Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Hacked into Facebook's Legal Department Admin Panel

alaa.blog

Post reply on HN
Print view View original

141–150 of 301 posts

Re: I Hacked into Facebook's Legal Department Admin Panel

#141

Post by tptacek »

greatgib wrote: post #140
tptacek wrote: post #135

Earlier quoted context omitted.

Exploiting a vulnerability to learn and then reveal trade secrets is probably a crime. You have Facebook's tacit permission to look for vulnerabilities, but not to use them or pivot from them.

It is not trade secret. It would be in the public interest. Just let me remember you that we are speaking about Facebook and user's privacy... As we have discovered through recent scandals, a lot of people are not aware of the level of abuse on their privacy they expose themselves by using Facebook. But just reusing the devil's argument, if they have nothing bad to hide, there is no issue to be transparent...

That's not how that works at all. You absolutely do not have a right to hack into private companies "in the public interest".

Re: I Hacked into Facebook's Legal Department Admin Panel

#142

Post by [deleted] »

neffy wrote: post #107
sltEvas wrote: post #65

Earlier quoted context omitted.

2%? You have an interesting idea of the world's population. Just think about what that means. It means 2 out of 100 people can hack into Facebook's Legal Department Admin Panel. I mean if we are talking "mentally capable to achieve that within a decade if the person does nothing else but strive to that goal"... Perhaps. If we are talking "sit down right now and do it", then it's more like what... 10,000-100,000 peopl…

Not quite. The US alone graduates 2 million Computer Science students of various stripes every year. It's been graduating (smaller numbers) of them for over 40-50 years now. There are now second and third generation comp sci. workers and graduates. So let's say 1% of 1 million/year are up to this, I suspect it's rather more, but I can't be bothered to do the curve on past graduation rates, and figure out what the wor…

[deleted]

Re: I Hacked into Facebook's Legal Department Admin Panel

#143

Post by thaumasiotes »

jcims wrote: post #113
thaumasiotes wrote: post #109

Earlier quoted context omitted.

I worked for several bug bounty programs; showboating didn't really seem to be a major issue.

Maybe things have gotten better. I worked for one a while back and came away with a notion of the two distinct communities I described. I try to focus mostly on the positive side, which was the majority and had some amazing and inspiring folks, but the other side had some really irritating people with wholly unprofessional conduct. Bug Bounty King really spoke to me haha

> some really irritating people with wholly unprofessional conduct.

Yeah, they're very common. But, in my experience, showboating wasn't.

Re: I Hacked into Facebook's Legal Department Admin Panel

#144

Post by ss2003 »

underwater wrote: post #92
anonu wrote: post #70

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors. $7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

If you're OK commiting blatantly illegal acts for money you could just go rob a bank, too.

Lots of places you could do this from where it would not be illegal.

Re: I Hacked into Facebook's Legal Department Admin Panel

#145

Post by gargarplex »

tptacek wrote: post #136
throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

I macro agree with your point about leverage although I'd like a bit more insight here...

"You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything."

Wouldn't that cost Facebook much more than $7,000?

Re: I Hacked into Facebook's Legal Department Admin Panel

#146

Post by tptacek »

gargarplex wrote: post #145
tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

I macro agree with your point about leverage although I'd like a bit more insight here... "You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything." Wouldn't that cost Facebook much more than $7,000?

I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time.

The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; their desire to attract bounty hunters is priced in to the bounties they pay.

It's for this reason that people who want to make serious money and who start in bounty hunting break basically two ways:

* Either they get really good at mopping up lots of 4-figure bounties (hitting the occasional blackjack on something that pays into low-mid 5 figures), often with a fair bit of automation, or

* They graduate into consulting, where the weekly rate for this kind of work is substantially higher, you're given a briefing by the target about where to look, and where you get paid whether or not you find a marquee bug.

(A good person to ask about this stuff is 'daeken).

Re: I Hacked into Facebook's Legal Department Admin Panel

#148

Post by TameAntelope »

underwater wrote: post #92
anonu wrote: post #70

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors. $7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

If you're OK commiting blatantly illegal acts for money you could just go rob a bank, too.

It’s at least marginally harder to get shot sitting at my laptop in my room...

Re: I Hacked into Facebook's Legal Department Admin Panel

#150

Post by doopy1 »

throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

I mean if you're demanding you're kind of committing a crime. It's actually pretty nice of FB to reward this stuff, and along with the clout come career opportunities worth much more than $7.5k.
Post reply on HN