what do you propose the alternative? A legalised document that outlines every "if this"-"then that", in every language, continent, dialect, etc.? You know how that story goes... > And denying some kid a few hundred bucks even so he found a legit hack just because he didn't follow some proper corporate policy guideline does definitely reflect negatively on Facebook. You know what makes Facebook look even more negative? The future precedence set when good-will hackers think it's OK to use a non-test account and drop the exploit on the CEO's page. I know it's hard for the HN community to do so, but let's try practicing some empathy with both sides before we pick up the pitchfork.
din12143 13y ago
Lets hope that OP doesn't have anymore security vulnerabilities in hand because if he do, FB will pay the price of not paying him for the first time :)

by tshtf 13y ago

Aqueous 13y ago

Yeah, what the hell were they doing responding "This is not a bug." without investigating or asking for more details? What the hell is the point of even responding to possible security alerts from the general public if you're not going to investigate?

future_grad 13y ago
I am curious to how many trash reports they have to sort through to identify real bug reports. Anyone care to comment?
- taspeotis 13y ago
  Microsoft sifts through bogus security reports all the time. Raymond Chen posts the best-of-the-worst periodically. Here are I couple I found: http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247870.aspx http://blogs.msdn.com/b/oldnewthing/archive/2011/12/15/10247... http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/80801...
  - mattmanser 13y ago
    Yeah, but look at what he says in the first link: Before contacting the submitter, we want to be sure that we weren't missing something, but after looking at it from every angle, we still couldn't see what the issue was. ...Stumped, we contacted the submitter. "From what we can tell, the call to system takes place before you call the LoadKeyboardLayout function. Can you elaborate on how this constitutes a vulnerability in the LoadKeyboardLayout function?"
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
loceng 13y ago
Yeah, I wonder why the guy who said "This is not a bug." isn't actually the one getting in trouble. Clearly I understand why not - but then his actions lead to the person reporting to escalate their actions to get attention. If the "This is not a bug." guy actually helped guide the person reporting to the proper, expected actions, then this would have likely gone completely differently.
- ajross 13y ago
  Surely that person is in trouble, or will be once the relevant bureaucracy gets back on Monday morning. This is just a huge embarassment, and exactly the opposite of proper security analysis. But no one is going to admit that externally until all the internal work has been done.
  - loceng 13y ago
    It's an assumption that they even care or are looking into it. So far the resulted outcome is they are blaming the guy who didn't follow "their rules" (that wouldn't likely have been clear to him due to a language barrier). This should hit mainstream media though - because if that kind of bug exists, what else exists that Facebook doesn't even know about, that's being taken advantage of?

616c 13y ago

And to go further, Facebook has an office in Dubai. [0] Are you telling me if language was not a barrier, they could not find a single Arabic-speaking employee? They could even save money on the collect calls, if Facebook was not an option. And hats off to Khaled. Hebron is not a fun place to grow up, and making it that far, a B.S. that is, is an accomplishment. I grew up with far more privilege and I am still not smart enough to come up with Facebook exploits. [0] https://www.facebook.com/careers/locations/dubai https://www.facebook.com/careers/locations/dubai

negamax 13y ago
Primary reason for Dubai office - 0% taxes
- codeoclock 13y ago
  Secondary reason for Dubai office - "Business" Trips
  - wallzz 13y ago
    why there is no facebook location on Africa , this is racisme
  - homakov 13y ago
    "business" ? dubai ain't no fun
skeptiskepti 13y ago
Yes, right. The security team will ask the management to locate an Arabic speaking employee to handle a cryptic email, and do so for every email! That will surely scale. And employees love handling email exceptionally well.

faizanaziz 13y ago

First someone takes the pain of reporting a security flaw instead of exploiting it to help you out. Your answer - 'its not a bug its a feature'

1337biz 13y ago

What surprises me the most is how bad they are handling the incident! The behavior reflects that of a classic old and inflexible corporation that hides some details in their small prints to screw their customers over. It reflects incredibly bad on their relationship with the tech community and I am sure we will see some superficial backpedaling very soon.

mbesto 13y ago
> The behavior reflects that of a classic old and inflexible corporation that hides some details in their small prints to screw their customers over. You act as if corporations maliciously "screw their customers over". See the responses below and you'll see that in this specific case FB actually wins out when they pay more to their whitehats. I hate to single out your specific response, but it's comments like this (and the other 90% on this thread) that remind me how very few people on HN have experience with businesses at scale. classic old and inflexible corporation or let's just call them "enterprises" create policies so they can protect the highest number of cases available, but not all of them. It would be silly to think otherwise.
- 1337biz 13y ago
  Yes, but it is exactly these kind of policies that let enterprises, corporations or organizations look bad. This is like getting PR advise from a lawyer when there is trouble coming your way. Sure, the lawyer will tell you to repeat "no comment" or deny any involvement over and over again. That might be the right strategy in a legal sense and work out fine when nobody is watching. But you are loosing in the court of public opinion when the public perceives your actions as unfair. And denying some kid a few hundred bucks even so he found a legit hack just because he didn't follow some proper corporate policy guideline does definitely reflect negatively on Facebook.
  - mbesto 13y ago
    > Yes, but it is exactly these kind of policies that let enterprises, corporations or organizations look bad. And what do you propose the alternative? A legalised document that outlines every "if this"-"then that", in every language, continent, dialect, etc.? You know how that story goes... > And denying some kid a few hundred bucks even so he found a legit hack just because he didn't follow some proper corporate policy guideline does definitely reflect negatively on Facebook. You know what makes Facebook look even more negative? The future precedence set when good-will hackers think it's OK to use a non-test account and drop the exploit on the CEO's page. I know it's hard for the HN community to do so, but let's try practicing some empathy with both sides before we pick up the pitchfork.

din12143 13y ago

Lets hope that OP doesn't have anymore security vulnerabilities in hand because if he do, FB will pay the price of not paying him for the first time :)