Facebook paid $4.5K for disclosure of my user account exploit

Re:Facebook paid $4.5K for disclosure of my user account exp... by CJefferson on Friday May 31, 2013 @10:22AM (#5798760)

In what sense? I'm sure you could find people who would pay $20,000 to view anyone's private photos.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @10:24AM (#5798775)

If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real.

I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by mootothemax on Friday May 31, 2013 @11:48AM (#5799282)

I have no evidence to suggest that the website auth bypass markets are real.

You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that.

Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans.

Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge.

Does Matasano never get cranks asking for stuff of a similar nature?

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @01:51PM (#5800096)

There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by shawabawa3 on Friday May 31, 2013 @10:34AM (#5798841)

Just to clarify, "drive-by clientside RCE" means remote execution on the browser just by visiting a website? Like one of the recent Java 0-days?

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @11:02AM (#5798999)

Yes.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by borlak on Friday May 31, 2013 @11:41AM (#5799238)

You can't just view anyone's private photos. They have to have been logged into facebook (have a session) and then go to your domain with the exploit.

[ Parent | on HN ]

Re:Facebook paid $4.5K for disclosure of my user account exp... by tomjen3 on Friday May 31, 2013 @12:28PM (#5799553)

Most people are locked into facebook.

And you could just send them an email, carefully tailored to target them, with a link to your exploit site.

[ Parent | on HN ]