Instagram's Million Dollar Bug

Post by brazzledazzle » Fri, Dec 18, 2015, 8:58 AM UTC

jasonlotito wrote: post #351

yeukhon wrote: post #291

Earlier quoted context omitted.

If you read the article, his company does security research and found a vulnerability in Hotmail. Plus he was using his company's email address. > At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marke…

The Facebook reply does not state that he was using his company email address to report issues or to communicate prior to them reaching out. The researcher says that he only used the email after Facebook got his employer involved. The Facebook post does not, in any way, contest that.

Post by bechampion » Fri, Dec 18, 2015, 9:15 AM UTC

ryanlol wrote: post #146

The fact that Alex Stamos from Facebook contacted this researchers employer talking about potential lawsuits to threaten the employee via a proxy is probably the single most damning thing in the entire article. That to me is entirely unacceptable, if you want to threaten someone then have your legal team send them a cease and desist. Don't go after their livelihood.

Post by bambax » Fri, Dec 18, 2015, 9:29 AM UTC

lsaferite wrote: post #400

tptacek wrote: post #365

Earlier quoted context omitted.

If he had told Facebook that at the same time as he reported the credentials he harvested from the database --- which his timeline suggests he could have --- I'd agree with you. But he didn't. He put the credentials in his back pocket so he could pull them out when they suggested he hadn't found his "million dollar bug". And so for a month after they fixed the bug, some fucking rando is walking around with credential…

I think the point is that, after the first bug report those credentials SHOULD NOT WORK because their job should have included revoking ANYTHING that system have access to. How did they know Wes was the first person to find that bug and the linked credentials? So, the fact that those credentials still worked a month later is a HUGE FUCKING DEAL! Alex, the consummate professional, didn't do his job and instead had a k…

Post by sangnoir » Fri, Dec 18, 2015, 9:52 AM UTC

slantyyz wrote: post #285

tptacek wrote: post #239

Earlier quoted context omitted.

Alex has in the last few months built one of the best teams in application security at Facebook (Facebook security is now seemingly most of O.G. iSEC Partners). I get it, everyone hates big companies and especially Facebook evil Facebook but, come on. They know what they're doing. If you understand how security works inside of big companies, this is a really silly theory to run with. CSOs are happy when shit like thi…

>> Delete the keys or I have to tell legal what's happening. >> The researcher NEEDED TO HEAR THAT. I'm not in security, but from the outside looking in, how things worked out just doesn't smell right. If "the researcher NEEDED TO HEAR THAT" is the priority, then why waste time looking up who the guy works for and calling them instead? The simplest and most obvious way to tell the researcher is to tell him directly i…

Post by sangnoir » Fri, Dec 18, 2015, 9:59 AM UTC

argonaut wrote: post #488

ossreality wrote: post #458

Earlier quoted context omitted.

I get your point in these threads, but unless I'm misunderstanding, who cares about stolen, potentially undeleted Amazon creds? Revoke the key in the portal and be done with it? Given who I'm replying to, I'm assuming that I'm missing some key piece of the puzzle. (And I totally acknowledge it doesn't change the circumstances of what either side has done, I'm just curious)

The point is, having those is a prosecute-able offense, if Facebook chose to prosecute. So it's a big threshold to cross legally, even if not meaningful from a programmer's perspective.