Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Hacked into Facebook's Legal Department Admin Panel

alaa.blog

Post reply on HN
Print view View original

41–50 of 301 posts

Re: I Hacked into Facebook's Legal Department Admin Panel

#41

Post by grawprog »

atum47 wrote: post #37

well, I wasn't gonna to comment about this subject, but here we go: I find this value ($7,500.00) kind of low for a discovery like this. The other day, someone shared a link to an app [1] that estimastes how much a only fan user makes. I got tell, it got to me. I was never money orientated and I don't plan to become; but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary…

>but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary is kinda sad.

>some of the only fans users makes in a month what a plain SE would make in a year

I'm sure if you could think of a way to make software engineers as appealing as naked women, you'd probably find yourself a pretty great job paying well over the people on onlyfans.

Re: I Hacked into Facebook's Legal Department Admin Panel

#42

Post by jcims »

bredren wrote: post #21
jcims wrote: post #11

Earlier quoted context omitted.

In general you are on shaky legal ground. However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that you can operate within to discover vulnerabilities within their products or infrastructure in exchange for some kind of recognition or award. The terms of Facebooks bounty are here: https://www.facebook.com/whitehat Based on a cursory glance and the fact that thi…

Yes. Most competent tech companies permissibly allow “security research” like this. If you are genuinely trying to find exploits in good faith, and are acting within the parameters spelled out in their bug bounty program, it’s all good. You also may get paid. This blog entry sort of dramatized what happened for clicks. I actually think it’s unwise to characterize any exploit like this, because it adds a PR dimension…

Totally agree with your perspective here. There's security research and there's bug prospecting. Both have streaks of narcissists and showboaters but the latter seems to be thick with them.

(edit: to clarify b/c this can easily be interpreted otherwise, I'm not calling the writer of this article either of those. The headline is a bit of cheap clickbait but the article is a good walkthrough of their mindset)

Re: I Hacked into Facebook's Legal Department Admin Panel

#43

Post by atum47 »

Latty wrote: post #39
atum47 wrote: post #37

well, I wasn't gonna to comment about this subject, but here we go: I find this value ($7,500.00) kind of low for a discovery like this. The other day, someone shared a link to an app [1] that estimastes how much a only fan user makes. I got tell, it got to me. I was never money orientated and I don't plan to become; but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary…

Describing that work as "being naked in front of a webcam" is like calling software development "typing at a computer". You can make any job sounds trivial and downplay its value by describing it in a way that removes the skill and effort involved. I'm not sure why you feel the need to imply some else's work isn't valuable to make the point that this work should be more valuable.

ok, I'll bite. What kind of skill to you need to have, besides being born attractive, to succeed in such business?

Re: I Hacked into Facebook's Legal Department Admin Panel

#44

Post by detaro »

tptacek wrote: post #40
detaro wrote: post #33

Earlier quoted context omitted.

A "market" needs a bit more than "is worth something". What multiplier of the $7500 bounty would you want for the trouble of committing a crime? Who's the buyer (FB afaik doesn't buy a whole lot of publicly traded companies, so it probably needs to be someone who can get into the deals, and quickly)? How do you find them? How do you convince that buyer that your deal is worth the money and the hassle of committing a…

I believe a good way to think about the market for vulnerabilities is this: There are markets for vulnerabilities that slot seamlessly into existing business processes. In other words, you can tend to find a buyer for a vulnerability that would replace another vulnerability already being used, that accomplishes pretty much exactly the same thing as that vulnerability. The more people run that business process, the mo…

Interesting. I guess a real-world analogy is theft of valuables. If you steal random money, that's easy to turn into value. There's a harder to access criminal industry smelting down gold, which will equally reduce jewelry and priceless museum artifacts to material value. And a unique well-known painting is pretty much impossible to sell if you aren't already connected to a buyer with a specific interest.

