Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Hacked into Facebook's Legal Department Admin Panel

alaa.blog

Post reply on HN
Print view View original

201–210 of 301 posts

Re: I Hacked into Facebook's Legal Department Admin Panel

#201

Post by spoonjim »

asdfasgasdgasdg wrote: post #191
spoonjim wrote: post #189

Earlier quoted context omitted.

Is it legal to do this? Post on Twitter that you've asked Company X for this bounty and if they don't pay it by Date X you'll post it on Twitter. If they don't pay it, post the bug on Twitter. Is that as legal as posting the bug on Twitter straightaway, which as I understand is legal?

> Is it legal to do this? Post on Twitter that you've asked Company X for this bounty and if they don't pay it by Date X you'll post it on Twitter. No, it is not legal. This is called blackmail. https://www.justia.com/criminal/offenses/white-collar-crimes... Although as a non-legal expert, I'm not clear on how this is different from demanding that the company fix the bug or else you'll reveal it after ninety days a l…

Maybe what you need to do is post consulting fees on your Twitter, and then post something that just says, "Facebook, I've found a bug, I'm posting it in 90 days." Then it's up to Facebook to find it and fix it, or make you an offer you can't refuse.

Re: I Hacked into Facebook's Legal Department Admin Panel

#202

Post by chii »

LockAndLol wrote: post #118
singingfish wrote: post #80

Earlier quoted context omitted.

Which is essentially market driven blackmail as far as I can see. Once I meet my new neighbours (one of whom is a moral philosopher by trade) I might ask about how to assess if that's ok. Personally it feels somewhat ok to me, speaking as someone who's built industrial espionage for money.

So, what is your proposed solution for people who find security vulnerabilities in systems? Keep in mind these vulns are worth money in the black market.

If the gov't stops prosecuting the security experts for selling the vulnerability on the black market (but instead, only prosecute those who use it for illegal purposes), then the security expert can find out the true value of a vulnerability.

This makes the company with said vulnerability pay the true price for it - may be even just purchase it on the black market and outbid the "bad guys". Or pay someone to fix it asap before it's sold.

Re: I Hacked into Facebook's Legal Department Admin Panel

#203

Post by andrewguenther »

taeric wrote: post #199
skissane wrote: post #196

Earlier quoted context omitted.

IANAL, but: The classic situation of blackmail is demanding money from someone, or else you'll reveal some embarrassing fact about them, report that they committed some crime, etc. Saying "Give me money or I will publicly disclose a bug in your computer systems" – that fits the classic situation of blackmail straight on. Saying "Fix this bug in 90 days or I'll publicly reveal it" – doesn't fit the classic situation o…

I think a big part is that it is not "or I will reveal". Rather, it is, "I'm revealing this bug in ninety days. Fix it sooner." Right?

This is how Google's Project Zero works basically

Re: I Hacked into Facebook's Legal Department Admin Panel

#204

Post by foepys »

unishark wrote: post #192
phkahler wrote: post #105

Earlier quoted context omitted.

>> student wouldn't be legally obligated to inform you of a vulnerability, and it wouldn't make sense to if you weren't willing to pay. Which leads to a very interesting situation in negotiating. It's not the first time someone tried to sell information or an idea without getting ripped off. But how can one agree the value of information without knowing it. Is there a standard word or phrase to describe that situatio…

perhaps a third party both sides trust is hired to appraise the value

Those things already exist but ultimately bugs and exploits are too niche. A trusted third party cannot rule by themselves but is always required to ask both sides about the bug's impact. Since both sides try to frame it as both high and low impact at the same time, you make both parties unhappy in the most cases and become untrusted.

Re: I Hacked into Facebook's Legal Department Admin Panel

#205

Post by jcims »

tptacek wrote: post #151
markdown wrote: post #60

Earlier quoted context omitted.

