Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deleting any Facebook album

7xter.com

Post reply on HN
Print view View original

81–90 of 107 posts

Re: Deleting any Facebook album

#81

Post by monochromatic »

drubio wrote: post #76

Didn't anyone else find this post suspicious ? I browsed through the site thinking there were some other interesting security posts. Turns out this is the only post on the site. Then I did a Whois and this site was created 2 days ago. It's registered to laksshmanan51@gmail.com which is apparently the same guy on the post. Then I did a search on Google for laksshmanan51@gmail.com and there are search results with "You…

Also, the guy who found this vulnerability doesn't know not to use jpegs for text?? That doesn't pass the smell test either.

Re: Deleting any Facebook album

#82

Post by [deleted] »

monochromatic wrote: post #81
drubio wrote: post #76

Didn't anyone else find this post suspicious ? I browsed through the site thinking there were some other interesting security posts. Turns out this is the only post on the site. Then I did a Whois and this site was created 2 days ago. It's registered to laksshmanan51@gmail.com which is apparently the same guy on the post. Then I did a search on Google for laksshmanan51@gmail.com and there are search results with "You…

Also, the guy who found this vulnerability doesn't know not to use jpegs for text?? That doesn't pass the smell test either.

[deleted]

Re: Deleting any Facebook album

#83

Post by Johnbrian »

drubio wrote: post #76

Didn't anyone else find this post suspicious ? I browsed through the site thinking there were some other interesting security posts. Turns out this is the only post on the site. Then I did a Whois and this site was created 2 days ago. It's registered to laksshmanan51@gmail.com which is apparently the same guy on the post. Then I did a search on Google for laksshmanan51@gmail.com and there are search results with "You…

Nope i see his name listed here for the last two years. https://www.facebook.com/whitehat/thanks

Re: Deleting any Facebook album

#86

Post by itsybitsycoder »

Raphmedia wrote: post #41
tptacek wrote: post #19

Earlier quoted context omitted.

I doubt the "black market" would pay much of anything for this bug, because, like most severe web vulnerabilities, it has no half-life.

No, but imagine the ressources they would have had to throw at the problem if the user had instead decided to delete ALL the photo albums on the site. Or imagine if he would have used the exploit to delete all the photos of a movie launch, etc. The reward is appropriate.

I'm guessing not much? I was under the impression that nothing you delete on Facebook is ever truly deleted, just marked as disabled and hidden. And if they're logging their API calls it should be fairly straightforward to look up which albums were disabled using that one token and switch the flag back.

Re: Deleting any Facebook album

#87

Post by saneem »

fidz wrote: post #80
sillysaurus3 wrote: post #5

If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate $12,500 every 33 seconds. Paying out that sum of money to increase the number of people searching for security flaws is quite smart.

> Facebook theoretically loses $22,453 for every minute their website is down. Any reference for this?

It was mentioned on a Techcrunch article[1]. Annual earnings/Time.

[1] http://techcrunch.com/2014/09/03/why-is-facebook-down/

Re: Deleting any Facebook album

#88

Post by [deleted] »

fidz wrote: post #80
sillysaurus3 wrote: post #5

If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate $12,500 every 33 seconds. Paying out that sum of money to increase the number of people searching for security flaws is quite smart.

> Facebook theoretically loses $22,453 for every minute their website is down. Any reference for this?

[deleted]

Re: Deleting any Facebook album

#89

Post by Fedorasupreme »

drubio wrote: post #78
msie wrote: post #2

Nice! Easy $12500. I'm kicking myself but then again, who woulda thunk?

I think this post is a hoax. A lot of things don't add up. I thought there would be more interesting security posts and this is the only post on the entire site. The site was registered just 2 days ago, see http://www.whois.com/whois/7xter.com . Then if you search on Google for the email that registered the site (laksshmanan51@gmail.com) you get this http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi... tha…

Shhh, don't interrupt the circle jerk. ;)

Re: Deleting any Facebook album

#90

Post by xtrumanx »

I've never been more motivated to sign up for FB like I am now so I checked out the eligibility rules for the bug bounty and I found one interesting rule:

> Not reside in a country under any current U.S. Sanctions (e.g., North Korea, Libya, Cuba, etc.)

Keyword there is any. Some Russian officials are under U.S. sanctions, does that mean Russian citizens are not eligible for the bounty?

I ask cause according to Wikipedia[0], I reside in a country under U.S. sanctions but the sanctions apply to certain people instead of the entire country.

[0] http://en.wikipedia.org/wiki/United_States_embargoes

Post reply on HN