Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram's Million Dollar Bug

exfiltrated.com

Post reply on HN
Print view View original

81–90 of 562 posts

Re: Instagram's Million Dollar Bug

#81

Post by tptacek »

encoderer wrote: post #78
tptacek wrote: post #71

Earlier quoted context omitted.

No, this is not the point of bug bounties. The point of a bug bounty is to find and fix bugs. That's why they're called "bug bounties". This person took a bug bounty and ran it as a penetration test. Facebook fixed the one bug he found and paid him for it.

What is the protocol for assuming that a bug might have previously been exploited and keys already compromised? Is that just not worried about unless they see evidence in logs?

I don't know, but that's the security team's job; it is emphatically not the job of a bug bounty researcher to do that.

Re: Instagram's Million Dollar Bug

#82

Post by rileymat2 »

troebr wrote: post #66
daveloyall wrote: post #38

In my opinion, the author is feigning shock... He claims to have downloaded the content listed below. And he is surprised that Facebook responds coldly? Note the string "private keys" in this list... Doesn't the author know how long it will take them to recover from this breech? How much it will cost them? On the other hand, it does sort of re-enforce the idea that he should be paid handsomely, doesn't it? :) * Stati…

I would tend to agree. Facebook's point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view though. "See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user, and then I'm just one click away from accessing all the instagram pictures I want." Although Facebook's handling of the…

"See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user"

However, these weak passwords could have been exploited separately as part of an attack. It is fair to call it a new vulnerability, even though it was discovered by exploiting the first vulnerability.

Re: Instagram's Million Dollar Bug

#83

Post by [deleted] »

cjbprime wrote: post #30
tptacek wrote: post #20

In stories like this, try first to remember that Facebook isn't a single entity with a single set of opinions, but rather a huge collection of people who came to the company at different times and different points in their career. Alex Stamos is a good person† who has been doing vulnerability research since the 1990s. He's built a reputation for understanding and defending vulnerability researchers. He hasn't been at…

> I assume the AWS resources have been rekeyed by now It doesn't look like the SSL cert on instagram.com has changed recently, and the pentester specifically claims to have obtained its private key.

[deleted]

Re: Instagram's Million Dollar Bug

#84

Post by tptacek »

joslin01 wrote: post #76
tptacek wrote: post #65

Earlier quoted context omitted.

Nobody is going to pay you a million dollars in 2015 for the 2013 Rails YAML bug in a stale server. Nobody is going to pay you a million dollars for a reliable Firefox RCE, and those take months to prove out and develop, and there's a liquid market for them.

But that's not going to stop Facebook from publicizing that they will. You're glossing over the details and attributing an aire of "old news" to the bug. Well, yes / no. If he didn't find such an ancient bug but instead someone devious did, they could have dumped all the private user photos. If that happened, what do you think the financial implications might have been?

He got $2500 for that bug. I will venture a guess that that's the most any bug bounty program will pay for that Rails YAML bug in 2015.

Re: Instagram's Million Dollar Bug

#85

Post by tptacek »

emerongi wrote: post #77
dogecoinbase wrote: post #52

Earlier quoted context omitted.

You're HN's anointed expert, so I suppose all I can say is that's not my experience. Among the many reasons bug bounties are bad ideas is that they generally fail to write clear rules -- as Facebook did. As written, what he did is not against the rules and while it may fall into some best-practices bucket you assert to be universal, that's hardly sufficient for a field in which participants can come from any backgrou…

I agree. If there's no clear rule "all data stays in our network", dumping data is not an unreasonable move. I don't care whether some experts in their offices mull about what's alright to do in a pentest or when finding vulnerabilities for a bounty program - most people aren't experts in that sector, so better make it clear. The researcher is in the right here.

Not only is dumping data an unreasonable move, but it's one that will get you referred to prosecutors. That didn't happen here, but it just did happen somewhere else last week. Don't ever do that.

Re: Instagram's Million Dollar Bug

#86

Post by sanderjd »

danso wrote: post #68
Animats wrote: post #53

The initial bug in Ruby/Rails is striking in its stupidity.[1] You can send something to Ruby/Rails in a session cookie which, when unmarshalled, stores into any named global variable in the namespace of the responding program . It's not a buffer overflow or a bug like that. It's deliberately designed to work that way . It's like doing "eval" on untrusted input. This was on YC years ago.[2] Why was anything so idioti…

I think you're overextrapolating here, though I admit my knowledge on this isn't totally up to date. As I understand it, Ruby's Marshal function, which takes text data and deserializes it, is not safe by default . So, is that a flaw of Ruby? I guess ...except that this kind of serialization seems to be a standard feature in languages (well, Ruby and Python, the two things I currently use): https://docs.python.org/3/l…

Also, only the server is allowed to put things into the session cookie, which is enforced by checking the cookie's signature which is generated from a key that only the server is supposed to know. Using a "native object" serializer (like Marshal or pickle) for session data and storing the secret token in a file that is easy to accidentally check into source control are both stupid things to do, but they're also common mistakes and you have to do both at the same time for this attack to work, so it seems quite overboard to suggest it was done deliberately.

