12 ms·

Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

189 points by chrisdinn 13y ago

chrisacky 13y ago
Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so dismissive with critical bugs. (I still think they should pay the guy, and it should be double the $5k he would have expected to receive).
- short_circut 13y ago
  Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.
  - mcphilip 13y ago
    I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true. A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.
    - Oculus 13y ago
      The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.
      - walid 13y ago
        Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.
        madeofpalk 13y ago
        In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")
      - iyulaev 13y ago
        Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.
        yogo 13y ago
        Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
  - donohoe 13y ago
    It was tough enough to read his post to MZ wall. Clearly there was a language gap and the original bug report suffered as a result. I don't its such a big deal overall.
  - ethanbond 13y ago
    Not figuring out a way to communicate with someone clearly having difficulty communicating is dismissive.
  - zobzu 13y ago
    The fact that hes not english native and that communication seems hard for him does not mean that: - he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+money is all that matters) - $500 is less than peanuts for FB. Finding these bugs, even if they have to read into the guy's submission more than usual, is critical for FB. Refusing the bounty means that next time it'll be left unfixed and the bad guys will probably get it instead. All in all, FB's not wrong per say, but it's still a bad move from FB, morally and PR-wise.
    - LandoCalrissian 13y ago
      I think the important part too, is when he technically violated the TOS it was only to get their attention because he was otherwise being ignored. I don't see any reason they should not want to pay him.
      - jack-r-abbit 13y ago
        FWIW, his initial bug report included a link to a post he made on a non-friend's wall. So his first TOS violation was prior to his first attempt to file a bug. The second TOS violation (posting on Zuck's wall) was what got him press time.
    - rmc 13y ago
      Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.
  - efuquen 13y ago
    Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.
    - lttlrck 13y ago
      I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)
      - AsymetricCom 13y ago
        I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
        jack-r-abbit 13y ago
        > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
        lewispollard 13y ago
        Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
  - thezilch 13y ago
    I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing." Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.
  - wereHamster 13y ago
    To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).
    - dsl 13y ago
      He posted on Mark's wall, not as him. Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.
      - rmc 13y ago
        He posted on Mark's wall, not as him. Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?
        dsl 13y ago
        What if I was able to send a fake press release on behalf of a company?[1] What if I hacked the Twitter account of a major press organization?[2] Eventually the SEC will require traders to seek independent verification before executing based on social data, or put stops in place similar to the flash crash protections. 1. http://www.sec.gov/news/press/2009/2009-226.htm http://www.sec.gov/news/press/2009/2009-226.htm 2. http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twitter-crash-is-flash-crash-redux/ http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twit...
        whatusername 13y ago
        Hell -- you don't even have to "hack" in to anything to do damage with a Press Release. Just Publish it anyway - most of the press is too lazy to double-check http://www.smh.com.au/business/mining-and-resources/hoax-press-release-sparks-whitehaven-plunge-20130107-2cc47.html http://www.smh.com.au/business/mining-and-resources/hoax-pre...
  - rohunati 13y ago
    his first language is Arabic.
  - skeletonjelly 13y ago
    Can we not get into this again? There are plenty of threads on the validity of this as a bug report.
- macspoofing 13y ago
  I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.
  - rgbrenner 13y ago
    "they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as long as they embarrass facebook with it afterward.
    - lightcatcher 13y ago
      I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.
    - toomuchtodo 13y ago
      You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."
      - webvictim 13y ago
        I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.
        toomuchtodo 13y ago
- ck2 13y ago
  Have you see the interview on CNN with this guy? http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-facebook-hack/ http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f... He is rather poor and had a tiny broken laptop that is missing five keys. He could have used that money and really tried to get them to see the problem. They should pay him just out of realizing what idiots they were. Someone should at least send him a better laptop.
  - 001sky 13y ago
    r/random acts of laptop
- __voidcast__ 13y ago
  When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.
- FedRegister 13y ago
  This is being covered a lot more widely because it's a distraction.
codex_irl 13y ago
poor show FB - thumbs down!
nthitz 13y ago
Plenty more discussion here: https://news.ycombinator.com/item?id=6229858 https://news.ycombinator.com/item?id=6229858
jack-r-abbit 13y ago
I don't really understand what significance there is in stating that he is "unemployed." Does that somehow make his actions better/worse or the "hack" more/less tolerable?
- beat 13y ago
