3 ms·

Good work. I see a lot of people are surprised at the amount received for this report. Yes, that is typical of both Facebook and Google (and to a lesser extent,

by dsacco 12y ago

Good work. I see a lot of people are surprised at the amount received for this report. Yes, that is typical of both Facebook and Google (and to a lesser extent, Yahoo will pay large sums for particularly bad bugs). They are extremely generous - Facebook recently paid $5000 for a bug report that existed in their careers portal despite that infrastructure being entirely third party. If anyone wants to try and replicate this sort of thing, consider this: the mobile applications (touch.facebook.com, iOS/Android apps) that Facebook use very often take advantage of legacy api calls and code that the main web application has long since disposed of. A well known researcher, Stephen Sclafani ('ssclafani) receiced a bounty of $25,000 for arbitrary account takeover using the legacy api. Legacy code is generally the first place to look for vulnerabilities. Legacy apis which are still allowed to exist for backwards compatibility are prime areas to search for bug bounties. Good luck.

patio11 12y ago
Another good place is at edges of systems, particularly where they rub each other in fraught ways. What's the rule that says that computer systems invariably take on the architecture of the organizations that make them? You can predict Terrible Code Exists Here by getting a list of team names from the target (trivial -- use LinkedIn or ask anyone who works there) and then figuring out where those teams have shipped half-assed worked-on-my-machine glue code to tie their systems together. A common example: any handoff between a marketing site (or email) and a SaaS app more complicated than "Clicking this unchanging link takes you to a login form" almost certainly involves two teams and was somebody's perceived least important thing to do that day.
- taprun 12y ago
  The "rule" that you're thinking of is Conway's Law: http://en.wikipedia.org/wiki/Conway%27s_law http://en.wikipedia.org/wiki/Conway%27s_law
downandout 12y ago
If anyone wants to try and replicate this sort of thing, consider this: the mobile applications (touch.facebook.com, iOS/Android apps) that Facebook use very often take advantage of legacy api calls and code that the main web application has long since disposed of. Agreed. Touch/m.facebook.com have had major holes exist for long after they have been plugged on the main site. It was iframeable long after the main site wasn't (and thus subject to clickjacking). Also, for a long time you could invite anyone to events by Facebook ID by posting the correct calls to the mobile site, essentially without limit, even after the issue was fixed on the main site. Since custom messages could be embedded in the invitations, it was a spam free-for-all.
- deleted 12y ago
  [deleted]
ssclafani 12y ago
Philippe Harewood (@phwd on Twitter) mantains a list of published Facebook bug bounty reports. It's a very good resource for anyone looking to learn about bug bounties and web app security in general: https://www.facebook.com/notes/phwd/facebook-bug-bounties/707217202701640 https://www.facebook.com/notes/phwd/facebook-bug-bounties/70...
drubio 12y ago
I think this post is a hoax. A lot of things don't add up. I thought there would be more interesting security posts and this is the only post on the entire site. The site was registered just 2 days ago, see http://www.whois.com/whois/7xter.com http://www.whois.com/whois/7xter.com . Then if you search on Google for the email that registered the site (laksshmanan51@gmail.com) you get this http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi.. http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi.... that has "You can earn huge using your Facebook page. Please let me know if you are interested. Shoot me a mail laksshmanan51@gmail.com"

by dsacco 12y ago

patio11 12y ago

Another good place is at edges of systems, particularly where they rub each other in fraught ways. What's the rule that says that computer systems invariably take on the architecture of the organizations that make them? You can predict Terrible Code Exists Here by getting a list of team names from the target (trivial -- use LinkedIn or ask anyone who works there) and then figuring out where those teams have shipped half-assed worked-on-my-machine glue code to tie their systems together. A common example: any handoff between a marketing site (or email) and a SaaS app more complicated than "Clicking this unchanging link takes you to a login form" almost certainly involves two teams and was somebody's perceived least important thing to do that day.

taprun 12y ago
The "rule" that you're thinking of is Conway's Law: http://en.wikipedia.org/wiki/Conway%27s_law http://en.wikipedia.org/wiki/Conway%27s_law

downandout 12y ago

If anyone wants to try and replicate this sort of thing, consider this: the mobile applications (touch.facebook.com, iOS/Android apps) that Facebook use very often take advantage of legacy api calls and code that the main web application has long since disposed of. Agreed. Touch/m.facebook.com have had major holes exist for long after they have been plugged on the main site. It was iframeable long after the main site wasn't (and thus subject to clickjacking). Also, for a long time you could invite anyone to events by Facebook ID by posting the correct calls to the mobile site, essentially without limit, even after the issue was fixed on the main site. Since custom messages could be embedded in the invitations, it was a spam free-for-all.

deleted 12y ago
[deleted]

ssclafani 12y ago

Philippe Harewood (@phwd on Twitter) mantains a list of published Facebook bug bounty reports. It's a very good resource for anyone looking to learn about bug bounties and web app security in general: https://www.facebook.com/notes/phwd/facebook-bug-bounties/707217202701640 https://www.facebook.com/notes/phwd/facebook-bug-bounties/70...

drubio 12y ago

I think this post is a hoax. A lot of things don't add up. I thought there would be more interesting security posts and this is the only post on the entire site. The site was registered just 2 days ago, see http://www.whois.com/whois/7xter.com http://www.whois.com/whois/7xter.com . Then if you search on Google for the email that registered the site (laksshmanan51@gmail.com) you get this http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi.. http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi.... that has "You can earn huge using your Facebook page. Please let me know if you are interested. Shoot me a mail laksshmanan51@gmail.com"