Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook vulnerability 2013

khalil-sh.blogspot.com

Post reply on HN
Print view View original

251–260 of 301 posts

Re: Facebook vulnerability 2013

#251

Post by rapind »

DominikR wrote: post #246
rapind wrote: post #231

Earlier quoted context omitted.

I disagree. I don't think that making a case by case assessment is opening the floodgates (that argument is exactly what I would call bureaucracy BS). For an exploit of this severity I would expect them to be grateful to someone who was obviously not being malicious regardless of some silly policy.

How would you feel if he found an exploit that allowed him to make all your private messages public and proceeded to report this by leaking your inbox? I'm no fan of Facebook, but even I can see why they can't ever encourage such irresponsible behaviour.

As stated, a case by case assessment would most definitely capture this fictional scenario appropriately.

Re: Facebook vulnerability 2013

#252

Post by semihmasat »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

Just empty talk.

Re: Facebook vulnerability 2013

#253

Post by coolbreeze762 »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

What you've just done is create a disincentive for "researchers" to report vulnerabilities to you. The next time Kahlil or someone else finds a vulnerability (and there will be a next time), he/she/they will simply use it and/or sell it. Kahlil did the right thing, at the end of the day, and only broke Facebook protocol in order to get your attention because you ignored his first (legal) notification of said bug. If you don't pay him, you'll have a hard time with credibility in future cases.

In addition to all of that, it's the right thing to do.

You stay classy Facebook.

Re: Facebook vulnerability 2013

#254

Post by simples »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

the real reason why he wont be rewarded, is because the guy who found the bug, is an arab from palestine, who was being ignored on purpose. facebook is jewish. simple.

Re: Facebook vulnerability 2013

#255

Post by imtheone »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

Pay the guy! He could have sold it and made lots of money. He was trying to do the right thing. Too bad he had to go to such extremes to get someone's attention.

Re: Facebook vulnerability 2013

#256

Post by DominikR »

rapind wrote: post #251
DominikR wrote: post #246

Earlier quoted context omitted.

How would you feel if he found an exploit that allowed him to make all your private messages public and proceeded to report this by leaking your inbox? I'm no fan of Facebook, but even I can see why they can't ever encourage such irresponsible behaviour.

As stated, a case by case assessment would most definitely capture this fictional scenario appropriately.

Well, we don't need to assess fictional scenarios, we can take a look at what this hacker has achieved.

1) Lots and lots of negative press. (we wouldn't talk about this if this wasn't true)

2) Embarassing the CEO of a company and thereby also hurting the reputation of his company

3) And on top of that he breached his privacy

And you still think that they treated him too harsh by withholding payment? I mean couldn't he have waited a few more days or reopen the ticket - or maybe just use Facebooks test accounts? It's not like he waited for ages, he brought this bug to attention last friday.

But yeah, waiting a whole weekend was probably too much for him to take, so he obviously had to post on MZs wall.

Re: Facebook vulnerability 2013

#257

Post by andy721 »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

your milking this aren't you. I know the truth.

Re: Facebook vulnerability 2013

#258

Post by Howesr1 »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

WOW. Facebook is proving their scuminess once more. It's $500. Pay the guy you cheap asshat b-tards.

Re: Facebook vulnerability 2013

#259

Post by andrew23950 »

mkjones wrote: post #34
mkjones wrote: post #28

Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

Facebook is wrong on this issue. OP made a good faith effort to report the problem. When this failed, he demonstrated the bug in a non-destructive way. He did not post maliciously, nor did he use the bug to obtain confidential information. When the channel set up by Facebook failed, he took the problem to the CEO. I will post this issue to various social media outlets until the OP is fairly compensated. Facebook's actions here are deplorable and discourage users' efforts to report bugs.

Re: Facebook vulnerability 2013

#260

Post by jimbob99 »

moocowduckquack wrote: post #60
mkjones wrote: post #34

Earlier quoted context omitted.

OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure polic…

"As you can see at https://www.facebook.com/whitehat , in order to qualify for a payout you must "make a good faith effort to avoid privacy violations" and "use a test account instead of a real account when investigating bugs." I just looked at it, then switched Facebook to Arabic and the TOS is magically still in English (edit - and right aligned really badly as the page evidently expects arabic). If you demand that…

Yes because if you go to Saudi Arabia and murder someone, you can get away with it because their law is written in Arabic and not English, therefore it doesn't apply to you. Newsflash - it doesn't work that way. The terms can be in Swahili and they still apply to you. Hacking somebody's Facebook to demonstrate a "bug" is black hat and not white hat. This was a real hack of a real person and this guy should be imprisoned in his home country, then extradited to the US to face cyber terrorism charges.
Post reply on HN