  You're starting to see the fnords. Stop that! Look over there, a celebrity is having marital problems! A pretty young blonde woman is missing! Journalism is always fair and balanced. They would never, ever use potentially biasing words to suggest that you favor the big corporation over the individual.
  - quantumpotato_ 13y ago
    I think it was done to give credence to the web-developers lack of "corporatism", to show an "underdog" narrative. Sort of like "homeless man discovers flaw in millionaire's mansion security".. he's so badass he doesn't need a home, or a job, to be good at what he does. I think. It's gotten nearly impossible to tell w/ modern journalism.
    - beat 13y ago
      "Unemployed" is never a positive word in American English. In America, if you're unemployed, it's because you're a lazy, shiftless bum - and will quickly resort to crime if your own shortcomings won't let you scam a powerful and scrupulously honest corporation. The word "unemployed" has such negative connotations here that trying to use it in an underdog narrative is dooming your story to failure.
  - jack-r-abbit 13y ago
    Got it. "Down on his luck web developer, just trying to make a living helping people, gets screwed out of $5k bounty for reporting a Facebook bug. News at 11."
  - skeletonjelly 13y ago
    To be fair, Khalil mentioned this several times in his blog post.
jzelinskie 13y ago
Why don't people just send things in their native language? If the platform for communication is serious (like a place to report security vulnerabilities), I would imagine they would spend the time/money to get a real translation if one was needed. Even Google Translate probably could've done a better job than this guy's original report.
- swang 13y ago
  Whatever language he was going to send it in was not going to get parsed anyways since he barely communicated any relevant information in his emails. The Facebook employee who replied to the email handled it very poorly, but the guy who found this bug also handled it very poorly by not actually sending any details about what he did.
  - beat 13y ago
    Exactly. A step-by-step with screenshots doesn't require translation. I've worked with a lot of brilliant programmers with very poor English, and they communicate effectively by sticking to hard technical data.
  - walid 13y ago
    Also he did mention on whose wall he posted and that they are not friends so this should have been a red flag on its own.
- cliveowen 13y ago
  There's no excuse for not knowing the English language, first as a 21 century citizen and secondly as a web developer.
  - deleted 13y ago
    [deleted]
    - cliveowen 13y ago
      Nope, I'm Italian.
baby 13y ago
hasn't this story been posted multiple times already? Also it was made clear that he clearly violated the TOS and that his messages were unintelligible.
- skeletonjelly 13y ago
  It most definitely has. I'm so over arguing over this. Previous discussion https://news.ycombinator.com/item?id=6229858 https://news.ycombinator.com/item?id=6229858 +383 and about 10 other single digit posts of various blogspam sites https://www.hnsearch.com/search#request/submissions&q=facebook&sortby=create_ts+desc&start=0 https://www.hnsearch.com/search#request/submissions&q=facebo... and reddit http://www.reddit.com/r/sysadmin/comments/1kkvfr/user_reports_security_bug_to_facebook_after_user/ http://www.reddit.com/r/sysadmin/comments/1kkvfr/user_report... +329 http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_security_bug_to_facebook_after_user/ http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_... +532 http://www.reddit.com/r/technology/comments/1ko71v/researcher_facebook_ignored_the_bug_i_found_until/ http://www.reddit.com/r/technology/comments/1ko71v/researche... +831 http://www.reddit.com/r/technology/comments/1kkoux/hacker_posts_facebook_bug_report_on_zuckerbergs/ http://www.reddit.com/r/technology/comments/1kkoux/hacker_po... +3005 Can we wrap this one up perhaps?
shortcj 13y ago
Facebook is a top tier company; they don't pay people attention, much less real money, without a track record of like Harvard or Stanford already.
- shortstuffsushi 13y ago
  I really don't think that's an fair allegation to just throw out there. Care to back that up with some evidence?
diminoten 13y ago
The Facebook team should have taken better care of this, but the guy should have used one of the test accounts, or created a test account to demonstrate this, rather than fuck with someone else's private Facebook account. Very bad form.
- JangoSteve 13y ago
  I agree. Why not create a test account and post to his own wall?
arnarbi 13y ago
> Shreateh reports he will not, however, receive a bounty for his work — per an e-mail from Facebook, he violated the terms of the program when he hacked Zuckerberg’s account. I think this is wrong. He posted on Sarah Godin's wall first before making any report, very clearly breaking the rules FB sets up for its whitehat program. They offer a way to create test accounts for exactly this. Posting on Mark Zuckerberg's wall has nothing to do with it. As far as I'm concerned. FB's only mistake here was to brush him off instead of asking for further information from the initial report. Hardly newsworthy.
- bwang8 13y ago
  From my understanding, Sarah Godin is a fake FB account that he made to test his bug out.
  - yuliyp 13y ago
    Sarah Goodin is not a fake account, she is one of the first Facebook users (back when it was at Harvard only).
    - jamesjguthrie 13y ago
      How do you know that the post to her wall wasn't his initial discovery of the bug? Any occurrence of the bug was a breach of the ToS.
      - ceol 13y ago
        Not between two test accounts or two accounts that belong to you (work and personal, which you are allowed to have.)
callesgg 13y ago
What is wrong with journalists now days. Reading on hacker news and copy pasting stuff in to articles is not what i would call good journalism. It would be nice if people could stop reposting shit from "average joe" news papers.
joshaidan 13y ago
I find it interesting the amount of attention Hacker News is getting from this in mainstream media. It makes me wonder, when people unfamiliar to Hacker News read about it in stories like this, do they get the wrong impression and think Hacker News is about the criminal kind of "hacking"?