Re: Instagram's Million Dollar Bug

#87

Post by Qualman »

tptacek wrote: post #71
Qualman wrote: post #62

Earlier quoted context omitted.

Is this not the point of a Whitehat bounty program? To entice someone to discover and disclose a bug in a trustworthy manner? If they react this way, and can't trust people to attempt to find exploitable security holes on their system (even those that yield private keys), then what is the point at all? The only people that find them then, are not going to be as cooperative about it. > Doesn't the author know how long…

No, this is not the point of bug bounties. The point of a bug bounty is to find and fix bugs. That's why they're called "bug bounties". This person took a bug bounty and ran it as a penetration test. Facebook fixed the one bug he found and paid him for it.

Bug bounty appears to be a misnomer in this instance. Facebook is specifically asking for reports of security vulnerabilities in their policy:

> If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away.[1]

Which then begs the question to me: how do you differentiate an acceptable and unacceptable probing of security vulnerabilities when you can't capture the full impact of an issue without attempting to exploit it to its fullest? Because it is certainly not outlined in their policy.

And when you're asking for any whitehat to attempt to discover and disclose security vulnerabilities in your system with only the limpest of guidelines around how to do so, I don't feel that it is warranted to react such as Facebook has here.

[1]: https://www.facebook.com/whitehat

Re: Instagram's Million Dollar Bug

#88

Post by tptacek »

dogecoinbase wrote: post #74
tptacek wrote: post #64

Earlier quoted context omitted.

then responded by threatening a researcher's employment after multiple conciliatory e-mails. That is NOT what happened. Look at the timeline again. * He popped the server. * He submitted the RCE. * He submitted dumped file from the compromise as a finding. * They fixed the RCE. * They told him not to dump files. * They paid out the RCE finding. * A month later, they declined to pay out on the dumped file. * In respon…

The "then" isn't temporally proximal. The quoted e-mails (unless you feel like asserting that they're fake, which I think is the next step in your arguments in this thread) demonstrate that he's trying to work within the unwritten rules of the program and asking for clarification in good faith. Then after that, rather than attempting any communication with his, Stamos threatens his employment. I agree with you that s…

Read the timeline again and then the post.

1. Second finding is declined.

2. New third finding, which includes AWS credentials that this person should not have had, is written and submitted.

3. Stamos calls Synack.

I believe the relative timing of these events is, in fact, established.

Now: stipulate that I'm right, even if you're not sure. Does your opinion of the story change?

Re: Instagram's Million Dollar Bug

#89

Post by hotgoldminer »

tptacek wrote: post #71
Qualman wrote: post #62

Earlier quoted context omitted.

Is this not the point of a Whitehat bounty program? To entice someone to discover and disclose a bug in a trustworthy manner? If they react this way, and can't trust people to attempt to find exploitable security holes on their system (even those that yield private keys), then what is the point at all? The only people that find them then, are not going to be as cooperative about it. > Doesn't the author know how long…

No, this is not the point of bug bounties. The point of a bug bounty is to find and fix bugs. That's why they're called "bug bounties". This person took a bug bounty and ran it as a penetration test. Facebook fixed the one bug he found and paid him for it.

I'll rephrase the question. Is the broader vulnerability apparent based on the first discovery OR does it only become clear the further down the rabbit hole you get?

Re: Instagram's Million Dollar Bug

#90

Post by tptacek »

defen wrote: post #72
tptacek wrote: post #20

In stories like this, try first to remember that Facebook isn't a single entity with a single set of opinions, but rather a huge collection of people who came to the company at different times and different points in their career. Alex Stamos is a good person† who has been doing vulnerability research since the 1990s. He's built a reputation for understanding and defending vulnerability researchers. He hasn't been at…

Thanks for the writeup. Based on what you've written, it sounds like you would have been surprised if Facebook had paid $1 million for the original report (and no further nefarious behavior by OP) since it was probably due to a simple oversight, even though it was a RCE that obviously could have been turned into total ownage of instagram. Is that accurate? If so, what class of vulnerability would make you say "Yep th…

There isn't a parallel universe in which this finding is worth $1,000,000. It it was, every pentester in the country is getting way underpaid, because this is not an uncommon pentest finding.
Post reply on HN