Instagram's Million Dollar Bug (2015)

Post by AviationAtom » Tue, Dec 15, 2020, 6:14 AM UTC

Zee2 wrote: post #3

God, this is frustrating. They essentially cracked Instagram's entire production environment open, and took explicit steps at every turn to stay within the published guidelines, and then they just take his report with zero compensation whatsoever. Insane.

Post by wdr1 » Tue, Dec 15, 2020, 6:20 AM UTC

TravisLS wrote: post #5

Previous discussion (5 years ago): https://news.ycombinator.com/item?id=10754194

Post by fnbr » Tue, Dec 15, 2020, 6:47 AM UTC

oofbey wrote: post #41

LukasReschke wrote: post #19

Earlier quoted context omitted.

Disclaimer: I was a Security Engineer on the FB Security Team until last month and was also involved in the Bug Bounty Program :-) That's not how Facebook treats Bug Bounty Participants. By far, it's one of the better programs in terms of payouts, fairness, and triage time on critical issues. Just a recent example: a bug bounty hunter reported unexpired CDN links. After internal research, FB figured out to chain this…

I think FB's greatest achievements is convincing their employees that their jobs are actually good for society, or at least neutral. Plenty of good people working there who seem honestly confused about how their jobs lead to so corruption and downfall of our society.

Post by MPSimmons » Tue, Dec 15, 2020, 7:02 AM UTC

donmcronald wrote: post #61

HexagonalKitten wrote: post #59

Earlier quoted context omitted.

> triagers have a whole pile of crap to wade through, to get to the useful material. This is very true. > The issues with bug bounties as a whole is the market is skewed. For any work done by a bug bountier, there is exactly one legitimate buyer who gets to make a significant judgement call on the value of the work done. The problem, in my experience, is that they never analyze it by its potential. Why would they, th…

IMHO it’s only a matter of time until someone blows up a unicorn just for the thrill of it. That’s not something I’d support, but I won’t feel bad for companies that don’t pay adequate bug bounties.

Post by ryanlol » Tue, Dec 15, 2020, 7:40 AM UTC

paulpauper wrote: post #17

spoonjim wrote: post #16

Earlier quoted context omitted.

They didn't change the credentials that had been hacked? God I wish the hacker had sold the vuln to North Korea.

Real life is not like the movies, in which a floppy disk of info is exchanged for a suitcase of money in a dark alley or in a boardroom. Blackhats typically find that there is little market for their info, especially before the advent of bitcoin being popular. yeah, you cracked a bunch of selfie pics. What can you do with it. not much.