In the post the album id for the attackers album and the victims album are the same, 518171421550249.
I'm not surprised the delete worked...
Deleting any Facebook album
101–107 of 107 posts
Re: Deleting any Facebook album
#102So here seems like as good a thread as any. What do you do when you think a company would just fix the bug based on your report and not pay out anything? I have seen so many bugs in the wild like this. For example a site in the uk where I can get access to any account I wish. Are there any data protection laws that would provide leverage? How would you make first contact with a company that doesn't advertise a bug bo…
Not like that. A few times I've gotten free software, twice I got some recognition, and one time I got $500. This was years ago before bug bounties were a thing. I simply emailed a technical person (once I called cause I had a prior business relationship) saying I had found a bug with security implications and I want to let them know privately, who's the best person. Always someone has been grateful at least. After you've explained everything to the right person and they get back to you, then you can ask. The $500 I did not even ask, I was assuming it would be like with the large company that simply mentioned my employer in the notice, it was from another large company, that floored me.
edit: And you're probably not going to get anything for what you found, but you'll get a thanks if you go around it right, and you'll get arrested or ignored if you don't. You might get some recognition too, and that's worth a lot when you are young.
Re: Deleting any Facebook album
#103Re: Deleting any Facebook album
#104Earlier quoted context omitted.
And then go to jail. Great plan there...
Only if you are caught _and_ they can prove you did it, which isn't likely to be easy if you launch the attack from a botnet.
And when you inevitably do get caught red handed, don't worry, because you'll have a Greek Chorus of Internet commenters making t-shirts advocating your release and writing Boing Boing articles about how you got screwed. Unless your offense involves credit cards, the celebrity might be worth the (very minimal) sentence you'll end up with.
Re: Deleting any Facebook album
#105Holy heck, $12.5K? That's one heck of a nice bug bounty program Facebook has there. That is likely more than the black market would pay for this, or at least a lot less hassle (plus the black market might have little interest as this cannot be used for hijackings, just trolling/harrassment).
It's not very useful to compare bug bounty payouts to what the "black market" would pay for a vulnerability. Let's look through the challenges of selling a vulnerability that allows for arbitrary account takeover (much more serious than this): 0. Find the vulnerability. Assume that no one will find it by the time you find a third party buyer. 1. Look for a buyer. If you're not well-connected, you might stumble into a…
Looking over your list it seems that Shellshock (and possibly heartbleed) would have been extremely profitable on the black market. Any guess as to their selling price?
Re: Deleting any Facebook album
#106So here seems like as good a thread as any. What do you do when you think a company would just fix the bug based on your report and not pay out anything? I have seen so many bugs in the wild like this. For example a site in the uk where I can get access to any account I wish. Are there any data protection laws that would provide leverage? How would you make first contact with a company that doesn't advertise a bug bo…
No, that email doesn't seem okay at all. That's extortion. A company has every right to not offer a bug bounty, and to fully prosecute you for trying to find a vulnerability (you can quibble about what "trying to find a vulnerability" means, but they have the right, like it or not). You have no right to demand payment for a perceived vulnerability in a company's infrastructure, even if they have a bug bounty program.…
>to fully prosecute you for trying to find a vulnerability
Wouldn't that strongly depend on how you found it? E.g if a friend sends you an invite to share files on dropboks.com (hypotetical dropbox like service) and you copy and paste only part of the link, you now have access to his files (think /mergers/dove-soap but you insert /mergers/ and get to see all his mergers). In this case you stumbled on a huge security issue but how did you do anything illegal?
Re: Deleting any Facebook album
#107Is anyone else kind of shocked that this particular vulnerability exists given that Facebook employs "the best and brightest" in the industry? This isn't one of those vulnerabilities that relies on numerous seemingly unrelated steps and makes you wonder how the person ever thought it up. Instead, this is security 101 stuff. Facebook simply wasn't making sure userFor(appKey) == owner(albumId). I would've assumed obvio…
That is not how a scalable architecture looks like. You don't want to handle authorization in the same service that's responsible for deleting the resource. Yes, there should have been tests in place, but no it's not a missing if condition.
Couldn't you have a service which checked you were allowed to delete something, then handed a deletion order back (essentially a signed xml blob) which would then get passed on to the actual deletion service (and here validated)? That way no issue with scalable architecture and no issue with hacks like this.