- beat 13y ago
  The mainstream media spent twenty years trying to turn the word "hacker" into some sort of unholy cross between thief, terrorist, child pornographer, and teenager. They'd better be getting the sense that hacker == criminal by now!
  - deleted 13y ago
    [deleted]
  - deleted 13y ago
    [deleted]
  - ceol 13y ago
    Your replies in this thread have been piss poor, anti-corporation, anti-media, hyperbolic shitposting. Please take it back to /r/technology.
    - beat 13y ago
      If the media hasn't consistently presented "hacker" as negative, why is it seen as such? After all, everyone who actually knows what hacking is a: sees it as positive, and b: is irritated at the media presentation. Facts is facts, man. Sorry if you don't like the snark, but I'm not sorry for telling the truth.
      - ceol 13y ago
        It's the general public's opinion about "hacker", not just the media's. Connotations change. Everyone here knows "hacker" to mean "someone who finds a simple solution to a complex problem" but everyone elsewhere uses "hacker" to mean "someone who breaks into another person's computer system." It's not even the wrong usage; it's just a usage you don't personally like. That's not touching on the rest of your posts. They've all been hyperbolic bullshit, and I hate seeing it bleed over from the political discussions.
gexla 13y ago
"What can I get..." Sounds like he really needed the cash and got a bit too eager. ;)
guard-of-terra 13y ago
I think we should crowd-source $5k to that guy and make Zuck sure we don't really need him for anything. I'm ready to toss $10.
- webvictim 13y ago
  You would prove nothing other than that crime pays.
  - gnaritas 13y ago
    Crime does pay, that's rather the point of crime, it doesn't really need proving.
    - webvictim 13y ago
      In that case, crowdsourcing a way to pay this guy $5k for the vulnerability he found and abused would be counterintuitive.
      - shiven 13y ago
        abused Really? Just because FB's security team was dismissive of a real bug report due to a language barrier they could have overcome with the tiniest bit of due diligence?
      - walid 13y ago
        WOW WOW you say "abused"... strong language there. He was trying to show the bug to them. This guy looks like he never read the TOS in the first place so he wasn't going after abusing. He didn't communicate properly is the way I would put it.
      - gnaritas 13y ago
        I see no abuse. Secondly, the publicity of this will probably land the dude a job.
  - synchronise 13y ago
deleted 13y ago
[deleted]
bloaf 13y ago
Its simple, Facebook can't set the precedent that people who exploit bugs in this way get paid. If they did, every Joe who felt that their particular bug wasn't being addressed quite right would think that public exploitation is the faster route to their reward.
- rmc 13y ago
  Conversely, they might be setting the opposite precendent, that they might ignore your intial email if you don't speak perfectly, and if they ignore your initial email, even hacking Zuck's account won't get you any offical recognition. The bad precendent is that if you're not a great english speaker, you might as well sell your bug on the black market. This is not good for facebook.
tptacek 13y ago
Once again, with feeling: Even if Facebook wanted to ignore the terms of their bug bounty to pay this person, they probably can't. Bug bounties are legally fraught as it stands. Like every bug bounty, Facebook's is clear: if you use a real account, you must have the consent of the accountholder. That term isn't just there to make the Facebook security team's job easier; they also can't officially condone people compromising random user accounts. Facebook also operates in a web of contractual and regulatory concerns, including California's breach notification laws. Exploitation of security vulnerabilities on Facebook's public properties outside of the terms of their bug bounty might be legally more akin to attacks than to pro-bono testing. Further, Facebook obviously needs the ability to reliably enforce their terms, lest they provide attackers with ammunition in a court case if they, for instance, Pastebin large amounts of Facebook user data. "Oh, I was just participating in the bug bounty program; I certainly wasn't setting out to sell $CELEBRITY's data to a tabloid." Jim Denaro is an attorney specializing in stuff on this. We talked to him on Twitter this weekend when the story broke, and he said he would have advised against paying the bounty here too. Maybe we can get him to write a blog post. I don't know how much "outrage" this has actually generated in the security community (maybe you can find links). The security people I've talked to think what happened makes perfect sense. Facebook didn't freak out, the acknowledged the bug report (once they understood it) and fixed the bug. They're just not paying a reward, because the bugfinder violated what is perhaps the most important term in the bug bounty. One more thing: people on HN have a lot of strong opinions about Facebook, and while I don't share many of them, I understand and respect them. Understand though that the people working on Facebook's security are real and very smart and by and large not the least bit interested in screwing other bugfinders out of 0.00000000001% of Facebook's operating capital.
- phogster 13y ago
  Being real and very smart does not preclude you from being an asshole.
  - tptacek 13y ago
    Whatever set of things you are obviously doesn't preclude you from calling people you don't know "assholes" either, does it? This is all you have to say?
lcusack 13y ago
It would be a class act if Mark Z personally paid him the bounty or maybe if FB employees crowdfunded it. Then they don't have to admit they were wrong and don't look like jerks. Best of both worlds.
deleted 13y ago
[deleted]
adsr 13y ago
This seems like a lack of communication skills on both parts imho, why would you respond: "this is not a bug" to a bug report you did not understand.
enterx 13y ago
lol, you ad serving pricks! XD Will someone send this Khalil Shreateh a brand new quad-core? TIA Khalil Shreateh - respect. Let your name be indexed once more.

