61–70 of 107 posts
It seems like Facebook's Bug Bounty Program payment processor bugbountypayments.com is down http://isup.me/bugbountypayments.com . Anyone have any experience with that site? I haven't heard of it coming up before in security program discussions on HN or elsewhere.
Good work. I see a lot of people are surprised at the amount received for this report. Yes, that is typical of both Facebook and Google (and to a lesser extent, Yahoo will pay large sums for particularly bad bugs). They are extremely generous - Facebook recently paid $5000 for a bug report that existed in their careers portal despite that infrastructure being entirely third party. If anyone wants to try and replicate…
Is anyone else kind of shocked that this particular vulnerability exists given that Facebook employs "the best and brightest" in the industry? This isn't one of those vulnerabilities that relies on numerous seemingly unrelated steps and makes you wonder how the person ever thought it up. Instead, this is security 101 stuff. Facebook simply wasn't making sure userFor(appKey) == owner(albumId). I would've assumed obvio…
Earlier quoted context omitted.
That alternative being...
Ruining his aunt's birthday memories? It would ultimately be the hapless users who suffer in some way.
Earlier quoted context omitted.
For the seriousness of this bug 12k doesn't seem like much to me. I don't know if I would turn it in for that little. With my personal dislike of facebook, the alternative is so very, very tempting..
That alternative being...
However I'm not sure if the risk being caught is considered in this. If you can get let's say, X times more in the black market but also risk 10 or 20 or whatever years in jail as well, I'm not sure those 12.5k seem that bad.
Edit: Or maybe doing extortion on someone? but how much could you get by threatening to delete someone's photos? I'm guessing not much... no?
If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate $12,500 every 33 seconds. Paying out that sum of money to increase the number of people searching for security flaws is quite smart.
Yet there's no way to tell FB about problems without having an account (that I could find in 5 minutes). I found potential phishing attempts in the Windows Store, suggested apps right from the start menu. MS refuses to do anything about phishing/scams on their store, and FB offers no way to contact them (I tried a few email addresses like legal@, to no response).
apps.facebook.com (Facebook Windows Store) is not in the scope of this bug bounty program though.
Find line of code containing bug and:
git blame -L2469,2469 -- app/core/shitty_auth.php | \
egrep -oh '[A-Z][a-z]+ [A-Z][a-z]+' | \
xargs -I {} python dock_monthly_pay.py \
--employee-name="{}" --amount=1041.67Nice! Easy $12500. I'm kicking myself but then again, who woulda thunk?