I Hacked into Facebook's Legal Department Admin Panel • Hacker News Board

Re: I Hacked into Facebook's Legal Department Admin Panel

#251

Post by kortilla » Sun, Dec 13, 2020, 12:58 PM UTC

tptacek wrote: post #216

kortilla wrote: post #173

Earlier quoted context omitted.

The academic difference is quite distinct and is well understood in the research community there. Impressive vulnerabilities that could take down all of Google wouldn’t be accepted into any security research conferences/journals if the bug didn’t involve a new class of vulnerability or discovery method. The term “bug prospector” might not be widely accepted, but people just looking for well understood bugs in product…

Vulnerability researchers aren't generally academic researchers. "Vulnerability research" is a term of art.

But there are people who generally research vulnerabilities in academia and your “term of art” doesn’t really apply there. Point being - “vulnerability researcher” means one thing talking to a PhD student at CMU vs talking to someone in the industry.

Re: I Hacked into Facebook's Legal Department Admin Panel

#252

Post by kabes » Sun, Dec 13, 2020, 1:02 PM UTC

marcan_42 wrote: post #245

serial_dev wrote: post #229

Earlier quoted context omitted.

It works sometimes . I'm not sure everyone would have the nerve to aggressively drop zero days, you don't know who you are going to cross, my paranoia would not let me. I'm also not a security person, but I am sure there are people who have the necessary skills, but have the same nerves as I have.

And then sometimes you get sued. Source: got sued by Sony for disclosing that they screwed up their ECDSA implementation so badly that you could compute their private keys (and then putting Linux back on the PS3 using that flaw). Microsoft not doing that with Xbox (orig/360) hackers is why the Xbox One has really good security. They hired them instead.

How did that turn out with Sony in the end?

Re: I Hacked into Facebook's Legal Department Admin Panel

#253

Post by hh3k0 » Sun, Dec 13, 2020, 1:12 PM UTC

z3t4 wrote: post #34

Judging my the response letter it seems they think he only managed to reset a password... not setting the password. Will be interesting to read the follow up.

> Judging my the response letter it seems they think he only managed to reset a password

That wouldn't really make sense, would it? As it allowed him to log in.

> So let’s get back to see what I’ve done here, I sent random requests using intruder with a CSRF token and random emails with a new password to this endpoint /savepassword

> Now I went to the login page and I put the login email and the new password and BOOM I logged in Successfully into the application and I can enter the admin panel

Re: I Hacked into Facebook's Legal Department Admin Panel

#254

Post by marcan_42 » Sun, Dec 13, 2020, 1:30 PM UTC

kabes wrote: post #252

marcan_42 wrote: post #245

Earlier quoted context omitted.

And then sometimes you get sued. Source: got sued by Sony for disclosing that they screwed up their ECDSA implementation so badly that you could compute their private keys (and then putting Linux back on the PS3 using that flaw). Microsoft not doing that with Xbox (orig/360) hackers is why the Xbox One has really good security. They hired them instead.

How did that turn out with Sony in the end?

They settled which Geohot (who had nothing to do with the rest of us, but kind of triggered the whole thing by just implementing our exploit and posting the keys on his site), and dropped it against everyone else. I never got served personally, so for me it was mostly a big scare and having the EFF help us with lawyers to be prepared for whatever happens. One of my friends wasn't so lucky, they got ahold of lawyers at his job and caused him a bunch of trouble.

Re: I Hacked into Facebook's Legal Department Admin Panel

#255

Post by thrownaway561 » Sun, Dec 13, 2020, 1:49 PM UTC

throwitaway1235 wrote: post #49

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

you will be sent to prison for extortion.

Re: I Hacked into Facebook's Legal Department Admin Panel

#256

Post by mcdevilkiller » Sun, Dec 13, 2020, 1:51 PM UTC

marcan_42 wrote: post #245

serial_dev wrote: post #229

Earlier quoted context omitted.

It works sometimes . I'm not sure everyone would have the nerve to aggressively drop zero days, you don't know who you are going to cross, my paranoia would not let me. I'm also not a security person, but I am sure there are people who have the necessary skills, but have the same nerves as I have.

And then sometimes you get sued. Source: got sued by Sony for disclosing that they screwed up their ECDSA implementation so badly that you could compute their private keys (and then putting Linux back on the PS3 using that flaw). Microsoft not doing that with Xbox (orig/360) hackers is why the Xbox One has really good security. They hired them instead.

PS3 runs FreeBSD

Re: I Hacked into Facebook's Legal Department Admin Panel

#257

Post by wut42 » Sun, Dec 13, 2020, 2:11 PM UTC

rukshn wrote: post #179

Awesome post. Shameless plug on a similar exploit I found using the browser developer tools on a large scale application https://github.com/rukshn/rukshn.github.io/blob/master/archi...

Interesting post, but I have troubles understanding the "SSL vulnerability with the exposed IP address" part. SSL does not prevent knowing IP addresses...

Re: I Hacked into Facebook's Legal Department Admin Panel

#258

Post by colejohnson66 » Sun, Dec 13, 2020, 2:18 PM UTC

mcdevilkiller wrote: post #256

marcan_42 wrote: post #245

Earlier quoted context omitted.

And then sometimes you get sued. Source: got sued by Sony for disclosing that they screwed up their ECDSA implementation so badly that you could compute their private keys (and then putting Linux back on the PS3 using that flaw). Microsoft not doing that with Xbox (orig/360) hackers is why the Xbox One has really good security. They hired them instead.

PS3 runs FreeBSD

OtherOS was Linux

Re: I Hacked into Facebook's Legal Department Admin Panel

#259

Post by spacemanmatt » Sun, Dec 13, 2020, 2:28 PM UTC

spoonjim wrote: post #186

tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

Why don't state actors that are explicitly aligned against the USA have public bug buying programs? Like a Russian website where you can go and submit your bug and get $250K.

That's called selling on the dark web, and it's at least vaguely mercenary, IMO

Re: I Hacked into Facebook's Legal Department Admin Panel

#260

Post by IfOnlyYouKnew » Sun, Dec 13, 2020, 2:45 PM UTC

foota wrote: post #184

tptacek wrote: post #136

Earlier quoted context omitted.

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can t…

It seems like the problem is that there is disclosing as a zero day isn't seen as a credible thread, since it's generally seen as bad practice. If security researchers wanted to try and collect more they could in theory form some kind of union to keep up the price of bounties, with like a middle agent pricing the bounty and disclosing the vulnerability if the price isn't met. Maybe combine with some kind of insurance…

It "isn't seen as a credible thread" because it's immoral.

Sequencing plays a major role here. And while that may seem somewhat arbitrary, it is significant.

(Similar case, that, for some reason tech people have entirely too much trouble understanding: Announce "I'm going to shoot this gun at that target". Person, having heard you, walks and stands in front of the target. Are you still allowed/morally right to shoot?)