6 ms·

If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate

If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate $12,500 every 33 seconds. Paying out that sum of money to increase the number of people searching for security flaws is quite smart.

deleted 12y ago
[deleted]
- deleted 12y ago
  [deleted]
MichaelGG 12y ago
Yet there's no way to tell FB about problems without having an account (that I could find in 5 minutes). I found potential phishing attempts in the Windows Store, suggested apps right from the start menu. MS refuses to do anything about phishing/scams on their store, and FB offers no way to contact them (I tried a few email addresses like legal@, to no response).
- jessaustin 12y ago
  Yeah there's no way that's enough money to submit to creating a FB account. [only half-joking... EDIT: three-quarters?]
- compbio 12y ago
  You can (and preferably should) use a Whitehat Test Account to perform your research/make your report: https://www.facebook.com/whitehat/accounts/ https://www.facebook.com/whitehat/accounts/ apps.facebook.com (Facebook Windows Store) is not in the scope of this bug bounty program though.
  - MichaelGG 12y ago
    I'm just trying to let FB know of a potential phishing attempt that's targeting all Windows users. I don't care about the bounty, in fact I only care a: to teach MS a lesson and b: to annoy the "developers" scamming people. I don't care enough to sign up for FB. Every other company I've dealt with on this, except some of the large media companies, have been easy enough to contact about the problem. To be clear, the issue is: Windows users using the Windows search feature, or directly using the Windows Store, are presented with fake FB apps claiming to be official. Contacting MS support gets useless replies, as they are trying to pump their app counts. Meanwhile, normal users end up installing a potentially malicious app, claiming to be the official FB app. FB needs to send a takedown.
    - ryanburk 12y ago
      things might have changed over the past 12 months, but if you report an app from the store app in windows 8, the report gets looked at and they were good about removing apps that had issues. I say this since I went through this process myself about a year ago and the app I reported was taken down. full disclosure: I worked on the app store team, but didn't use any internal mechanism.
      - MichaelGG 12y ago
        I've been going through this recently quite a bit. Reporting stuff is a waste of time, except for entertainment purposes. I've reported all sorts of things. In nearly every single case, they say they cannot do anything. Even when there's a fake DropBox app "by" "@Microsoft". In that case, the CSR told me to try re-installing the app, that it worked for him. Zero understanding of the issue. I've found a fake Windows Update on the Store. Reporting it got a generic response, until I emailed the MS security folks. Then it was removed in a few minutes. Meanwhile, they suggest I "Leave a review" or email the developer. Idiotic. Netflix went back and forth with MS at least 3 times. Amazon had issues as well. Other ISVs tell me they can simply not get MS to be responsive about things. Disney was the funniest response. Despite being a major Store publisher, there's all sorts of fake Disney stuff online. When I spoke to the Disney Store about it, the final suggestion was "don't go on it [the Windows Store]". Neato. It's obvious MS is just padding the app numbers and no review is actually happening. It's a shame, since it undermines all the work; the Windows Store is a joke even with casual users. (Like even meeting random people on a plane and asking.) I emailed Satya. I emailed the GM of the Store. I emailed the Dev evangelist pushing the "let's pay people in third world countries 4 months salary for publishing 20 shitty wrap-a-webpage apps" program. No replies. Here's a gallery of some gems: http://imgur.com/a/xvqZg#0 http://imgur.com/a/xvqZg#0 But nothing beats this awesomeness: http://imgur.com/fLOWMI4 http://imgur.com/fLOWMI4 I really hope they enable an Android compat layer. Even if it's slow, A: tons of random utility apps will be available, B: MS can enforce some quality instead of quantity. I find it hard to believe MS isn't aware of these issues, unless no one actually uses it (Win10 makes it more in-your-face, though). Someone must have a bonus that's tied to "published app count". Neither Apple nor Google have these issues. The Store is worse than the Android Marketplace was.
wslh 12y ago
$ 12,500 is not a lot of money for this kind of work, if he is hired to find the same bugs he will earn much more.
- rosser 12y ago
  ...especially if he can put that he's gotten that big a payout from Facebook's bug bounty program on his résumé. This isn't (generally) about the absolute dollar amount. It's a prestige thing, it's a pride thing, and it's an accomplishment thing. For the preponderance of people that participate in bug bounties, the money is probably very much secondary.
- lbotos 12y ago
  While this is absolutely true, I know some people that like to do this type of stuff for "fun" and the bounty is just icing on the cake. It also won't hurt him in finding that kind of work in the future.
  - DenisM 12y ago
    Yeah, I feel it's more about earning respect than making a living. "I made $10k just for a quick hack"[1] has enormous bragging value - it's both a large enough payout for that, and it can actually be used without going to jail. Much better than actually bringing Facebook down. [1] It doesn't matter how much work went into finding the exploit, one can still brag about doing it left-handed in 5 minutes.
- dsacco 12y ago
  I understand your sentiment here, but that's a difficult comparison. Friends of mine make more money hunting bug bounties each year than their (competitive) full time salaries as consultants or developers. These sorts of things are publicly verifiable - Michal Zalewski has commented on it before as a member of the Google appsec team, and if you look on Twitter for writeups from the same folks you come to the same conclusion. I have in mind one particular friend who literally bankrupted a bug bounty in three hours. Another security researcher by the name of Nicholas Gregoire earned $35,000 combined from Yahoo and Facebook for a single vulnerability in each company - both server-side request forgery. He found it in Yahoo's YQL console, then decided to look elsewhere for it in a very deterministic fashion, and came across it in Parse (Facebook). He found many more bugs in a period of a few months, but he explicitly didn't look as seriously as some people do, which entails actively tracking acquisitions by companies like Google and Facebook. It can be something of a meat grinder, but finding bug bounties is extremely profitable work. Then of course, having this work on a rèsumè is an immediate step up for getting interviews.
enjoy-your-stay 12y ago
It probably also gives somebody discovering the flaw a disincentive for exploiting it just for fun and then bragging about it since there will be no payout in that case.
deleted 12y ago
[deleted]
legohead 12y ago
For the seriousness of this bug 12k doesn't seem like much to me. I don't know if I would turn it in for that little. With my personal dislike of facebook, the alternative is so very, very tempting..
- tptacek 12y ago
  That alternative being...
  - o_____________o 12y ago
    Ruining his aunt's birthday memories? It would ultimately be the hapless users who suffer in some way.
    - robryan 12y ago
      Doubt you would do any real damage, I believe in the past it has been noted that deleting photos on Facebook won't remove the actual images from their servers. So it is likely possible that they could simply identify photos deleted in this way and restore them.
  - saganus 12y ago
    I'm guessing the alternative he's referring to is the black market. However I'm not sure if the risk being caught is considered in this. If you can get let's say, X times more in the black market but also risk 10 or 20 or whatever years in jail as well, I'm not sure those 12.5k seem that bad. Edit: Or maybe doing extortion on someone? but how much could you get by threatening to delete someone's photos? I'm guessing not much... no?
  - benmanns 12y ago
    Short FB, delete everyone's photos, buy FB.
    - evgen 12y ago
      And then go to jail. Great plan there...
fidz 12y ago
> Facebook theoretically loses $22,453 for every minute their website is down. Any reference for this?
- saneem 12y ago
  It was mentioned on a Techcrunch article[1]. Annual earnings/Time. [1] http://techcrunch.com/2014/09/03/why-is-facebook-down/ http://techcrunch.com/2014/09/03/why-is-facebook-down/
- deleted 12y ago
  [deleted]

