Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Hacked into Facebook's Legal Department Admin Panel

alaa.blog

Post reply on HN
Print view View original

231–240 of 301 posts

Re: I Hacked into Facebook's Legal Department Admin Panel

#231

Post by brodie »

plankers wrote: post #225
foota wrote: post #184

Earlier quoted context omitted.

It seems like the problem is that there is disclosing as a zero day isn't seen as a credible thread, since it's generally seen as bad practice. If security researchers wanted to try and collect more they could in theory form some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met. Maybe combine with some kind of insurance…

+1 for security researchers' union. Reminds me of the bounty hunters' guild in the Mandalorian but with fewer blasters.

I wish modern society had more guilds in general. So many interesting things are possible when likeminded people come together.

Re: I Hacked into Facebook's Legal Department Admin Panel

#232

Post by mrleiter »

tptacek wrote: post #13
polishdude20 wrote: post #2

What is this fuzzing tool you use to get the endpoints?

It's sort of implied that it's not Burp Intruder, but Burp Intruder would be a pretty normal way to do this.

It's actually Burpsuite, you can tell from the screenshot he provided.

Re: I Hacked into Facebook's Legal Department Admin Panel

#233

Post by i_am_new_here »

forest_dweller wrote: post #104
toyg wrote: post #57

Earlier quoted context omitted.

It was always thus. In fact, until the ‘60s, a girl had to rely on her beauty and personality to eat and survive , i.e. by marrying. I have a daughter and, while obviously I’d prefer she didn’t end up on onlyfans, I really don’t want to limit what she should do or what talent she should leverage to reach happiness and/or prosperity.

> It was always thus. In fact, until the ‘60s, a girl had to rely on her beauty and personality to eat and survive, i.e. by marrying. The way this is framed today by people is soo disgusting. 1) Women did work before 1960. 2) Two incomes are better than one. Married couples are better off financially. Many women worked part time while the children were at school or in the evenings when the husband was back at home. I…

> The way this is framed today by people is soo disgusting.

> Most people were dirt poor in the past in the western world by today's standards.

You have just adjusted one simplification to end up over exaggerating another one. A boomer's family could live off one salary. Since then women have joined the workforce and kind of the whole world by moving (migrating) or remote. While it is definitely true that those "none westerners were dead poor in the past compared to today" there is a 20+ year long wage stagnation in the west and increase in prices on some of the very fundamental needs like housing, which results in memes about gen XYZ not being able to afford them, create stable conditions, have a spouse and then a family (kids).

Anyway, we are in this together, always on(line), connected, one global world and it depends how you view it: Appreciate the advancements the non-western world has made or focus on the gap they still have to the west. Though this all comes to the expense of the western world, which is kind of required to close the global gap.

Re: I Hacked into Facebook's Legal Department Admin Panel

#234

Post by jamesmishra »

throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

There isn't a super lucrative market for this type of thing that doesn't involve either the buyer or seller violating US law.

The real money is probably something more boring than setting up exploits--such as setting up a security consulting practice that charges a ton of money. It's a lot easier because then you would have less pressure to discover completely novel exploits.

Re: I Hacked into Facebook's Legal Department Admin Panel

#236

Post by lazyasciiart »

webmaven wrote: post #195
tptacek wrote: post #146

Earlier quoted context omitted.

I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time. The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; thei…

> I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. Well, okay, but the opportunity cost (ie. the other valuable things they could be doing) is surely something that could have a $ value attached?

Sure. But if they drop it for this, it was less value than this - and you’ve saved them the time of testing less important things before narrowing in on this bug.

Re: I Hacked into Facebook's Legal Department Admin Panel

#237

Post by lazyasciiart »

fancythat wrote: post #220
tptacek wrote: post #171

Earlier quoted context omitted.

The fair market price of an entire app pentest of that legal dashboard application, one which would almost certainly find that bug† if run by a competent, reputable firm, along with many other bugs, run by consultants with bios and concluded with a deliverable that Facebook can file away, is probably somewhere between $20,000 and $35,000, so the idea that the fair market value of a single finding of that engagement i…

One point of you to consider though, I guess FB runs pentests all the time, either internally or externally by appointing some other company to do it. That being said, if they pay that company 35k, for example, and they haven't found this, wouldn't that fact make this discovery worth more than 35k?

Maybe they found other bugs that were worse, or of the same value, and you should have just given them another day.

Re: I Hacked into Facebook's Legal Department Admin Panel

#238

Post by stiray »

tptacek wrote: post #136
throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

I think if the guy that came to the internal google documents a few years back, would offer the content on the donation based web site and prove they are genuine, it might get more out of donations from various privacy groups / people than he got from google for the vulnerability.

Same goes here.

It is not about the vulnerability, it is about the content.

Re: I Hacked into Facebook's Legal Department Admin Panel

#239

Post by forest_dweller »

i_am_new_here wrote: post #233
forest_dweller wrote: post #104

Earlier quoted context omitted.

> It was always thus. In fact, until the ‘60s, a girl had to rely on her beauty and personality to eat and survive, i.e. by marrying. The way this is framed today by people is soo disgusting. 1) Women did work before 1960. 2) Two incomes are better than one. Married couples are better off financially. Many women worked part time while the children were at school or in the evenings when the husband was back at home. I…

> The way this is framed today by people is soo disgusting. > Most people were dirt poor in the past in the western world by today's standards. You have just adjusted one simplification to end up over exaggerating another one. A boomer's family could live off one salary. Since then women have joined the workforce and kind of the whole world by moving (migrating) or remote. While it is definitely true that those " non…

The wage stagnation relative to inflation started happening 1960s-1970s, so that was well after the time period we were discussing (pre-1960s).

Re: I Hacked into Facebook's Legal Department Admin Panel

#240

Post by DrJaws »

mosselman wrote: post #209
foota wrote: post #184

Earlier quoted context omitted.

It seems like the problem is that there is disclosing as a zero day isn't seen as a credible thread, since it's generally seen as bad practice. If security researchers wanted to try and collect more they could in theory form some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met. Maybe combine with some kind of insurance…

> some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met So a hacker group that will blackmail companies? $7500 for spending anywhere less than a month on something is a pretty decent compensation. You also seem to forget that despite the fairness of the compensation, disclosing the vulnerability could damage real users,…

It could be a decent compensation if you were assured that you will get the money, but you don't know and it is probably that you can't find anything in months.
Post reply on HN