Remote Code Execution on a Facebook server

Re:Remote Code Execution on a Facebook server by tptacek on Saturday August 25, 2018 @12:05AM (#17839466)

Look, this is Hacker News, I know you can come up with 1,000 different random arguments for why Facebook was wrong and this guy was right. What I can tell you with confidence is that if you did what this researcher did as a contract pentester, you'd get your firm permanently fired from Facebook (or virtually any other major site you might have been testing), and would probably be immediately fired yourself. What he did was very much outside the norm for testing sites.

Remember, he didn't simply pivot. He back-pocketed credentials, didn't tell anyone he had them, and used them later to hit out-of-scope systems. Nobody is OK with that.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by sterlind on Saturday August 25, 2018 @12:25AM (#17839535)

Makes sense; I don't know the pentesting industry too well, nor the norms of bug bounty programs. Certainly his sort of behavior would give me the heebie-jeebies if I ran security at a firm like that. Thinking more on it, I think he was edging black hat and used the rules lawyering as an excuse for pushing past an ethical limit.

You've changed my view.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by tptacek on Saturday August 25, 2018 @12:31AM (#17839551)

I think this might be like the 3rd or 4th time I've managed to accomplish that the whole time I've been yelling at clouds on this site. Thanks!

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by Grue3 on Saturday August 25, 2018 @03:27AM (#17839974)

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

>He back-pocketed credentials, didn't tell anyone he had them

It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by pvg on Saturday August 25, 2018 @07:03AM (#17840380)

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

It's pentesting not penthieving. That's like saying military training is useless because they don't actually kill people.

[ Parent | on HN ]

Re:Remote Code Execution on a Facebook server by throwawaymath on Saturday August 25, 2018 @10:25AM (#17840885)

> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it.

> It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.

[ Parent | on HN ]