Instagram's Million Dollar Bug

Post by elcct » Thu, Dec 17, 2015, 10:49 PM UTC

dsacco wrote: post #69

As a security researcher and engineer, I'd like to point out the following, without taking sides: 1. Facebook is not going ballistic because this is a RCE report. They have received high and critical severity reports many times before and acted peaceably, up to and including a prior RCE reported in 2013 by Reginaldo Silva (who now works there!). 2. The researcher used the vulnerability to dump data. This is well know…

Post by tptacek » Thu, Dec 17, 2015, 10:50 PM UTC

hitekker wrote: post #159

tptacek wrote: post #92

Earlier quoted context omitted.

I don't know. I feel bad for Alex but if we want to suggest that Facebook's vulnerability disclosure policy was poorly written, I will ruefully agree. When you stand up a bug bounty program, you are giving strangers permission to do something that they would otherwise be prosecuted for doing. You should be extraordinarily careful when you do that, and your rules of engagement should be crystal clear. These weren't.

EDIT: Having read the CSO's explanation that the guy was using his company work email, it makes more sense why the CSO would contact the company (and explains away the pettiness my comment was referring to) One thing I notice: if the CSO felt like this person did something grossly illegal and irresponsible, why not go straight to the police? Why instead go to the man's employer and speak passively aggressively? Parad…

Post by bigiain » Thu, Dec 17, 2015, 10:50 PM UTC

tptacek wrote: post #112

encoderer wrote: post #107

Earlier quoted context omitted.

I don't know much about this which is why I asked. It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all rce bugs should be paid out on an assumption that if used they'll lead to access to a shell or to user data.

Severity on a vulnerability assessment is based on the bug itself; it's the severity of the RCE.

Post by elcct » Thu, Dec 17, 2015, 10:52 PM UTC

tptacek wrote: post #154

blazespin wrote: post #147

Earlier quoted context omitted.

The problem that Alex is skimming over here is that if Wes got access to this data, you have to ask yourself - WHO ELSE GOT THE DATA? If Alex knows anything about his job he should know that he has to refresh all those keys even if Wes didn't report it or say anything. The diff between Wes and everyone else is Wes just explained to Facebook how completely screwed they are. Alex is just pissed because Wes made it blun…

Alex has been a vulnerability research since the 1990s, and co-ran iSEC Partners, one of the best-known software security firms in the world, through the 2000s. I'm pretty sure they're on top of the key situation.

Post by blazespin » Thu, Dec 17, 2015, 10:53 PM UTC

droopybuns wrote: post #153

dsacco wrote: post #69

As a security researcher and engineer, I'd like to point out the following, without taking sides: 1. Facebook is not going ballistic because this is a RCE report. They have received high and critical severity reports many times before and acted peaceably, up to and including a prior RCE reported in 2013 by Reginaldo Silva (who now works there!). 2. The researcher used the vulnerability to dump data. This is well know…

Running a bug bounty is not a suicide pact. A team had to convince a finance group that it was valuable to give money away to people who might be assholes. Bounty hunters are not a community- but if you are a bounty hunter, you should understand that many of your peers are total assholes. The company that wants to pay you a reward has to figure out if you are going to make them regret offering you a reward. There are…