Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Hacked into Facebook's Legal Department Admin Panel

alaa.blog

Post reply on HN
Print view View original

161–170 of 301 posts

Re: I Hacked into Facebook's Legal Department Admin Panel

#161

Post by tptacek »

shuringai wrote: post #159
tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

You can sell it to others. Zerodium buys 0days for 10 times or more than the original bounties. https://zerodium.com/program.html

This comes up on every thread about vulnerabilities. Zerodium doesn't buy random one-off serverside bugs. It's not that they simply don't have a price listing for them; it's that they don't make a market for them at all.

It's not even cut-and-dried for the RCEs that firms like this do buy. Bounty programs at giant tech companies are generally aware of the market prices for RCEs and are not overtly trying to screw you over. The flip side is that the price you get from a broker is (1) negotiated and (2) tranched, so the "number" you get is a best-case, not guaranteed, and can collapse if the bug is burned before the IC agencies the broker sells it to finish using it to hurt people. The bounty number, on the other hand, is a sure thing.

But ~nobody is buying auth bypass vulnerabilities. Maybe if you can mint OG Twitter accounts and aren't worried about going to prison.

Re: I Hacked into Facebook's Legal Department Admin Panel

#162

Post by snazz »

shuringai wrote: post #159
tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

You can sell it to others. Zerodium buys 0days for 10 times or more than the original bounties. https://zerodium.com/program.html

This isn't anything equivalent to a zero-day in a web browser, for instance. It's trivial for Facebook to patch and it can't fit in a "slot" filled by a previous bug. Note that vulnerabilities in a specific web app like this one are not listed on Zerodium's website.

Re: I Hacked into Facebook's Legal Department Admin Panel

#163

Post by Barrin92 »

anonu wrote: post #70

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors. $7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

I mean evidently enough people go to Facebook for them not seeing the need to raise the price on bug reports, or else they'd probably do just that.

The barrier for most people to sell data to criminals is high, both because it's illegal and because most people have at least enough of an ethical compass to not sell their services to scammers.

Re: I Hacked into Facebook's Legal Department Admin Panel

#164

Post by orborde »

tptacek wrote: post #146
gargarplex wrote: post #145

Earlier quoted context omitted.

I macro agree with your point about leverage although I'd like a bit more insight here... "You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything." Wouldn't that cost Facebook much more than $7,000?

I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time. The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; thei…

As a company, why would I want to pay the hourly rate at all? Why not contract with a reputable bounty hunter, give them the level of access I'd give the hourly consultant, and pay the hunter bounties for what they find?

Seems like that captures the "higher bugs per hour" advantage of the consultant while retaining the "you only get paid for directly producing value" advantage of bounties.

Re: I Hacked into Facebook's Legal Department Admin Panel

#165

Post by underwater »

LockAndLol wrote: post #123
underwater wrote: post #92

Earlier quoted context omitted.

If you're OK commiting blatantly illegal acts for money you could just go rob a bank, too.

Can someone name this fallacy for me? It sounds like the slippery slope fallacy, but I'm not sure.

Maybe you're thinking false equivalence? What I'm pointing out that just because you can make a lot of money by doing something illegally doesn't mean you should expect to similar amounts of money using those skills in a legal way. Walter White would back me up on this.

Re: I Hacked into Facebook's Legal Department Admin Panel

#166

Post by xtracto »

baby wrote: post #129
anonu wrote: post #70

$7500 seems low for this bug. If I were Facebook i would raise it. Why? Cost/benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors. $7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

I always see posts like this, but I’m wondering at what amount of money would people feel like it’s fair?

Imho it would be fair if it was treated on a cost per hour basis.

So a typical sec researcher will charge $350 per hour. So if this hack took 10 hours then $3500 would be fair

Re: I Hacked into Facebook's Legal Department Admin Panel

#167

Post by tptacek »

orborde wrote: post #164
tptacek wrote: post #146

Earlier quoted context omitted.

I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time. The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; thei…

As a company, why would I want to pay the hourly rate at all? Why not contract with a reputable bounty hunter, give them the level of access I'd give the hourly consultant, and pay the hunter bounties for what they find? Seems like that captures the "higher bugs per hour" advantage of the consultant while retaining the "you only get paid for directly producing value" advantage of bounties.

It seems like what you're describing here is simply a bug bounty program.

The reason companies pay for app pentests and also run bug bounties is that the two modalities find different kinds of bugs. App pentesters generally get a lot of intel about their targets (source is not unusual). You're also getting a team with bios and a final deliverable that records the diligence work done, which is not an outcome you get with a bounty program.

But you can do things in between. It's not crazy to offer a gig to someone who has delivered a good finding on a bounty project. But you have to do something to incentivize them beyond what the bounty already does, and the most normal way to do that is to not make payment contingent.

Re: I Hacked into Facebook's Legal Department Admin Panel

#169

Post by Biganon »

rriepe wrote: post #26
paxys wrote: post #20

Earlier quoted context omitted.

There is no easily accessible "black market" for a hack like this. As an average person what is your alternative really? Pick up the phone and call the government of Iran? It is far more convenient (and safer) to just take the guaranteed ~$10K and move on with your life.

> Pick up the phone and call the government of Iran? Would that work? Asking for a friend.

Have you seen "Burn after reading"?

Re: I Hacked into Facebook's Legal Department Admin Panel

#170

Post by np_tedious »

underwater wrote: post #91
petters wrote: post #84

How on Earth did this endpoint pass code review at Facebook? The person who wrote it probably was working under the assumption that the calling user was logged in, but still....

It's undoubtably some third party system, not code written at Facebook.

https://legal.tapprd.thefacebook.com/

You're probably right. Windows Server / IIS doesn't seem like them

Post reply on HN