189 points by chrisdinn 13y ago

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so dismissive with critical bugs. (I still think they should pay the guy, and it should be double the $5k he would have expected to receive).

short_circut 13y ago
Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.
- mcphilip 13y ago
  I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true. A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.
  - Oculus 13y ago
    The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.
    - walid 13y ago
      Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.
      - madeofpalk 13y ago
        In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")
    - iyulaev 13y ago
      Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.
      - yogo 13y ago
        Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
- donohoe 13y ago
  It was tough enough to read his post to MZ wall. Clearly there was a language gap and the original bug report suffered as a result. I don't its such a big deal overall.
- ethanbond 13y ago
  Not figuring out a way to communicate with someone clearly having difficulty communicating is dismissive.
- zobzu 13y ago
  The fact that hes not english native and that communication seems hard for him does not mean that: - he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+money is all that matters) - $500 is less than peanuts for FB. Finding these bugs, even if they have to read into the guy's submission more than usual, is critical for FB. Refusing the bounty means that next time it'll be left unfixed and the bad guys will probably get it instead. All in all, FB's not wrong per say, but it's still a bad move from FB, morally and PR-wise.
  - LandoCalrissian 13y ago
    I think the important part too, is when he technically violated the TOS it was only to get their attention because he was otherwise being ignored. I don't see any reason they should not want to pay him.
    - jack-r-abbit 13y ago
      FWIW, his initial bug report included a link to a post he made on a non-friend's wall. So his first TOS violation was prior to his first attempt to file a bug. The second TOS violation (posting on Zuck's wall) was what got him press time.
  - rmc 13y ago
    Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.
- efuquen 13y ago
  Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.
  - lttlrck 13y ago
    I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)
    - AsymetricCom 13y ago
      I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
      - jack-r-abbit 13y ago
        > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
        lewispollard 13y ago
        Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
- thezilch 13y ago
  I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing." Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.
- wereHamster 13y ago
  To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).
  - dsl 13y ago
    He posted on Mark's wall, not as him. Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.
    - rmc 13y ago
      He posted on Mark's wall, not as him. Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?
      - dsl 13y ago
        What if I was able to send a fake press release on behalf of a company?[1] What if I hacked the Twitter account of a major press organization?[2] Eventually the SEC will require traders to seek independent verification before executing based on social data, or put stops in place similar to the flash crash protections. 1. http://www.sec.gov/news/press/2009/2009-226.htm http://www.sec.gov/news/press/2009/2009-226.htm 2. http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twitter-crash-is-flash-crash-redux/ http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twit...
        whatusername 13y ago
        Hell -- you don't even have to "hack" in to anything to do damage with a Press Release. Just Publish it anyway - most of the press is too lazy to double-check http://www.smh.com.au/business/mining-and-resources/hoax-press-release-sparks-whitehaven-plunge-20130107-2cc47.html http://www.smh.com.au/business/mining-and-resources/hoax-pre...
- rohunati 13y ago
  his first language is Arabic.
- skeletonjelly 13y ago
  Can we not get into this again? There are plenty of threads on the validity of this as a bug report.
macspoofing 13y ago
I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.
- rgbrenner 13y ago
  "they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as long as they embarrass facebook with it afterward.
  - lightcatcher 13y ago
    I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.
  - toomuchtodo 13y ago
    You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."
    - webvictim 13y ago
      I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.
      - toomuchtodo 13y ago
ck2 13y ago
Have you see the interview on CNN with this guy? http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-facebook-hack/ http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f... He is rather poor and had a tiny broken laptop that is missing five keys. He could have used that money and really tried to get them to see the problem. They should pay him just out of realizing what idiots they were. Someone should at least send him a better laptop.
- 001sky 13y ago
  r/random acts of laptop
__voidcast__ 13y ago
When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.
FedRegister 13y ago
This is being covered a lot more widely because it's a distraction.

