7 ms·

I applaud him for his expertise and finding the bug but here are some points Ḱhalil: - You violated Facebook's terms of service by exploiting the bug on Sarah'

• s_q_b 13y ago
  The author clearly has a language barrier. Not all bug reports are going to come with sterling reports to back them. In the end, Ḱhalil fell back on the lingua franca of the internet: a working demonstration. The onus is on the organization, not the bug reporter, to vet the information. From what I see, there was more than enough in the report to conclude there was a problem, and follow up. If Facebook security fails in coding the application, in QR, and when a user files a bug report, it is awfully hard to place the blame with the bug reporter.
  • ressaid1 13y ago
    I agree, and in the end, they finally broke the language barrier and comprehended the bug which I am sure they are working on fixing. They were able to get all the benefit of his work, why screw him on a measly little bounty?
  • dylangs1030 13y ago
    This isn't a good summary of the events. His "lingua franca" is technically illegal, and violates Facebook's explicit and easily accessible Terms of Service. There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention. He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report. Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.
    • avalaunch 13y ago
      In another thread it was mentioned that the terms of service aren't available in Arabic.
      • borplk 13y ago
        I believe that was referring to the terms of service of the whitehat program not Facebook's TOS itself.
        • avalaunch 13y ago
          Aren't the whitehat term's of service those that were talking about? They're the most relevant terms to this discussion.
      • dylangs1030 13y ago
        That's not Facebook's problem...should they also write Esperanto terms of service and Swahili terms of service just because security researchers exist who speak those languages?
• throwaway420 13y ago
  >>> If Facebook does pay you for the bug, it is just setting a bad example and will be encouraging similar behaviour. I strongly disagree. Despite not following the process by the book, I think it is clear that he attempted to act in good faith and had trouble with language/cultural issues. It's not like he posted porn or something on Zuckerberg's profile. I think that going out of their way to stiff this guy out of a few bucks makes it all the more likely that any future vulnerabilities that are discovered by foreigners will just be sold to spammers/hackers. And this makes the internet a worse place. Facebook saved a few bucks but just lost a big PR war here that Facebook will reward you for disclosing vulnerabilities. Facebook should have paid the guy and used this event as a reminder about the best practices and procedures to follow.
  • yashkadakia 13y ago
    I want to step in here - Facebook is in no-way trying to save a few bucks. I've reported a few bugs to Facebook and they go out of their way to pay you greater sums depending on the severity. You just have to be professional and disclose in-detail with steps to reproduce.
    • loxs 13y ago
      Who said that only professionals can find vulnerabilities? The guy is clearly inexperienced, but catching the bug is no lesser favor to Facebook. They are being dicks. And they deserve the bad press.
    • throwaway420 13y ago
      Nobody would disagree with you that the disclosure message was poorly written. Though the Facebook engineer conceivably could have offered to give the guy's email to a native speaker or tried to get more detail from him, I don't blame the initial Facebook engineer for dismissing it on the spot given that he probably had a few dozen other messages like that on the same day to review and deal with. But it's all about perception here. The end result of this is a big PR loss for Facebook if they want to protect their users and get people to submit bug reports without having to fear that they'll lose out on money. The next time an inexperienced foreigner discovers an exploit they'll research this topic and see that Facebook answered this guy with a "thanks for working for us for free" message. So what will happen is that when some spammer comes around with a few thousand dollars in cash vs the uncertainty of dealing with Facebook, odds are the exploit will go to him rather than Facebook. They won't read about the hundreds of times that Facebook did pay up, but the couple of times they didn't. So this is just a big loss for the internet because Facebook made it that much more likely that people will sell their exploits to all kinds of nefarious people.
• dylangs1030 13y ago
  Excellent summary, thanks. I don't think most of the people raising an outcry over Khalil not receiving any bounty understand that the Terms and Conditions are explicit and easily accessible. They also can't just set a precedent. "Oh, if we don't understand your bug report, just post it on our founder/CEO's Facebook wall and it'll shoot right up to the top on our priority list." I know everyone hates big companies but come on...the argument for Khalil to not be paid is very reasonable. I respect him for being able to find the bug but it's not a conspiracy. He could have sent back an email trying to be more clear, or ask for an Arabic-speaking employee. Plus, Facebook is not a stingy company when it comes to paying security researchers. Just look at their Hall of Fame. It includes HN's 'homakov (Egor Homakov), who wrote an excellent blog post about finding a vulnerability in Facebook and his primary language isn't English. But he still found a way to report the vulnerability through responsible disclosure and he is very happy with the bounty he received. Everyone thinks it's so cool and "sticking it to Facebook" and that Facebook is just some big bad company who doesn't care about the small folk. It's not like that at all, change your perspective.
• vpeters25 13y ago
  I thought the whole idea behind whitehat reports was to keep these exploits off the hands of malicious hackers. Whoever made the decision not to pay this guy should check with Mark Zuckerberg. If Mark is still adhering to "the hacker way" he should embrace such clever ways of reporting exploits and invite any whitehat to test them on his or better, {the idiot who decided not to pay}'s profile. Hacking and finding exploits requires thinking outside the box, by imposing rules and "terms of service" on them, Facebook might be defeating the whole purpose of the whitehat program. Any exploit violates Facebook's terms anyways. By not paying, Facebook is telling the whitehat community "go ahead, do our QA for us, we will only pay you if we feel like it"
  • unreal37 13y ago
    That's not true. There was a very easy way to find and demonstrate this bug without violating the TOS. The TOS clearly says, you can't target someone with your hack without their permission. The hacker could have created two accounts he owned and controlled, who are not Facebook friends. He could have used one to post to the other's wall. Viola, bug proven and bounty collected.
