Remote Code Execution on a Facebook server

Re:Remote Code Execution on a Facebook server by meowface on Friday August 24, 2018 @12:54PM (#17836117)

I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage.

Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by tptacek on Friday August 24, 2018 @03:46PM (#17837385)

Where are you pulling that number out of?

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by meowface on Friday August 24, 2018 @06:24PM (#17838239)

Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by tedunangst on Friday August 24, 2018 @08:36PM (#17838860)

But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by meowface on Sunday August 26, 2018 @07:31PM (#17848505)

I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by arcticfox on Friday August 24, 2018 @07:18PM (#17838534)

Probably the same rather random place where $5000 got pulled out of in the first place

[ Parent | on HN ]