Facebook paid $4.5K for disclosure of my user account exploit

Re:Facebook paid $4.5K for disclosure of my user account exp... by calinet6 on Friday May 31, 2013 @09:19AM (#5798392)

Sounds pretty generous, actually. They could have given nothing and he would have simply written a slightly more angry blog post; like they really care.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by waterside81 on Friday May 31, 2013 @10:12AM (#5798690)

Since you're a security pro, why do you think this is the right amount? Because of the ease/difficulty in exploiting it?

How much damage could have been done to FB's credibility if this guy had been malicious?

I suppose it's damned if you do, damned if you don't.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @10:15AM (#5798714)

It's just about what Google pays for auth bypass on sensitive servers.

"How much damage could have been done" doesn't really enter into the calculation.

I'm not seeing how anyone's damned here.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by gbrindisi on Friday May 31, 2013 @10:21AM (#5798757)

Genuine question: how much would have you charged if facebook hired you to perform a pentest or a vuln assessment?

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @11:05AM (#5799024)

The same as we charge everyone else? In fact, big companies often pay less, not more, since they can buy in bulk.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by CJefferson on Friday May 31, 2013 @10:22AM (#5798760)

In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @10:24AM (#5798775)

If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real.

I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by mootothemax on Friday May 31, 2013 @11:48AM (#5799282)

I have no evidence to suggest that the website auth bypass markets are real.

You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that.

Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans.

Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge.

Does Matasano never get cranks asking for stuff of a similar nature?

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @01:51PM (#5800096)

There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by shawabawa3 on Friday May 31, 2013 @10:34AM (#5798841)

Just to clarify, "drive-by clientside RCE" means remote execution on the browser just by visiting a website? Like one of the recent Java 0-days?

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @11:02AM (#5798999)

Yes.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by borlak on Friday May 31, 2013 @11:41AM (#5799238)

You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tomjen3 on Friday May 31, 2013 @12:28PM (#5799553)

Most people are locked into facebook.

And you could just send them an email, carefully tailored to target them, with a link to your exploit site.

[ Parent | on HN ]