Instagram's Million Dollar Bug

God says... windy Taoist's sleeve's extrusion's dysfunctional aphelions weights armoring phantasm domestication eclipsing maidservant's workingman rakishness's addition bacchanals yak lamentable singed worshipping flyspecking Wheatstone's crumpet's deceives beam Jainism's latecomer acme accounting's arrogance's vine's philanderer deposition's headlock's summing Chartism undergarment's Rivers dippers encumbers jurisdiction imitations momma sartorially gravelly indorsements mushes needlepoint friskiness's restructurings efface readings purser Lazarus's Daisy daze logging's epistles Dutchman's warmers venturesome Jimmie's Andrea's unsuccessful swashed televises incineration garb's importations Siberian's stenographer begin leviathan airdrop recession publicity's analgesic's mischance nicknacks honeycomb Nukualofa beefy training counterrevolutions tuneful gastronomy conformity entrant Thebes gawking stylists landward fiddly Sankara phalanx's Sphinx's nervousness miens reviewed posher

Two things I've learned from this article:

1. Never trust Facebook. If he had signed some messages using their keys and sent it to Wired/NYTimes/etc he'd be getting fame and job offers instead of $1250 and call home to his parents.

2. Ruby programmers are garbage.

Getting the credentials is clearly enough to prove the point. Digging through user data is just celebrating.

In stories like this, try first to remember that Facebook isn't a single entity with a single set of opinions, but rather a huge collection of people who came to the company at different times and different points in their career.

Alex Stamos is a good person† who has been doing vulnerability research since the 1990s. He's built a reputation for understanding and defending vulnerability researchers. He hasn't been at Facebook long.

To that, add the fact that there's just no way that this is the first person to have reported an RCE to Facebook's bug bounty. Ask anyone who does this work professionally: every network has old crufty bug-ridden stuff laying around (that's why we freak out so much about stuff like the Rails XML/YAML bug, Heartbleed, and Shellshock!), and every large codebase has horrible flaws in it. When you run a bug bounty, people spot stuff like this.

So I'm left wondering what the other side of this story is.

Some of the facts that this person wrote up are suggestive of why Facebook's team may have been alarmed.

It seems like what could have happened here is:

1. This person finds RCE in a stale admin console (that is a legit and serious finding!). Being a professional pentester, their instinct is that having owned up a machine behind a firewall, there's probably a bonanza of stuff they now have access to. But the machine itself sure looks like an old deployment artifact, not a valuable asset Fb wants to protect.

2. Anticipating that Fb will pay hundreds and not thousands of dollars for a bug they will fix by simply nuking a machine they didn't know was exposed to begin with, the tester pivots from RCE to dumping files from the machine to see where they can go. Sure enough: it's a bonanza.

3. They report the RCE. Fb confirms receipt but doesn't respond right away.

4. A day later, they report a second "finding" that is the product of using the RCE they already reported to explore the system.

5. Fb nukes the server, confirms the RCE, pays out $2500 for it, declines to pay for the second finding, and asks the tester not to use RCEs to explore their systems.

6. More than a month after Facebook has nuked the server they found the RCE in, they report another finding based on AWS keys they took from the server.

So Facebook has a bug bounty participant who has gained access to AWS keys by pivoting from a Rails RCE on a server, and who apparently has retained those keys and is using them to explore Instagram's AWS environment.

So, some thoughts:

A. It sucks that Facebook had a machine deployed that had AWS credentials on it that led to the keys to the Instagram kingdom. Nobody is going to argue that, though again: every network sucks in similar ways. Sorry.

B. If I was in Alex's shoes I would flip the fuck out about some bug bounty participant walking around with a laptop that had access to lord knows how many different AWS resources inside of Instagram. Alex is a smart guy with an absurdly smart team and I assume the AWS resources have been rekeyed by now, but still, how sure were they of that on December 1?

C. Don't ever do anything like what this person did when you test machines you don't own. You could get fired for doing that working at a pentest firm even when you're being paid by a client to look for vulnerabilities! If you have to ask whether you're allowed to pivot, don't do it until the target says it's OK. Pivoting like this is a bright line between security testing and hacking.

This seems like a genuinely shitty situation for everyone involved. It's a reason why I would be extremely hesitant to ever stand up a bug bounty program at a company I worked for, and a reason why I'm impressed by big companies that have the guts to run bounty programs at all.

† (and, to be clear, a friend, though a pretty distant one; I am biased here.)