Instagram's Million Dollar Bug • Hacker News Board

Re: Instagram's Million Dollar Bug

#191

Post by brazzledazzle » Thu, Dec 17, 2015, 11:06 PM UTC

slantedview wrote: post #117

troebr wrote: post #66

Earlier quoted context omitted.

I would tend to agree. Facebook's point is that he found a vulnerability, and exploited it instead of stopping there. I kind of understand their point of view though. "See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user, and then I'm just one click away from accessing all the instagram pictures I want." Although Facebook's handling of the…

Exploiting the bug would have been downloading the actual contents of the S3 bucket (the instagram source and other things). He specifically says he did not do that.

He clearly made a big effort not to violate privacy. The problem is that he made their security look like a joke by getting the keys to the kingdom without anyone noticing. Did that big expensive IDS catch him? Nope. Did any of the log watchers babysitting the AWS logs? Nope. One researcher made the CSO look incompetent in the matter of minutes.

If he had found a bug with something a developer wrote that would be a different story. What he found was layer after layer of Operations (particularly Security Operations) failures. This is something you hire a CSO to think about (or at least hire/manage others to think about).

Re: Instagram's Million Dollar Bug

#192

Post by brazzledazzle » Thu, Dec 17, 2015, 11:08 PM UTC

secalex wrote: post #131

Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

The lesson here is when you find Operations issues (particularly Security Operations) at Facebook don't report them. Those make the CSO look bad directly.

Re: Instagram's Million Dollar Bug

#193

Post by tptacek » Thu, Dec 17, 2015, 11:09 PM UTC

blazespin wrote: post #176

tptacek wrote: post #71

Earlier quoted context omitted.

No, this is not the point of bug bounties. The point of a bug bounty is to find and fix bugs. That's why they're called "bug bounties". This person took a bug bounty and ran it as a penetration test. Facebook fixed the one bug he found and paid him for it.

Which is fine. But threatening to call the cops was really bad.

You don't know that's what happened, even the researcher didn't say that. You're extrapolating.

A much more reasonable and likely explanation of the same set of things we've been told:

Alex Stamos called Synack and said that the AWS credentials, which, by the researchers own admission, he'd chosen to retain long after the vulnerability he reported was fixed, had to be deleted, and that if they weren't and the researcher continued to use them, the situation would be out of Stamos' hands and into Facebook legal's, at which point he couldn't keep him from being prosecuted.

In that interpretation, Alex isn't threatening the researcher; he's (very reasonably) saying "you cannot use these credentials you've taken from the server, and if you keep doing that, I can't take responsibility for how Facebook will handle this, so you should stop right away before you harm yourself."

Re: Instagram's Million Dollar Bug

#194

Post by tdicola » Thu, Dec 17, 2015, 11:09 PM UTC

arasmussen wrote: post #190

tdicola wrote: post #162

Earlier quoted context omitted.

Thanks for the response, but why did you start by contacting the CEO of Synack instead of the researcher directly?

> At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. I feel like that bullet point answers your question pretty well.

I'm more questioning the flow of researcher reports vulnerability, company awards bounty, researcher disputes bounty value, CSO of company contacts CEO of researcher's company. Is that normal escalation procedure?

Re: Instagram's Million Dollar Bug

#195

Post by blazespin » Thu, Dec 17, 2015, 11:11 PM UTC

secalex wrote: post #131

Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

The real question is did you rotate the keys (and do further hardening, I hope!) because of the vuln report Wes made? If so, than you should be grateful for his work pointing out your mistaken single point of failure via AWS S3 security and you should have rewarded him handsomely.

Re: Instagram's Million Dollar Bug

#196

Post by tptacek » Thu, Dec 17, 2015, 11:11 PM UTC

blazespin wrote: post #171

dsacco wrote: post #149

Earlier quoted context omitted.

Assuming that's true (and I personally don't believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It's fully reasonable to escalate to an employer if they seem to be affiliated with the security researcher's report. Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work wi…

No, Alex just assumed. Why didn't he just ask Wes if he was doing this for Synack?

He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook.

He wasn't guessing. He didn't look the guy up on LinkedIn.

Re: Instagram's Million Dollar Bug

#197

Post by gsnedders » Thu, Dec 17, 2015, 11:13 PM UTC

bigiain wrote: post #188

secalex wrote: post #131

Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

So the bits where you lost the ssl keys, auth cookie keys, app signing keys, push notification keys - and had to ask him (via his employer) about what data he'd accessed are all true? Implying you have no records of who else might have done this and acquired those keys? Boggle!

That's one interpretation: the other is that you're placing faith in them being honest, and you'll get a list of what he'd got without the time of doing forensics of the systems, and hence being able to change the keys sooner.

Re: Instagram's Million Dollar Bug

#198

Post by brazzledazzle » Thu, Dec 17, 2015, 11:14 PM UTC

pests wrote: post #172

dhimes wrote: post #126

Earlier quoted context omitted.

As someone outside the infosec industry, I think the dissonance I feel reading this comes from this line: "[Alex] then explained that the vulnerability I found was trivial and of little value" coupled with the fact that he seemed to be very worried about the problems that could be caused by the author in exploiting it. Something seems amiss.

I feel he meant the original RCE Ruby bug which then allowed all this extra access. It was not some huge, architecture-changing security problem, just a simple upgrade to fix.

What he revealed however, was that Facebook doesn't pay attention to least privilege with key access, what those keys access[1] and more importantly where those keys access data from[2]. I have a feeling there's some scrambling to cover these blind spots over at Facebook.

[1] http://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.ht...

[2] http://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.htm...

Re: Instagram's Million Dollar Bug

#199

Post by tptacek » Thu, Dec 17, 2015, 11:14 PM UTC

tdicola wrote: post #194

arasmussen wrote: post #190

Earlier quoted context omitted.

> At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. I feel like that bullet point answers your question pretty well.

I'm more questioning the flow of researcher reports vulnerability, company awards bounty, researcher disputes bounty value, CSO of company contacts CEO of researcher's company. Is that normal escalation procedure?

Wait, you just made something up.

Even the researcher doesn't claim that Alex contacted the CEO of Synack because of a dispute over the bounty.

Rather, it's the other way around: the researcher disputed the bounty, and did so by revealing that he'd retained AWS credentials from Instagram long after they'd closed the vulnerability that he used to get them.

Alex contacted the CEO of Synack to ensure the credentials weren't used, because if they were, Alex couldn't be control Facebook's response: they've got a bug bounty participant who has essentially "gone rogue" and is exploiting Facebook servers long after they've told him to stop. They need him to stop.

Re: Instagram's Million Dollar Bug

#200

Post by bigiain » Thu, Dec 17, 2015, 11:14 PM UTC

larssorenson wrote: post #139

slantedview wrote: post #116

Earlier quoted context omitted.

Key quote: "Since the Faceboook Whitehat rules state that researchers need to "make a good faith effort to avoid privacy violations", I avoided downloading any content from those buckets" Listing the contents of the bucket is very different from fetching them. Without listing the contents, he wouldn't know the severity of the vulnerability. There's nothing wrong with that.

While I'm on his side, his wording seems to indicate he did download data from SOME of the buckets, just not those specifically containing user sensitive data.

I'm of the opinion that not downloading user data, but grabbing source code, backups, and secret keys - is a perfectly reasonable interpretation of "making a good faith effort to avoid privacy violations".