    • jnbiche 13y ago
      Yeah, and he breaks their terms of service even there, since you're only supposed to create a single personal account under your true name.
      • avalaunch 13y ago
        They have special whitehat accounts which you are allowed to set up for testing. You can have as many of those as you like.
      • unreal37 13y ago
        My company creates Facebook apps and have multiple FB accounts for testing purposes. They're not going to kick him off FB for having two accounts, come on.
    • 13y ago
• negamax 13y ago
  Oh come on. This is such a corporate PR stand. The guy had taken the perfect step by posting the exploit on Mark's wall. He tried twice with best way available to him to report the bug. Is Facebook saying he should have adhered to a particular way for doing a service to them? Good luck in making him paint in the bad light. Next person will simply upload the video on Youtube and won't even bother reporting anything.
• thezilch 13y ago
  What a load of crap. I understand that English is not your first language (no I don't; I'll deride your command of it at every turn, going forward) and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps (every whitehat reporter CAN NOT be expected to understand how or what to adequately include in a PoC; it is _Facebook_ who is shown to be lazy in their responses, failing to point the reporter to the rules, appropriate [localized] steps, and ANYTHING of value to help the reporter). For example you have said "mark profile" instead of "Mark Zuckerberg's profile" (lol, idiot). That's just ambiguous language (see, I really don't understand nor can forgive you for being an English speaker) and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously (unlike the mistakes made by Facebook; woe is them who can't be arsed to not even have boilerplate guidance and just shrug off reporters; cool story bro). [...] you failed to communicate clearly (idiot).
  • borplk 13y ago
    Very informative commentary with your "lol" and "idiot" brackets. Maybe Facebook sucks and can't be bothered with helping the reporter. That does not make it ok for the reporter to go ahead and exploit it. And for what it's worth, I'm not a English speaker either so I can understand and forgive someone for not being a English speaker too. His report is very short and lazily written. It's not about the level of language skills. It's about the time and effort he put in on disclosing the vulnerability. Using simple language he could have written a step by step guide explaining the problem. The point is, regardless of Facebook's behavior, it is not ok for him to go ahead and exploit the bug on two different users one of them being the CEO of the company. And he did not put in enough effort to make them understand what he's talking about. He could have given it another shot with more details. Facebook is not trying to "save" money on the bounty program. The budget is already allocated and no one is sitting there crying over the couple of thousands of dollars and trying to stop people from getting it. If anything, he has caused damage to Facebook's image and reputation due to the negative publicity, greater than the amount he was going to be paid. So yes, if you post on Mark Zuckerberg's profile and create a news shit-storm of negative publicity against Facebook they are not going to thank you and pay you money.
• hcarvalhoalves 13y ago
  > After they said it is not a bug, it is clear that they have misunderstood you because you failed to communicate clearly. You could write a more detailed report and tell them that they have misunderstood you. Right. He could also make a detailed flow diagram, or maybe fly to US and demonstrate in loco how it works. Give me a break... If I send a bug report and some lazy engineer replies back in laconic fashion with "It's not a bug" I would also have exploited the CEO profile. They should be thankful he didn't simply sold the exploit, it had the potential to be huge.
  • borplk 13y ago
    A lazy engineer doesn't automatically result in a warrant for exploiting the bug on the CEO's (or anyone's) profile. No corporation will come forward and say "thank you for exploiting two of our users including our CEO and generating lots of negative PR for us. Here have this money for being a good boy and not selling the bug in the black market". That's not how whitehat works.
    • hcarvalhoalves 13y ago
      You talk as if raising awareness of the issue directly to the CEO of the company because his employee was incompetent at handling the issue in the first place is a bad thing.
• Udo 13y ago
  It's not just the language barrier or the ethics of disturbing someone's profile though. His emails read like a job application with some vague hints at an exploit that may or may not be real. I'd say he expected a job offer or at least an interview as compensation for eventually revealing the bug. In his perception, going ahead and posting on Zuckerberg's timeline was just another step toward that goal. Breaking the rules is a somewhat glorified thing in hacker circles, and this may have contributed to his attitude. Of course, what they don't tell you when they say "break all the rules" is that only works out if you actually win in the end. And winning is an event often contingent on getting someone important to like you. For what it's worth, all of that probably wasn't done in bad faith, but it wasn't a constructive process either. It's something someone very inexperienced would do if they were desperate for a job in the USA. It's understandable behavior, and if I was on the relevant FB team I'd at least given him something to recognize his efforts. If in doubt, do the generous thing (and be it only for publicity's sake).
  • borplk 13y ago
    By giving him anything they would be encouraging violation of their terms of service. I'm no fan of Facebook but as a corporation they are doing the right thing.
    • Udo 13y ago
      I'm not saying they're doing the wrong thing either.
• walid 13y ago
  Considering the language barrier I have to shoot down some of your assumptions. > - I understand that English is not your first language and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps. For example you have said "mark profile" instead of "Mark Zuckerberg's profile". That's just ambiguous language and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously. The part where Khalil writes "mark profile" is the way it is said in Arabic because Arabic has no capitalization. There is no "apostrophe + s" in Arabic either. The violation of TOS is a obviously a violation, but the language barrier thing again. The TOS is not in Arabic. Finally: > - Just because they fail to receive your bug report does not make it ok for you to go ahead and exploit it. The word "exploit" is not the right word here. He didn't exploit the bug, he demonstrated it, albeit in a poor way but it wasn't an exploitation.