Re:I Hacked into Facebook's Legal Department Admin Panel
by tschwimmer on Monday December 14, 2020 @01:01AM
(#25414042)
I disagree. I can imagine tons of parties that would pay good money for access to Facebook's legal admin panel. Without knowing exactly what's in there, one could imagine lawsuit filings, documents and data that have been put aside during a legal hold, C&Ds sent to people doing things Facebook doesn't like, etc. What can you do with this data? Well, probably embarrass Facebook badly by exposing all sorts of confidential discussions. You might be able to pull an invoice scam by harvesting vendor information and sending a bunch of fake invoices to be paid. You might find other unsecured information that allows you to escalate your access. One can only imagine.
Sure, the economic value of the root password to the NAS for Joe's Carwash is quite low but I suspect even the low level systems at high profile companies is worth tons (I'd guess millions) of dollars to the right (wrong people).
Re:I Hacked into Facebook's Legal Department Admin Panel
by tptacek on Monday December 14, 2020 @02:45AM
(#25414513)
You can disagree, but you're wrong. The kinds of people who watch dark marketplaces for exploits are not dreaming of the super interested information they can get off a random backoffice system.
One time, about 15 "bug bounties are a ripoff" threads ago, someone actually made a non-ironic case for a high valuation for logout CSRF bugs. A competing image service could employ it to ruthlessly log users out, degrading service and jacking up their own signups. A logout CSRF. That's the kind of logic we're talking about here.
Nobody buys these kinds of bugs speculatively.
If your bug generates OG Instagram accounts, you'll probably find a buyer --- they will be loons who are likely to land you a prison sentence, because that's the general caliber of person who commits felonies to briefly lock up short account names on Instagram, and you'll have absolutely no way of arguing in court that you didn't know exactly what they were going to do. But you'll probably sell it, because there is an existing business process that acquires OG Instagram accounts your bug can slot into.
Nobody has a business process for exploiting access to a stupid internal legal dashboard application. Nobody is going to shell out more than $7000, speculatively, for access to this website.