Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook exploit – Confirm website visitor identities

tomanthony.co.uk

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Facebook exploit – Confirm website visitor identities

#41

Post by Izmaki »

wolco wrote: post #34
tptacek wrote: post #27

Earlier quoted context omitted.

That's a really good bug! But $5k sounds pretty reasonable, since the only alternative market for it comes with pretty obscene legal risk (unlike an RCE, which will have a whole variety of white- and grey- market buyers, an SEO bug seller knows exactly what their buyer is doing with their work).

If you are in this business you are already connected with grey/black elements. Probably less risky than initially seems.

Plus I think it's safe to assume that they can handle themselves, anonymity wise. Tor and bitcoin is not rocket science

Re: Facebook exploit – Confirm website visitor identities

#42

Post by paxys »

chipperyman573 wrote: post #23
eveningcoffee wrote: post #12

Earlier quoted context omitted.

How much did Google offer for a security bug (if they would have accepted it)?

A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero" http://www.tomanthony.…

Bug bounties don't exist to prevent people from selling exploits on the black market. Those who were going to do so will do it anyways, and companies don't want a scenario where they have to bid against other buyers for such reports.

They simply exist as a small incentive for folks who would have otherwise done nothing.

Re: Facebook exploit – Confirm website visitor identities

#43

Post by paxys »

supernovae wrote: post #3

Is there something in here we're missing? Someone finds exploit, gets the bounty, facebook fixes and we have a timeline. Sounds like the system worked... are we looking for something else here?

Who is complaining about anything? It's a nice article about a neat little exploit, and the process to find it.

Re: Facebook exploit – Confirm website visitor identities

#44

Post by TomAnthony »

tptacek wrote: post #27
chipperyman573 wrote: post #23

Earlier quoted context omitted.

A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero" http://www.tomanthony.…

That's a really good bug! But $5k sounds pretty reasonable, since the only alternative market for it comes with pretty obscene legal risk (unlike an RCE, which will have a whole variety of white- and grey- market buyers, an SEO bug seller knows exactly what their buyer is doing with their work).

OP here. Really interesting to get your take on that. From my (far less security educated) POV the Google XML bug felt less risky from a monetisation angle.

I guess the difference is between exploiting it yourself vs selling it. There was a clear path to monetisation that didn't require selling the exploit on the black market, and which could well fly under the radar (from my reasonably well educated SEO POV).

However, I don't think bug bounties necessarily need to equal the 'market value' of the bug, whatever that means.

Re: Facebook exploit – Confirm website visitor identities

#45

Post by TomAnthony »

patorjk wrote: post #6

I found an exploit like this in Google+ back in 2013 that worked in basically the same fashion (script tag and onload/onerror handlers) to identify users, and to tell if they were apart of certain groups. Google fixed the issue, but later wrote back: > The panel has determined your report did not meet the threshold for a reward or credit in our Hall of Fame. Thank you for reporting this issue and good luck with your…

OP here. I had exact same experience (and was aware of your story!). I also found a similar Google bug which didn't receive a bounty [1].

[1] http://www.tomanthony.co.uk/blog/confirm-google-users-email/

Re: Facebook exploit – Confirm website visitor identities

#46

Post by GoToRO »

tptacek wrote: post #26
ProAm wrote: post #16

Earlier quoted context omitted.

$1000 bounty for this seems really low.

Why? There's no market for this bug. Nobody else will buy it. If you found an equivalent bug in, say, Grubhub, nobody would think it was worth much more than a token bounty. Is it just because Facebook is a big company and can afford to pay more for every bug, or is there a particular reason you think this bug is super valuable?

If you participate in a bug bounty program you already decided you will not sell it on The Market. As such you should be payed for your effort and time at least. Otherwise you sell it to whoever pays more (on The Market).

If you read how much effort is put into just reporting the bug, that will come close to a half month at least. Is $1000 half a security research's salary?

Re: Facebook exploit – Confirm website visitor identities

#47

Post by zulln »

GoToRO wrote: post #46
tptacek wrote: post #26

Earlier quoted context omitted.

Why? There's no market for this bug. Nobody else will buy it. If you found an equivalent bug in, say, Grubhub, nobody would think it was worth much more than a token bounty. Is it just because Facebook is a big company and can afford to pay more for every bug, or is there a particular reason you think this bug is super valuable?

If you participate in a bug bounty program you already decided you will not sell it on The Market. As such you should be payed for your effort and time at least. Otherwise you sell it to whoever pays more (on The Market). If you read how much effort is put into just reporting the bug, that will come close to a half month at least. Is $1000 half a security research's salary?

That is a strange way of thinking about it. Should not Facebook instead incentivize the kind of bug they are interested in, rather than caring how long time it took to find?

Re: Facebook exploit – Confirm website visitor identities

#48

Post by notafrog »

wolco wrote: post #35
air7 wrote: post #19

I once (2009) found a similar bug that allowed leaking the ID and personal info of a FB user when their browser loaded a seemingly innocent tag (so it could be embedded in a forum post, for example). Sadly, it was before FB had a bug bounty program, so I didn't receive anything after I contacted them and they fixed the issue. I wrote about it here: http://blog.quaji.com/2009/07/facebook-personal-info-leak.ht...

In 2009 they had private photos exploits, login exploits and all other kinds open access issues. Fun times.

A friend of mine used to have a Facebook page with about 180k fans back in 2008 or 2009. He was so greedy, he found some "javascript code to increase fans" and ended up giving admin rights to the page to some "hackers".

Then Facebook started requiring a password to make changes to page administrators, but they never returned the page to him.

Re: Facebook exploit – Confirm website visitor identities

#49

Post by notafrog »

saagarjha wrote: post #7

> Because the endpoint is HTTP2 it also means you can have many of these requests in flight at once, which makes checking against large lists of IDs very quick. It's interesting that there wasn't any rate limiting on this API, it seems like?

Not surprised. Back in 2016 there was a bug in Facebook beta where you could bruteforce the verification code when performing a "forgot password" request. There was no rate limiting...

Re: Facebook exploit – Confirm website visitor identities

#50

Post by CPLX »

tptacek wrote: post #27
chipperyman573 wrote: post #23

Earlier quoted context omitted.

A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero" http://www.tomanthony.…

That's a really good bug! But $5k sounds pretty reasonable, since the only alternative market for it comes with pretty obscene legal risk (unlike an RCE, which will have a whole variety of white- and grey- market buyers, an SEO bug seller knows exactly what their buyer is doing with their work).

Just curious as an academic matter here. What’s the legal risk from an exploit like this?

Is the idea that manipulating URL’s like that for the victim site amounts to unauthorized use of their computer, hence CFAA stuff?

Just curious how an expert would draw the line between black hat SEO and TOS violations and actual illegal acts.

Post reply on HN