There is not a good, reliable way to make money from Facebook account takeover. You can conceive of them speculatively, but that is not the same thing as knowing you can execute, or, better, already having a business process in place that is already executing, just waiting for a new bug.
I worry that people are too obsessed about the hypothetical specter of tremendously skilled and bored black-hats who will ruin lives for fun, rather than for a pay-off, e.g. ZF0.
I'd assume having $15k to spend is a lot more fun than any enjoyment one could have by hacking someone's facebook account.
You'd have to have a real vendetta against someone to value ruining their life at $15k.
15k is actually cheap when compared with the costs of a private eye, a biker gang or a contract killer.
You're thinking about it wrong. There is no opportunity cost in their worldview, just lulz to be had at the expense of people they deem worthy of ruination.
(I never said the people that live in the intersection of trolls and blackhats are great at financial or career planning, after all.)
Translation: "Show us what you got and then we'll screw you over."
Sounds like you're less likely to get screwed by an escrow service found on TOR.
> Facebook's security team is one of the strongest and most sophisticated of any company
If that is true, how come they didn't catch this relatively obvious glitch discussed here.