codex_irl 13y ago

poor show FB - thumbs down!

nthitz 13y ago

Plenty more discussion here: https://news.ycombinator.com/item?id=6229858 https://news.ycombinator.com/item?id=6229858

jack-r-abbit 13y ago

I don't really understand what significance there is in stating that he is "unemployed." Does that somehow make his actions better/worse or the "hack" more/less tolerable?

beat 13y ago
You're starting to see the fnords. Stop that! Look over there, a celebrity is having marital problems! A pretty young blonde woman is missing! Journalism is always fair and balanced. They would never, ever use potentially biasing words to suggest that you favor the big corporation over the individual.
- quantumpotato_ 13y ago
  I think it was done to give credence to the web-developers lack of "corporatism", to show an "underdog" narrative. Sort of like "homeless man discovers flaw in millionaire's mansion security".. he's so badass he doesn't need a home, or a job, to be good at what he does. I think. It's gotten nearly impossible to tell w/ modern journalism.
  - beat 13y ago
    "Unemployed" is never a positive word in American English. In America, if you're unemployed, it's because you're a lazy, shiftless bum - and will quickly resort to crime if your own shortcomings won't let you scam a powerful and scrupulously honest corporation. The word "unemployed" has such negative connotations here that trying to use it in an underdog narrative is dooming your story to failure.
- jack-r-abbit 13y ago
  Got it. "Down on his luck web developer, just trying to make a living helping people, gets screwed out of $5k bounty for reporting a Facebook bug. News at 11."
- skeletonjelly 13y ago
  To be fair, Khalil mentioned this several times in his blog post.

jzelinskie 13y ago

Why don't people just send things in their native language? If the platform for communication is serious (like a place to report security vulnerabilities), I would imagine they would spend the time/money to get a real translation if one was needed. Even Google Translate probably could've done a better job than this guy's original report.

swang 13y ago
Whatever language he was going to send it in was not going to get parsed anyways since he barely communicated any relevant information in his emails. The Facebook employee who replied to the email handled it very poorly, but the guy who found this bug also handled it very poorly by not actually sending any details about what he did.
- beat 13y ago
  Exactly. A step-by-step with screenshots doesn't require translation. I've worked with a lot of brilliant programmers with very poor English, and they communicate effectively by sticking to hard technical data.
- walid 13y ago
  Also he did mention on whose wall he posted and that they are not friends so this should have been a red flag on its own.
cliveowen 13y ago
There's no excuse for not knowing the English language, first as a 21 century citizen and secondly as a web developer.
- deleted 13y ago
  [deleted]
  - cliveowen 13y ago
    Nope, I'm Italian.

