I submitted a bug to Facebook's whitehat disclosure 3 or 4 months ago. Got no response whatsoever, except an automated response. The bug still exists. The bug allows users to post as though they are other users on the timeline. I think that is pretty serious, but I guess they do not.
Facebook vulnerability 2013
101–110 of 301 posts
Re: Facebook vulnerability 2013
#102Figure out another way to reward this guy (maybe tell him that it's a gesture of goodwill only) and reward him. It doesn't have to be from Facebook, Inc, but he should get something from somewhere.
Otherwise, next time him or any of his friends find a vulnerability, they'd be tempted to share it with the people who would reward them, since they've seen firsthand that their reports to facebook seem to just get ignored. When you consider that his entire region is in turmoil, and that social media is clearly playing an important role in the uprisings across that region [whether you agree with them or not], you'll understand our reasons for insisting that his efforts be rewarded somehow.
Edit 1: Not suggesting that fb intentionally ignores their reports for poor English or any other reason, but that's clearly the impression they're getting.
Edit 2: And while I have no reason to believe that this guy (Khalil) would ever report a vulnerability to some dictator's security forces, others who have seen this story might. And those who have seen this need not be his friends either, since it's on HN, /r/technology, and elsewhere.
Edit 3: As tszming suggested, if you don't want to risk setting a precedent by offering cash, you could perhaps sponsor an all-expenses-paid trip (with no implications of future employment) for him to visit Facebook HQ. Granted I don't know the legal implications of this, but it does give you a chance to buy this guy lunch and tell him in person that you do appreciate his efforts, motivate him to continue reporting any vulnerabilities he finds, and tell him to encourage his friends to do the same. Actions speak louder than words, and there's no question this would have a far bigger impact than the dismissive two-liner he received, even if the intention was the same.
Re: Facebook vulnerability 2013
#103Earlier quoted context omitted.
OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…
Pay the man. He stumbled around a bit trying to work out how to help, but he brought a flaw to your attention in what he thought was a polite way. If unleashed, this bug could've been used to wreak havoc on Facebook and damage the company's reputation. $500 is the very least FB should be paying.
after being treated this way, i doubt this man (probably everyone who read this) will ever report bugs to facebook anymore.
Re: Facebook vulnerability 2013
#104Earlier quoted context omitted.
OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…
Pay the man. He stumbled around a bit trying to work out how to help, but he brought a flaw to your attention in what he thought was a polite way. If unleashed, this bug could've been used to wreak havoc on Facebook and damage the company's reputation. $500 is the very least FB should be paying.
if this bug, does what i think it does, this man if met with certain group of people, had the chance to make millions out of this bug.
Re: Facebook vulnerability 2013
#105Earlier quoted context omitted.
Again: how exactly do you propose that they write a policy that compensates people for violating the security of their users? Not the security of Facebook, but the integrity of their actual users. We all know this person had good intentions. But good intentions aren't always enough. Facebook doesn't appear to be freaking out at him. They just can't pay him for having demonstrated a vulnerability by hacking someone's…
Not sure what you mean by "again". > They just can't pay him for having demonstrated a vulnerability by hacking someone's account. I don't see why that is. They already provide the following caveat: > When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing.[1] So I don't think there's some kind of legal issue there, if that's what you mean. And…
Immediately following that quote: Do not interact with other accounts without the consent of their owners.
Re: Facebook vulnerability 2013
#106Earlier quoted context omitted.
They didn't pay because he messed with other peoples' data. That's a clear no-go.
He couldn't have proved without doing that .
He could have made test accounts with appropriate privacy settings. He could have just told the security team, "Your server does not validate permissions when posting to walls, so if you change this specific HTML form value to anyone else's profile ID, it will post to their wall."
Re: Facebook vulnerability 2013
#107Earlier quoted context omitted.
The situation is the guy in good faith tried to give them repro steps and report a critical bug. Technically he fucked up and didn't do it on a white hat account. No harm was intended or done. They are denying him his reward based on a technicality. If that FB employee is not some lawyer trying to cover their asses, then he should want to pay this person and make it happen via some exception. If they truly didn't car…
They're not "denying him the reward". He demonstrated the vulnerability on someone's actual account. They can't pay people to fuck with other people's accounts. That's not what bug bounties are about. Only on a message board is this hard to understand.
A very specific message board, it seems like. /r/netsec is having no trouble understanding it.
Which leads me to believe most people commenting are not doing so with an actual understanding of the situation, and are instead viewing this solely as Big Bad Facebook vs innocent hacker.
Re: Facebook vulnerability 2013
#108Earlier quoted context omitted.
This used to be part of a user's profile URL but Facebook allowed people to choose a "vanity URL" quite a while ago, so they're no longer as visible. They're still visible in photo albums and the like. Far from hidden.
It's not really obvious though
If you're investigating Facebook exploits it's one of the first things you'd have to learn about.
Re: Facebook vulnerability 2013
#109One on of my issues with FB is that its not easy to report a problem or get any kind of support (although its a free service). In one day, I lost over 100 facebook friends with no explanation. Its obviously a little humiliating to have everyone think you defriended them. I hadn't seen the issue before, nor could I report it anywhere..
Re: Facebook vulnerability 2013
#110Earlier quoted context omitted.
Pay the man. He stumbled around a bit trying to work out how to help, but he brought a flaw to your attention in what he thought was a polite way. If unleashed, this bug could've been used to wreak havoc on Facebook and damage the company's reputation. $500 is the very least FB should be paying.
after being treated this way, i doubt this man (probably everyone who read this) will ever report bugs to facebook anymore.
i said that many times , agreed