Instagram's Million Dollar Bug • Hacker News Board

Re: Instagram's Million Dollar Bug

#21

Post by onewaystreet » Thu, Dec 17, 2015, 9:19 PM UTC

phantarch wrote: post #13

onewaystreet wrote: post #7

> With the RCE it was simple to read the configuration file to gain the credentials necessary for this database. I connected and dumped the contents of the users table. This was his mistake. This is a huge no-no. You never dump data unless you have permission. It's against the terms of most bounty programs.

But like he said in the article, he was unable to find a clear policy that gave him the "Stop, no further" point. It may have been a bad assumption to think Facebook was going with the Tumblr stance of "give us a thorough POC," but where should he have drawn the line in his hack and why here instead of where he did?

At the line right above the one I quoted:

> As described above, I used the web interface to gain code execution, but at this point I still hadn't actually gained access to the web interface as a normal user.

He had code execution, there was no need for him to go any further.

Re: Instagram's Million Dollar Bug

#22

Post by tptacek » Thu, Dec 17, 2015, 9:19 PM UTC

Zikes wrote: post #5

Facebook's calling his employer could be slanderous, possibly even criminal harassment. Between stories like this demonstrating companies' apparent lack of understanding of whitehat infosec, and Weev's incarceration demonstrating the American legal system's apparent lack of understanding of whitehat infosec, it's hard to believe people still participate in such endeavors.

No, it can't be either of those things.

Re: Instagram's Million Dollar Bug

#23

Post by dperfect » Thu, Dec 17, 2015, 9:19 PM UTC

Not only did this person make several large and irresponsible mistakes in the process of uncovering and reporting the bug (dumping tons of private user information without permission, going far beyond simply discovering and reporting the bug, etc.), but they also keep referring to Ruby ("running Ruby 3.x, which is susceptible to code execution via the Ruby session cookie") as the vulnerable piece, when in reality, it's the version of Rails that had the vulnerability.

Re: Instagram's Million Dollar Bug

#24

Post by nathanvanfleet » Thu, Dec 17, 2015, 9:20 PM UTC

Sort of an interesting conflict these bug bounties create. You have someone who wants to hack as deeply as possible to have a bigger bug bounty based on stated rules, but at the same time they will invalidate your bounty if they arbitrarily determine it as too much?

I imagine the initial report by his friend that the server was accessibly would not be a very high paying bounty compared to one accessing the server. But how deep is too deep?

Re: Instagram's Million Dollar Bug

#25

Post by dogecoinbase » Thu, Dec 17, 2015, 9:21 PM UTC

oldmanjay wrote: post #16

phantarch wrote: post #13

Earlier quoted context omitted.

But like he said in the article, he was unable to find a clear policy that gave him the "Stop, no further" point. It may have been a bad assumption to think Facebook was going with the Tumblr stance of "give us a thorough POC," but where should he have drawn the line in his hack and why here instead of where he did?

Getting the credentials is clearly enough to prove the point. Digging through user data is just celebrating.

Whereof one cannot speak, one should be silent. Dumping the user table is the literal next step in a standard vulnerability assessment (in order to acquire reused credentials), wasn't prohibited by the terms of FB's bug bounty program, and was crucial to the development of the bug.

Re: Instagram's Million Dollar Bug

#26

Post by guard-of-terra » Thu, Dec 17, 2015, 9:21 PM UTC

Once again we see how people act hard-ass in sight of gaping vulnerability in their system. Be it law system, computer system or moral system, you will see denial and intimidation.

We should have "pastebin hat" list and Facebook should definitely be on it.

The problem with humans is that they will rather go extinct over such things than behave properly. You could try to teach us by painful example but death will probably come first.

Re: Instagram's Million Dollar Bug

#27

Post by joslin01 » Thu, Dec 17, 2015, 9:21 PM UTC

The thing that gets to me is the lack of gratitude on Facebook's end. Instead, they turn him into the villain for breaking imaginary rules. What would have been the harm in slapping him on the wrist and giving him some sort of reward for exposing a huge vulnerability? Instead, they eat the reward and shit on the guy who produced it. Real classy FB.

Re: Instagram's Million Dollar Bug

#28

Post by Garthex » Thu, Dec 17, 2015, 9:23 PM UTC

Cached version: https://webcache.googleusercontent.com/search?q=cache:vR9o3U...

Re: Instagram's Million Dollar Bug

#29

Post by ErrantX » Thu, Dec 17, 2015, 9:23 PM UTC

phantarch wrote: post #13

onewaystreet wrote: post #7

> With the RCE it was simple to read the configuration file to gain the credentials necessary for this database. I connected and dumped the contents of the users table. This was his mistake. This is a huge no-no. You never dump data unless you have permission. It's against the terms of most bounty programs.

But like he said in the article, he was unable to find a clear policy that gave him the "Stop, no further" point. It may have been a bad assumption to think Facebook was going with the Tumblr stance of "give us a thorough POC," but where should he have drawn the line in his hack and why here instead of where he did?

In the absence of a clear guideline, Researcher101 should kick in; it was clearly the wrong thing to do.

An apparent refusal to admit that in the write up is making it hard to put 100% support behind him.

There is no excuse: dumping the user table was too far.

Facebook went rather far too, of course.

Re: Instagram's Million Dollar Bug

#30

Post by cjbprime » Thu, Dec 17, 2015, 9:23 PM UTC

tptacek wrote: post #20

In stories like this, try first to remember that Facebook isn't a single entity with a single set of opinions, but rather a huge collection of people who came to the company at different times and different points in their career. Alex Stamos is a good person† who has been doing vulnerability research since the 1990s. He's built a reputation for understanding and defending vulnerability researchers. He hasn't been at…

> I assume the AWS resources have been rekeyed by now

It doesn't look like the SSL cert on instagram.com has changed recently, and the pentester specifically claims to have obtained its private key.