deleted 12y ago

[deleted]

deleted 12y ago
[deleted]

MichaelGG 12y ago

Yet there's no way to tell FB about problems without having an account (that I could find in 5 minutes). I found potential phishing attempts in the Windows Store, suggested apps right from the start menu. MS refuses to do anything about phishing/scams on their store, and FB offers no way to contact them (I tried a few email addresses like legal@, to no response).

jessaustin 12y ago
Yeah there's no way that's enough money to submit to creating a FB account. [only half-joking... EDIT: three-quarters?]
compbio 12y ago
You can (and preferably should) use a Whitehat Test Account to perform your research/make your report: https://www.facebook.com/whitehat/accounts/ https://www.facebook.com/whitehat/accounts/ apps.facebook.com (Facebook Windows Store) is not in the scope of this bug bounty program though.
- MichaelGG 12y ago
  I'm just trying to let FB know of a potential phishing attempt that's targeting all Windows users. I don't care about the bounty, in fact I only care a: to teach MS a lesson and b: to annoy the "developers" scamming people. I don't care enough to sign up for FB. Every other company I've dealt with on this, except some of the large media companies, have been easy enough to contact about the problem. To be clear, the issue is: Windows users using the Windows search feature, or directly using the Windows Store, are presented with fake FB apps claiming to be official. Contacting MS support gets useless replies, as they are trying to pump their app counts. Meanwhile, normal users end up installing a potentially malicious app, claiming to be the official FB app. FB needs to send a takedown.
  - ryanburk 12y ago
    things might have changed over the past 12 months, but if you report an app from the store app in windows 8, the report gets looked at and they were good about removing apps that had issues. I say this since I went through this process myself about a year ago and the app I reported was taken down. full disclosure: I worked on the app store team, but didn't use any internal mechanism.
    - MichaelGG 12y ago
      I've been going through this recently quite a bit. Reporting stuff is a waste of time, except for entertainment purposes. I've reported all sorts of things. In nearly every single case, they say they cannot do anything. Even when there's a fake DropBox app "by" "@Microsoft". In that case, the CSR told me to try re-installing the app, that it worked for him. Zero understanding of the issue. I've found a fake Windows Update on the Store. Reporting it got a generic response, until I emailed the MS security folks. Then it was removed in a few minutes. Meanwhile, they suggest I "Leave a review" or email the developer. Idiotic. Netflix went back and forth with MS at least 3 times. Amazon had issues as well. Other ISVs tell me they can simply not get MS to be responsive about things. Disney was the funniest response. Despite being a major Store publisher, there's all sorts of fake Disney stuff online. When I spoke to the Disney Store about it, the final suggestion was "don't go on it [the Windows Store]". Neato. It's obvious MS is just padding the app numbers and no review is actually happening. It's a shame, since it undermines all the work; the Windows Store is a joke even with casual users. (Like even meeting random people on a plane and asking.) I emailed Satya. I emailed the GM of the Store. I emailed the Dev evangelist pushing the "let's pay people in third world countries 4 months salary for publishing 20 shitty wrap-a-webpage apps" program. No replies. Here's a gallery of some gems: http://imgur.com/a/xvqZg#0 http://imgur.com/a/xvqZg#0 But nothing beats this awesomeness: http://imgur.com/fLOWMI4 http://imgur.com/fLOWMI4 I really hope they enable an Android compat layer. Even if it's slow, A: tons of random utility apps will be available, B: MS can enforce some quality instead of quantity. I find it hard to believe MS isn't aware of these issues, unless no one actually uses it (Win10 makes it more in-your-face, though). Someone must have a bonus that's tied to "published app count". Neither Apple nor Google have these issues. The Store is worse than the Android Marketplace was.

