Instagram's Million Dollar Bug

Re:Instagram's Million Dollar Bug by biot on Thursday December 17, 2015 @05:48PM (#10755200)

Summarizing what I've seen here in analogy form:

  Researcher: "I found a way to unlock your door"

  Facebook: "Thanks, here's $2500. We've now fixed the problem."

  Researcher: "Oh, BTW when I unlocked your door I rifled through
    your stuff and found your passport, your banking details, and a
    lot of personal information. I've kept copies of these. I also
    found the keys to your car and looked inside, where I found a box
    in the trunk. That box contained sensitive documents including an
    employee badge / proximity card. I used this card to gain access
    to your workplace. In doing this, I also managed to get into the
    janitor's closet which had a set of keys. I used these keys to
    get access to the complete building and took a look at all the HR
    files and rifled through a bunch of corporate contracts."

  Facebook: <gobsmacked>

  Researcher: "Can I have my million bucks now?"

Where the researcher stepped over the line is using the door attack to escalate further attacks. It's little different than finding a way to reliably impersonate Mark Zuckerberg's credentials in such a way that others will 100% believe it. That finding is worthy of a reward. But then using that vulnerability to social engineer others to reveal passwords, using that as a launching point for mounting further attacks is going way too far.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug by repn001 on Thursday December 17, 2015 @08:46PM (#10756073)

I saw it more like:

  Researcher: "I found a way to unlock your door"

  Facebook: "Thanks, here's $2500. We've now fixed the problem."

  Researcher: "Ohh hey about that bug. Turns out that
 door, if the guys from the Ashley Madison breach found
 first, your entire company would lose billions in market
 cap, you and all your friends would no longer have jobs,
 and the trust placed in your company by the public would
 be so eroded that there's a good chance it would no longer
 exist."

  Facebook: "Well this is embarrassing. Our boss found out
 and talked to your boss, the subject of lawyers and law
 enforcement may have been mentioned in an effort to keep
 this info getting to the public, and when this failed, he
 made a highly visible blog post discrediting your
 professional conduct"

  Researcher: <gobsmacked>

You can make the case for misconduct on both sides but I'm more inclined to side with the researcher. If you define bugs and the associated bounty by the amount of possible damage it could cause, this one would definitely be 'catastrophic'. And Facebook would still be none the wiser if he hadn't dug deeper.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug by bloaf on Thursday December 17, 2015 @08:36PM (#10756043)

   Oh by the way, when I looked in your open front door, I noticed all your 
   computer terminals had their passwords written on post-it notes by their 
   monitors, and the big safe in the back room had its key hanging right 
   next to it on a chain.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug by flgr on Thursday December 17, 2015 @06:32PM (#10755496)

Except that for a company as big as Facebook your security provisions probably shouldn't stop right at the front door.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug by niutech on Friday December 18, 2015 @01:33AM (#10757037)

Sorry, but being a multi-billion company, pledging $1M bounty and giving only $2500 for a serious bug which could lead to taking control of the whole Instagram is greedy. I can understand why the researcher didn't stop there.

[ Parent | on HN ]

Re:Instagram's Million Dollar Bug by adrianmacneil on Thursday December 17, 2015 @07:02PM (#10755665)

Also note that the second part of this conversation happened over a month after the original report.

[ Parent | on HN ]