Re:Breaking GitHub Private Pages for $35k
by vmception on Tuesday April 06, 2021 @06:22AM
(#26710171)
Also its worth considering that all these applications get updated like every week, so something that was ruled out in the past can be exploitable now.
Re:Breaking GitHub Private Pages for $35k
by paulpauper on Tuesday April 06, 2021 @07:34AM
(#26710618)
This is not just finding bugs but coding and dev., work. I too found bugs in fakebook but they never paid me, but they did fix them.
[dead]
Re:Breaking GitHub Private Pages for $35k
by montenegrohugo on Tuesday April 06, 2021 @08:58AM
(#26711216)
Just to clarify: you exploited said hole to access private photos of other people without their consent or knowledge?
What agreement they had with facebook I am unaware of. But facebook seemed to treat them as public.
Facebook and access have always been confusing and this is setup on purpose. Some photos show up in feeds some are available to other group members. Photos you think are private are private until someone else you know is tagged in them.
Re:Breaking GitHub Private Pages for $35k
by breakingcups on Tuesday April 06, 2021 @09:21AM
(#26711436)
I not only have an ethical issue with what you just said, I also question the wisdom in disclosing your illegal activities on a public forum.
I wouldn't assume illegal activities occurred. Did you know facebook had an easy to access search feature for key employees to view anyone's private profile. All very legal.
As for the ethnical issues. I'm not sure I buy in. At one point typing profilename/photos showed you everyones albums private or not with a small picture. You needed access to go further. That's more of a facebook design decision. At least one private photo and the any album name were purposely not private.
Finding a bug and not reporting it is not illegal. The rest is assumptions.
Re:Breaking GitHub Private Pages for $35k
by MattSayar on Tuesday April 06, 2021 @06:38PM
(#26718275)
Plus just being curious. I once found an exploit in a large IAM vendor's multifactor auth flow by just playing around with the Inspect tool in my browser. I told my customer success manager and they fixed it. Too bad there was no bounty :(
As someone who once got a $500 bug bounty from Facebook in high school, I'll have to say that this is not so surprising. Finding these bugs is 10% knowing about attack vectors (CSRF, XSS etc.) and 90% spending time trying them out in various forms in all the places you can think of. In school (especially if you're already doing well there) you often have lots of spare time and not so many others way of earning money. And with just a few years of experience with programming/computers there are far quicker ways to earn money.
It's still super impressive work by the author of course!! They are extremely talented! I'm not trying to dismiss what they accomplished; just commenting on the strange dynamic of software security research.