Instagram's Million Dollar Bug • Hacker News Board

Re: Instagram's Million Dollar Bug

#371

Post by argonaut » Fri, Dec 18, 2015, 2:20 AM UTC

jldugger wrote: post #328

tptacek wrote: post #90

Earlier quoted context omitted.

There isn't a parallel universe in which this finding is worth $1,000,000. It it was, every pentester in the country is getting way underpaid, because this is not an uncommon pentest finding.

What about the parallel universe in which bug bounty hunters are blackhats who directly profit from the exploit? It seems like someone with that level of access could run up, among other things, a decent AWS bill.

I don't know about you, but I value the certainty of not losing a few years of my life to court proceedings/jail time at significantly above $50M.

Re: Instagram's Million Dollar Bug

#372

Post by jldugger » Fri, Dec 18, 2015, 2:24 AM UTC

argonaut wrote: post #371

jldugger wrote: post #328

Earlier quoted context omitted.

What about the parallel universe in which bug bounty hunters are blackhats who directly profit from the exploit? It seems like someone with that level of access could run up, among other things, a decent AWS bill.

I don't know about you, but I value the certainty of not losing a few years of my life to court proceedings/jail time at significantly above $50M.

Well, obviously we're talking about the mirror universe where nerds get away with things instead of scapegoated. Also goatees everywhere.

Re: Instagram's Million Dollar Bug

#373

Post by [deleted] » Fri, Dec 18, 2015, 2:31 AM UTC

[deleted]

Re: Instagram's Million Dollar Bug

#374

Post by jtwebman » Fri, Dec 18, 2015, 2:33 AM UTC

secalex wrote: post #131

Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

What he did do is expose that you guys don't know how to use aws and S3. Those keys should have never been on a server in the first place. I think it would have been in your best interest to fix it and pay him. Now that other hackers know Instagram sucks at server management it is only time before someone finds another key. Guess what they are not going to do? They are not going to report it but download and sell your info.

Re: Instagram's Million Dollar Bug

#375

Post by bigiain » Fri, Dec 18, 2015, 2:39 AM UTC

tptacek wrote: post #332

bigiain wrote: post #183

Earlier quoted context omitted.

How much do you suppose blackhats would pay for instagram's ssl keys, mobile app signing keys, push notification keys, etc? Yeah, the researcher went deep into the grey area, but I find Alex Stamos's reaction barely short of unbelievable - it's almost as though he's so new to the internet he's never heard of the Streisand Effect... (Either that, or he's just so accustomed to bullying and intimidating people who might…

Not much. Probably much less than $2500. A script to create new bogus accounts on Facebook is probably worth more than mass Facebook account compromise. People really don't seem to understand how the "black market" works.

I was thinking more of the Zerodium/Gleg/BoozAllenHamilton class of buyers - who'd on-sell it to, say, the Egyptian or Thai Government, rather than run-of-the-mill carders or identity thieves.

(But yeah, I'm perfectly happy with my life where I have no real understanding of how the black market for this kind of thing works...)

Re: Instagram's Million Dollar Bug

#376

Post by ianhawes » Fri, Dec 18, 2015, 2:41 AM UTC

I'd like to see a service where a company's source code/database/confidential info is placed in escrow pending the payout from a bug bounty. Or, perhaps more likely, some sort of 3rd-party arbitration.

Re: Instagram's Million Dollar Bug

#377

Post by lawnchair_larry » Fri, Dec 18, 2015, 2:41 AM UTC

secalex wrote: post #131

Thank you to everybody who cautioned against judgment before hearing the whole story. Here is my response: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

Sorry Alex, you're in the wrong here. Your threats to go to law enforcement completely undermine the credibility of your bug bounty program. Your publicly calling another professional "unethical" is a serious charge for what is a grey area at best, and the facts and history of issues reported by this person would not lead a reasonable person to conclude malice. And ignoring him but going to his boss, that's just petty.

Not even one attempt to talk to the guy like an adult about what he was doing? You couldn't even be bothered to say anything?

You'd be amazed how a polite reply to the effect of, "thanks, you've proven your point, and we are getting a little uncomfortable with where this is headed" might have solved all of this. If he ignored you and kept hacking after that, by all means steamroll him, but if you don't even have that much respect for your peers, I'm not sure why you bother with the bounty program.

Re: Instagram's Million Dollar Bug

#378

Post by abrookewood » Fri, Dec 18, 2015, 2:42 AM UTC

blazespin wrote: post #303

In general, if you have a green handle, you shouldn't be commenting on things like this. Otherwise we'll have sock puppets galore muddying the waters.

What does a green handle indicate by the way? I checked the FAQ and there's nothing there.

Re: Instagram's Million Dollar Bug

#379

Post by zapt02 » Fri, Dec 18, 2015, 2:43 AM UTC

sanderjd wrote: post #86

danso wrote: post #68

Earlier quoted context omitted.

I think you're overextrapolating here, though I admit my knowledge on this isn't totally up to date. As I understand it, Ruby's Marshal function, which takes text data and deserializes it, is not safe by default . So, is that a flaw of Ruby? I guess ...except that this kind of serialization seems to be a standard feature in languages (well, Ruby and Python, the two things I currently use): https://docs.python.org/3/l…

Also, only the server is allowed to put things into the session cookie, which is enforced by checking the cookie's signature which is generated from a key that only the server is supposed to know. Using a "native object" serializer (like Marshal or pickle) for session data and storing the secret token in a file that is easy to accidentally check into source control are both stupid things to do, but they're also commo…

Completely right. If the secret server token is compromised, it is presumed that you can fake any data. Should that allow for RCE? That's where Ruby steps in and provides the double whammy.

Re: Instagram's Million Dollar Bug

#380

Post by gbhn » Fri, Dec 18, 2015, 2:45 AM UTC

tomlongson wrote: post #338

itsthecourier wrote: post #309

Earlier quoted context omitted.

Yeah, scaring the guy with his employer and telling him that kind of bug is USD2,500 worth makes me think about how important is my data for them

The hypothetical question Facebook should ask is: "If the security researcher did not disclose the RCE, but instead sold it to highest bidder, how much would that likely pay in this situation?" Paying security researchers to properly disclose is a way of financially encouraging the right behavior. While it may be tough to stomach a large payout for responsible disclosure, do you really want them considering the alter…

Agreed. To me as an outsider, this escalation bug looks a max bug, definitely dwarfing any particular admin console vulnerability, and that the processes the researcher claims to have followed were pretty much necessary to show it. Whether or not this followed the letter of the policy, by responsibly reporting the escalation in the spirit of the policy, the researcher has fulfilled the spirit of the goal.