That statement is just plain wrong. With over a billion Facebook users, surely some of them are high-value targets.
(Valuable != "immediate drop-in value")? So, he's saying the accounts aren't valuable, but they have value? The subtlety is lost on me...
Actually, you say the info has "a use"... does that not directly imply worth?
Imagine going to a tech trade show and setting up a stand for your lumber business. What you're selling has value and is useful, just not to the people you're trying to sell it to.
Edit: My intent was to understand your perspective (and argue...), but this comment goes over my head, and it seems as though it was a thinly veiled insult.
Not sure if you read Cryptonomicon, but there's a part there where Randy Waterhouse finds a crap load of gold in the middle of a jungle and then rationalizes that there's no easy way to get it out of there, making it worthless at that moment. That gold has value, but no liquidity.
If done intelligently, this is incredibly difficult to trace. There is risk (rather than a straight-up sale), but the expected returns are probably an order of magnitude higher.
It would likely be far cheaper and easier to execute something like this via social engineering than using an actual exploit. I'm reminded of the time Twitter user @m had his handle stolen because Apple gave up some personal info.
Given that there are likely 100s if not 1000s of FB users who may have access to Bloomberg/AP/NYTimes official page, figuring out in an automated fashion of who can be easily socially engineered isn't likely worth 15k.
The first example that comes to mind, "an organised trade in confidential personal information"
https://en.wikipedia.org/wiki/News_International_phone_hacki...
Just because this isn't the typical mass vulnerability SQL injection or XSS attack on a major framework doesn't mean it's basically worthless ($15k or less).
The amount of damage that could be done to Facebook's reputation is enormous, not to mention the value of the information that could be stolen.
Obligatory quote from Kanye's newest album 'The Life of Pablo':
" I had a cousin that stole my laptop that I was fuckin' bitches on
Paid that nigga 250 thousand just to get it from him "
Go try to sell an IBB bug.
Step two: hack into Tim Cook's account (no idea if he uses FB)
Step three: publish rant about Apple rotten ideoligies/he quits
Step four: see APPL lose value for a day until this shit is sorted
Step five: profit
Or something like that
Step 7 - get out of jail and decide doing far less risky illegal stuff has a better expected payout.
It all really depends on how fast FB can service the requests and how long it takes for them to notice and shut it down. Push your priority list off to a worldwide farm and watch the accounts pop out.
How long until FB would have it shut down and the affected accounts locked out?
It won't matter if everyone can get the latest version of Facebook if no one is willing to use it anymore.
In the real world, vulnerabilities are sold to blackhat groups who want to make a profit by attacking as many websites as possible. Generally, these websites will have valuable credit card or other information that can be stolen from a compromised server.
Compromised user accounts (not even the server! just users!) on a single website do not constitute a valuable target.
The idea that TMZ would pay a significant amount of money for this is a Hollywood plot, nothing more. Vulnerabilities are not valued highly just because you can come up with a contrived scenario in which it would be valuable to someone for some reason.
This is a market, and like any other market there are buyers and sellers who dictate supply and demand.