baby 13y ago

hasn't this story been posted multiple times already? Also it was made clear that he clearly violated the TOS and that his messages were unintelligible.

skeletonjelly 13y ago
It most definitely has. I'm so over arguing over this. Previous discussion https://news.ycombinator.com/item?id=6229858 https://news.ycombinator.com/item?id=6229858 +383 and about 10 other single digit posts of various blogspam sites https://www.hnsearch.com/search#request/submissions&q=facebook&sortby=create_ts+desc&start=0 https://www.hnsearch.com/search#request/submissions&q=facebo... and reddit http://www.reddit.com/r/sysadmin/comments/1kkvfr/user_reports_security_bug_to_facebook_after_user/ http://www.reddit.com/r/sysadmin/comments/1kkvfr/user_report... +329 http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_security_bug_to_facebook_after_user/ http://www.reddit.com/r/netsec/comments/1kkvei/user_reports_... +532 http://www.reddit.com/r/technology/comments/1ko71v/researcher_facebook_ignored_the_bug_i_found_until/ http://www.reddit.com/r/technology/comments/1ko71v/researche... +831 http://www.reddit.com/r/technology/comments/1kkoux/hacker_posts_facebook_bug_report_on_zuckerbergs/ http://www.reddit.com/r/technology/comments/1kkoux/hacker_po... +3005 Can we wrap this one up perhaps?

shortcj 13y ago

Facebook is a top tier company; they don't pay people attention, much less real money, without a track record of like Harvard or Stanford already.

shortstuffsushi 13y ago
I really don't think that's an fair allegation to just throw out there. Care to back that up with some evidence?

diminoten 13y ago

The Facebook team should have taken better care of this, but the guy should have used one of the test accounts, or created a test account to demonstrate this, rather than fuck with someone else's private Facebook account. Very bad form.

JangoSteve 13y ago
I agree. Why not create a test account and post to his own wall?

arnarbi 13y ago

> Shreateh reports he will not, however, receive a bounty for his work — per an e-mail from Facebook, he violated the terms of the program when he hacked Zuckerberg’s account. I think this is wrong. He posted on Sarah Godin's wall first before making any report, very clearly breaking the rules FB sets up for its whitehat program. They offer a way to create test accounts for exactly this. Posting on Mark Zuckerberg's wall has nothing to do with it. As far as I'm concerned. FB's only mistake here was to brush him off instead of asking for further information from the initial report. Hardly newsworthy.

bwang8 13y ago
From my understanding, Sarah Godin is a fake FB account that he made to test his bug out.
- yuliyp 13y ago
  Sarah Goodin is not a fake account, she is one of the first Facebook users (back when it was at Harvard only).
  - jamesjguthrie 13y ago
    How do you know that the post to her wall wasn't his initial discovery of the bug? Any occurrence of the bug was a breach of the ToS.
    - ceol 13y ago
      Not between two test accounts or two accounts that belong to you (work and personal, which you are allowed to have.)

callesgg 13y ago

What is wrong with journalists now days. Reading on hacker news and copy pasting stuff in to articles is not what i would call good journalism. It would be nice if people could stop reposting shit from "average joe" news papers.

joshaidan 13y ago

I find it interesting the amount of attention Hacker News is getting from this in mainstream media. It makes me wonder, when people unfamiliar to Hacker News read about it in stories like this, do they get the wrong impression and think Hacker News is about the criminal kind of "hacking"?

beat 13y ago
The mainstream media spent twenty years trying to turn the word "hacker" into some sort of unholy cross between thief, terrorist, child pornographer, and teenager. They'd better be getting the sense that hacker == criminal by now!
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- ceol 13y ago
  Your replies in this thread have been piss poor, anti-corporation, anti-media, hyperbolic shitposting. Please take it back to /r/technology.
  - beat 13y ago
    If the media hasn't consistently presented "hacker" as negative, why is it seen as such? After all, everyone who actually knows what hacking is a: sees it as positive, and b: is irritated at the media presentation. Facts is facts, man. Sorry if you don't like the snark, but I'm not sorry for telling the truth.
    - ceol 13y ago
      It's the general public's opinion about "hacker", not just the media's. Connotations change. Everyone here knows "hacker" to mean "someone who finds a simple solution to a complex problem" but everyone elsewhere uses "hacker" to mean "someone who breaks into another person's computer system." It's not even the wrong usage; it's just a usage you don't personally like. That's not touching on the rest of your posts. They've all been hyperbolic bullshit, and I hate seeing it bleed over from the political discussions.