> There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, then you can call your work "security research". Bug bounty programs are mainly targeted at bug prospectors. > Both have streaks of narcissists and showboaters but the latter seems to be thick with them. Thank god for that. Blog posts like the one this thread is…

Respectfully, I feel like you all are making up a taxonomy that feels right to you, but that is definitely not accepted by the vuln research field. Further: this idea that "research" is something we have to valorize, and that you have to meet a public interest threshold to be worthy of it, is itself a standard to which the real world does not adhere. There are lots of different kinds of "research" out there; there ar…

No you're right, bug prospector was made up on the spot. I'm old too and I confused the conversation by hauling out my rusty trusty grinding axe about some miscreants I encountered along the way.

In general though I do think we diffuse the term 'research' a bit in this case by applying it to a very broad spectrum of actions and motivations. As a result I think we lose some of the nuances of incentive that emerge at opposite ends of that spectrum. I mean we do call them 'bug bounties' afterall and we don't call Duane Chapman 'Dog the Fugitive Reseacher'. :)

Re: I Hacked into Facebook's Legal Department Admin Panel

#206

Post by justinko »

throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

And the idea of a “hacker agent” was born.

Re: I Hacked into Facebook's Legal Department Admin Panel

#207

Post by roveo »

spoonjim wrote: post #186
tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

Why don't state actors that are explicitly aligned against the USA have public bug buying programs? Like a Russian website where you can go and submit your bug and get $250K.

Because a vulnerability in FB's legal admin panel (and most other vulnerabilities) doesn't interest said state actors?

Anything mildly "interesting" being sold through such a program would be high treason. How do you know this "Russian website" isn't actually a CIA honeypot? Or maybe it's not a honeypot, but instead of paying you 250K you just die of heart attack in a couple of months? Or they sell your identity back to your govt. as part of some unrelated game.

Bad business.

Re: I Hacked into Facebook's Legal Department Admin Panel

#208

Post by asdfasgasdgasdg »

spoonjim wrote: post #201
asdfasgasdgasdg wrote: post #191

Earlier quoted context omitted.

> Is it legal to do this? Post on Twitter that you've asked Company X for this bounty and if they don't pay it by Date X you'll post it on Twitter. No, it is not legal. This is called blackmail. https://www.justia.com/criminal/offenses/white-collar-crimes... Although as a non-legal expert, I'm not clear on how this is different from demanding that the company fix the bug or else you'll reveal it after ninety days a l…

Maybe what you need to do is post consulting fees on your Twitter, and then post something that just says, "Facebook, I've found a bug, I'm posting it in 90 days." Then it's up to Facebook to find it and fix it, or make you an offer you can't refuse.

I think if you intersect the set of people willing to take this risk and the set of people with the capability to find bugs like this, then remove all the black hats, you'd end up with the empty set.

Re: I Hacked into Facebook's Legal Department Admin Panel

#209

Post by mosselman »

foota wrote: post #184
tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

It seems like the problem is that there is disclosing as a zero day isn't seen as a credible thread, since it's generally seen as bad practice. If security researchers wanted to try and collect more they could in theory form some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met. Maybe combine with some kind of insurance…

> some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met

So a hacker group that will blackmail companies?

$7500 for spending anywhere less than a month on something is a pretty decent compensation.

You also seem to forget that despite the fairness of the compensation, disclosing the vulnerability could damage real users, in this case Facebook’s.

If you think $7500 for finding something like this is not enough, you shouldn’t do it. You wouldn’t clean toilets for $1 a month either right?

Re: I Hacked into Facebook's Legal Department Admin Panel

#210

Post by vmception »

tptacek wrote: post #136
throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

The market for random serverside bugs doesn't have to be liquid, it just has to exist

I think you could flip this on White House Market pretty quick and pretty well. Either partner up with someone willing to risk their rep, or just sell 99 cent tutorials for a week and get your rep up. Or resell fullz lol

And then come in with the much larger payload and a few forum posts about it

They only use Monero for payments and PGP signed messaging on White House

Post reply on HN