wslh 12y ago

$ 12,500 is not a lot of money for this kind of work, if he is hired to find the same bugs he will earn much more.

rosser 12y ago
...especially if he can put that he's gotten that big a payout from Facebook's bug bounty program on his résumé. This isn't (generally) about the absolute dollar amount. It's a prestige thing, it's a pride thing, and it's an accomplishment thing. For the preponderance of people that participate in bug bounties, the money is probably very much secondary.
lbotos 12y ago
While this is absolutely true, I know some people that like to do this type of stuff for "fun" and the bounty is just icing on the cake. It also won't hurt him in finding that kind of work in the future.
- DenisM 12y ago
  Yeah, I feel it's more about earning respect than making a living. "I made $10k just for a quick hack"[1] has enormous bragging value - it's both a large enough payout for that, and it can actually be used without going to jail. Much better than actually bringing Facebook down. [1] It doesn't matter how much work went into finding the exploit, one can still brag about doing it left-handed in 5 minutes.
dsacco 12y ago
I understand your sentiment here, but that's a difficult comparison. Friends of mine make more money hunting bug bounties each year than their (competitive) full time salaries as consultants or developers. These sorts of things are publicly verifiable - Michal Zalewski has commented on it before as a member of the Google appsec team, and if you look on Twitter for writeups from the same folks you come to the same conclusion. I have in mind one particular friend who literally bankrupted a bug bounty in three hours. Another security researcher by the name of Nicholas Gregoire earned $35,000 combined from Yahoo and Facebook for a single vulnerability in each company - both server-side request forgery. He found it in Yahoo's YQL console, then decided to look elsewhere for it in a very deterministic fashion, and came across it in Parse (Facebook). He found many more bugs in a period of a few months, but he explicitly didn't look as seriously as some people do, which entails actively tracking acquisitions by companies like Google and Facebook. It can be something of a meat grinder, but finding bug bounties is extremely profitable work. Then of course, having this work on a rèsumè is an immediate step up for getting interviews.

enjoy-your-stay 12y ago

It probably also gives somebody discovering the flaw a disincentive for exploiting it just for fun and then bragging about it since there will be no payout in that case.

deleted 12y ago

[deleted]

legohead 12y ago

For the seriousness of this bug 12k doesn't seem like much to me. I don't know if I would turn it in for that little. With my personal dislike of facebook, the alternative is so very, very tempting..

tptacek 12y ago
That alternative being...
- o_____________o 12y ago
  Ruining his aunt's birthday memories? It would ultimately be the hapless users who suffer in some way.
  - robryan 12y ago
    Doubt you would do any real damage, I believe in the past it has been noted that deleting photos on Facebook won't remove the actual images from their servers. So it is likely possible that they could simply identify photos deleted in this way and restore them.
- saganus 12y ago
  I'm guessing the alternative he's referring to is the black market. However I'm not sure if the risk being caught is considered in this. If you can get let's say, X times more in the black market but also risk 10 or 20 or whatever years in jail as well, I'm not sure those 12.5k seem that bad. Edit: Or maybe doing extortion on someone? but how much could you get by threatening to delete someone's photos? I'm guessing not much... no?
- benmanns 12y ago
  Short FB, delete everyone's photos, buy FB.
  - evgen 12y ago
    And then go to jail. Great plan there...

fidz 12y ago

> Facebook theoretically loses $22,453 for every minute their website is down. Any reference for this?

saneem 12y ago
It was mentioned on a Techcrunch article[1]. Annual earnings/Time. [1] http://techcrunch.com/2014/09/03/why-is-facebook-down/ http://techcrunch.com/2014/09/03/why-is-facebook-down/
deleted 12y ago
[deleted]