gexla 13y ago

"What can I get..." Sounds like he really needed the cash and got a bit too eager. ;)

guard-of-terra 13y ago

I think we should crowd-source $5k to that guy and make Zuck sure we don't really need him for anything. I'm ready to toss $10.

webvictim 13y ago
You would prove nothing other than that crime pays.
- gnaritas 13y ago
  Crime does pay, that's rather the point of crime, it doesn't really need proving.
  - webvictim 13y ago
    In that case, crowdsourcing a way to pay this guy $5k for the vulnerability he found and abused would be counterintuitive.
    - shiven 13y ago
      abused Really? Just because FB's security team was dismissive of a real bug report due to a language barrier they could have overcome with the tiniest bit of due diligence?
    - walid 13y ago
      WOW WOW you say "abused"... strong language there. He was trying to show the bug to them. This guy looks like he never read the TOS in the first place so he wasn't going after abusing. He didn't communicate properly is the way I would put it.
    - gnaritas 13y ago
      I see no abuse. Secondly, the publicity of this will probably land the dude a job.
- synchronise 13y ago

deleted 13y ago

[deleted]

bloaf 13y ago

Its simple, Facebook can't set the precedent that people who exploit bugs in this way get paid. If they did, every Joe who felt that their particular bug wasn't being addressed quite right would think that public exploitation is the faster route to their reward.

rmc 13y ago
Conversely, they might be setting the opposite precendent, that they might ignore your intial email if you don't speak perfectly, and if they ignore your initial email, even hacking Zuck's account won't get you any offical recognition. The bad precendent is that if you're not a great english speaker, you might as well sell your bug on the black market. This is not good for facebook.

tptacek 13y ago

Once again, with feeling: Even if Facebook wanted to ignore the terms of their bug bounty to pay this person, they probably can't. Bug bounties are legally fraught as it stands. Like every bug bounty, Facebook's is clear: if you use a real account, you must have the consent of the accountholder. That term isn't just there to make the Facebook security team's job easier; they also can't officially condone people compromising random user accounts. Facebook also operates in a web of contractual and regulatory concerns, including California's breach notification laws. Exploitation of security vulnerabilities on Facebook's public properties outside of the terms of their bug bounty might be legally more akin to attacks than to pro-bono testing. Further, Facebook obviously needs the ability to reliably enforce their terms, lest they provide attackers with ammunition in a court case if they, for instance, Pastebin large amounts of Facebook user data. "Oh, I was just participating in the bug bounty program; I certainly wasn't setting out to sell $CELEBRITY's data to a tabloid." Jim Denaro is an attorney specializing in stuff on this. We talked to him on Twitter this weekend when the story broke, and he said he would have advised against paying the bounty here too. Maybe we can get him to write a blog post. I don't know how much "outrage" this has actually generated in the security community (maybe you can find links). The security people I've talked to think what happened makes perfect sense. Facebook didn't freak out, the acknowledged the bug report (once they understood it) and fixed the bug. They're just not paying a reward, because the bugfinder violated what is perhaps the most important term in the bug bounty. One more thing: people on HN have a lot of strong opinions about Facebook, and while I don't share many of them, I understand and respect them. Understand though that the people working on Facebook's security are real and very smart and by and large not the least bit interested in screwing other bugfinders out of 0.00000000001% of Facebook's operating capital.

phogster 13y ago
Being real and very smart does not preclude you from being an asshole.
- tptacek 13y ago
  Whatever set of things you are obviously doesn't preclude you from calling people you don't know "assholes" either, does it? This is all you have to say?

lcusack 13y ago

It would be a class act if Mark Z personally paid him the bounty or maybe if FB employees crowdfunded it. Then they don't have to admit they were wrong and don't look like jerks. Best of both worlds.

deleted 13y ago

[deleted]

adsr 13y ago

This seems like a lack of communication skills on both parts imho, why would you respond: "this is not a bug" to a bug report you did not understand.

enterx 13y ago

lol, you ad serving pricks! XD Will someone send this Khalil Shreateh a brand new quad-core? TIA Khalil Shreateh - respect. Let your name be indexed once more.