If companies are going to keep trying to get out of paying bounties for insane vulnerabilities like this, white hat researchers will just move onto something else, leaving the bounties to be paid out by the black market. Bounties aside, contacting his employer is a disgusting move.
Instagram's Million Dollar Bug
31–40 of 562 posts
Re: Instagram's Million Dollar Bug
#32> With the RCE it was simple to read the configuration file to gain the credentials necessary for this database. I connected and dumped the contents of the users table. This was his mistake. This is a huge no-no. You never dump data unless you have permission. It's against the terms of most bounty programs.
And if you look at the timeline, it looks like he got away with it the first time:
* Day 1: Report RCE
* Day 2: Report finding from dumped file
* Day 4: RCE's gone
* Day 8: Asked not to dump files using RCEs in the future
* Day 26: Paid out for the RCE.
* Day 40: Bug based on dump is rejected
* Day 41: Report new bug based on dump, which shouldn't have been accessible for over a month!
* Day 41+: All hell breaks loose.
Re: Instagram's Million Dollar Bug
#33Facebook's calling his employer could be slanderous, possibly even criminal harassment. Between stories like this demonstrating companies' apparent lack of understanding of whitehat infosec, and Weev's incarceration demonstrating the American legal system's apparent lack of understanding of whitehat infosec, it's hard to believe people still participate in such endeavors.
No, it can't be either of those things.
What possible motivation did Facebook have for contacting the company with whom this person had a contract employee relationship with, other than to implicitly threaten problems for both? There was no implication that he was doing this other than on his own, and he had cleared it with his employer. Presumably he didn't email Facebook with a corporate email account, and presumably his employer wasn't in a position where Facebook's first assumption would be "corporate espionage! (which was voluntarily reported to a bug bounty program)" - that's disingenuous.
No, it was "We're bigger than you and we have the power to fuck with your life and livelihood", and nothing more.
Re: Instagram's Million Dollar Bug
#34Facebook's calling his employer could be slanderous, possibly even criminal harassment. Between stories like this demonstrating companies' apparent lack of understanding of whitehat infosec, and Weev's incarceration demonstrating the American legal system's apparent lack of understanding of whitehat infosec, it's hard to believe people still participate in such endeavors.
I don't see anything in the description of that call that qualifies as either slander (which requires a false statement of fact) or harassment (which requires a pattern of repeated contact intended to cause emotional distress).
If bringing unrelated parties to dialogue in the background is not harrasment, then what is?
Imagine I will contact your significant other over your comment on HN. Would not you be deeply disturbed even if I do it just once? Bonus points for frivolous legal threats on my side.
Re: Instagram's Million Dollar Bug
#35So if I'm reading this correctly, this massively compromising attack was made possible by doing a little research? e.g. Knowing about one of the admin services used by Instagram, looking in that admin's public repo, and musing whether Instagram had bothered to change the secret key from the default entry in the repo? We'll probably never see a post mortem on this but it'd be interesting to hear how this got moved to…
I can tell you from experience working at another similar company that this is not surprising at all. Especially as startups transition into larger companies (with formal security controls and policies), a lot of things can get missed or forgotten. Your primary production servers may be completely up-to-date and secure, but somewhere along the way, there's a high chance that an engineer deployed an internal admin tool or a test build somewhere that ends up being public, but ultimately lost and forgotten. The problem is, that kind of "lost" infrastructure often contains keys, credentials, or network access to other more critical parts of the infrastructure, and no one realizes the severity of the mistake until it's too late.
Re: Instagram's Million Dollar Bug
#36Earlier quoted context omitted.
Getting the credentials is clearly enough to prove the point. Digging through user data is just celebrating.
Whereof one cannot speak, one should be silent. Dumping the user table is the literal next step in a standard vulnerability assessment (in order to acquire reused credentials), wasn't prohibited by the terms of FB's bug bounty program, and was crucial to the development of the bug.
No, that's the next step in an external penetration test, which is not the same thing as a vulnerability assessment.
In an external pentest, you get a set of netblocks and rules of engagement, and you get as far as you can. That's why it's called a "penetration test".
In a vulnerability assessment, you get a target (usually an application), and you find as many flaws in that target as you can.
Big annual pentests often have wide-open rules of engagements, where you (as a consultant) win big by, for instance, dumping the CEO's mail spool. But those projects also start with several meetings worth of negotiating rules of engagement.
Vulnerability assessments virtually never have those rules of engagement!
Nobody that I know of runs a bug bounty program on pentest norms. To do so would be grossly irresponsible, because on every network with more than 1000 hosts I've ever tested, ever, RCE behind the firewall is gameover for the whole test: you can get everything.
Re: Instagram's Million Dollar Bug
#37Earlier quoted context omitted.
No, it can't be either of those things.
What possible motivation did Facebook have for contacting the company with whom this person had a contract employee relationship with, other than to implicitly threaten problems for both? There was no implication that he was doing this other than on his own, and he had cleared it with his employer. Presumably he didn't email Facebook with a corporate email account, and presumably his employer wasn't in a position whe…
To ensure that this person deleted the credentials they had taken from the server they popped with the RCE, obviously.
Again: read the timeline. He submitted a finding with AWS creds taken from the server he popped on October 22 --- on December 1, more than a month after Facebook shut the server down. He took AWS creds from a Facebook server and saved them on his laptop for more than a month.
WHY?
Re: Instagram's Million Dollar Bug
#38In my opinion, the author is feigning shock...
He claims to have downloaded the content listed below. And he is surprised that Facebook responds coldly? Note the string "private keys" in this list... Doesn't the author know how long it will take them to recover from this breech? How much it will cost them?
On the other hand, it does sort of re-enforce the idea that he should be paid handsomely, doesn't it? :)
* Static content for Instagram.com websites. Write access was not tested, but seemed likely.
* Source code for fairly recent versions of the Instagram server backend, covering all API endpoints, some image processing libraries, etc.
* SSL certificates and private keys, including both instagram.com and *.instagram.com
* Secret keys used to sign authentication cookies for Instagram
* OAuth and other Instagram API keys
* Email server credentials
* iOS and Android app signing keys
* iOS Push Notifications keys
* Twitter API keys
* Facebook API keys
* Flickr API keys
* Tumblr API keys
* Foursquare API keys
* Recaptcha key-pairRe: Instagram's Million Dollar Bug
#39The thing that gets to me is the lack of gratitude on Facebook's end. Instead, they turn him into the villain for breaking imaginary rules. What would have been the harm in slapping him on the wrist and giving him some sort of reward for exposing a huge vulnerability? Instead, they eat the reward and shit on the guy who produced it. Real classy FB.
Did you read the whole post? He got paid on the RCE.
Re: Instagram's Million Dollar Bug
#40Sort of an interesting conflict these bug bounties create. You have someone who wants to hack as deeply as possible to have a bigger bug bounty based on stated rules, but at the same time they will invalidate your bounty if they arbitrarily determine it as too much? I imagine the initial report by his friend that the server was accessibly would not be a very high paying bounty compared to one accessing the server. Bu…
Right? If he left it at the RCE he would have gotten the $2,500 split between him and his friend... but he continued and was able to get access to all the S3 buckets which you would assume would warrant a much higher payout. Instead he got a huge amount of backlash.