Re: I Hacked into Facebook's Legal Department Admin Panel

#45

Post by atum47 »

grawprog wrote: post #41
atum47 wrote: post #37

well, I wasn't gonna to comment about this subject, but here we go: I find this value ($7,500.00) kind of low for a discovery like this. The other day, someone shared a link to an app [1] that estimastes how much a only fan user makes. I got tell, it got to me. I was never money orientated and I don't plan to become; but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary…

>but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary is kinda sad. >some of the only fans users makes in a month what a plain SE would make in a year I'm sure if you could think of a way to make software engineers as appealing as naked women, you'd probably find yourself a pretty great job paying well over the people on onlyfans.

well, I might. I finish college back in 2019 and my teacher who was my counselor, runs several projects trying to make SE and CS more attractive to girls. I guess she'll have a harder job to do now, knowing that a girl could rely on her beauty to makes thousands of dollars exposing herself to strangers.

Damn it, I have a two year old niece, I guess me and my brother better think something fast, so when shes a teenager she'll be interested in STEM.

Re: I Hacked into Facebook's Legal Department Admin Panel

#46

Post by julianlam »

atum47 wrote: post #43
Latty wrote: post #39

Earlier quoted context omitted.

Describing that work as "being naked in front of a webcam" is like calling software development "typing at a computer". You can make any job sounds trivial and downplay its value by describing it in a way that removes the skill and effort involved. I'm not sure why you feel the need to imply some else's work isn't valuable to make the point that this work should be more valuable.

ok, I'll bite. What kind of skill to you need to have, besides being born attractive, to succeed in such business?

Someone attractive can have the charisma of a dead fish.

Re: I Hacked into Facebook's Legal Department Admin Panel

#47

Post by pletsch »

Traubenfuchs wrote: post #35
iso8859-1 wrote: post #28

First pentester I found with 12k followers on Instagram: https://www.instagram.com/al_shwele/ but 8 on GitHub: https://github.com/Alaa-abdulridha Instagram keeps surprising me...

The majority of the accounts following him have 0 posts, very low amount of followers and follow thousands of other people. They are most likely bought or collected via an online bot tool. Further quantitative evidence: His posts have a very low amount of likes and comments.

61 likes off 13k followers..yeah, that's a tough sell.

Re: I Hacked into Facebook's Legal Department Admin Panel

#48

Post by mszcz »

detaro wrote: post #33
mszcz wrote: post #19

Earlier quoted context omitted.

Isn’t legal involved in most business moves? Getting a wind of those ahead of a public announcement surely must be worth something ;)

A "market" needs a bit more than "is worth something". What multiplier of the $7500 bounty would you want for the trouble of committing a crime? Who's the buyer (FB afaik doesn't buy a whole lot of publicly traded companies, so it probably needs to be someone who can get into the deals, and quickly)? How do you find them? How do you convince that buyer that your deal is worth the money and the hassle of committing a…

Didn’t say it was easy to monetize. I do recall a bust, some time ago, of a ring that used prerelease (?) announcement pdfs already placed on publicly accessible servers (?) as a source of insider alpha.

(‘?’ because I’m on my third whiskey and about to turn in :)

Re: I Hacked into Facebook's Legal Department Admin Panel

#50

Post by fakedang »

ForHackernews wrote: post #38
paxys wrote: post #20

Earlier quoted context omitted.

There is no easily accessible "black market" for a hack like this. As an average person what is your alternative really? Pick up the phone and call the government of Iran? It is far more convenient (and safer) to just take the guaranteed ~$10K and move on with your life.

It doesn't have to be "easily accessible" to be valuable. Corporate espionage exists, insider trading exists (and is more common than you might think), there's any number of parties who might pay for insider info (once properly laundered) about Facebook activities. Why would "the government of Iran" care about what Facebook is up to? Isn't FB banned in Iran?

You forget that intelligence and espionage goes both ways. Iran could use FB in some way to attack the US, just like Russia did, just as it could shield itself from FB.
Post reply on HN