News for hackers. Stuff that matters.

A comment on Facebook paid $4.5K for disclosure of my user account exploit. Parent comment

Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @10:24AM (#5798775)
If you say so. Where would you find them? There appears to be a functioning market for drive-by clientside RCE. The Interwebs seem to have interpreted this as evidence that there is a market for all kinds of vulnerabilities. I am skeptical that this is the case, and, unlike the RCE markets, I have no evidence to suggest that the website auth bypass markets are real.

I suppose the ability to generate unbounded Facebook likes or Twitter followers is monetizable.

[ Parent | on HN ]
Re:Facebook paid $4.5K for disclosure of my user account exp... by mootothemax on Friday May 31, 2013 @11:48AM (#5799282)
I have no evidence to suggest that the website auth bypass markets are real.

You could definitely contact your local firm of private investigators, insinuate that "I can access anyone's FB account," and make a tidy sum from doing just that.

Playing devil's advocate, admittedly, but there is still a very active market for quite petty-yet-nasty stuff, e.g. land developer wanting to access email accounts of local residents protesting against the plans.

Actually, you want weird? Thanks to my latest "seeking work" post on HN (and "Hacker" appearing in the page's title), I had someone ask me to hack the local authority computers responsible for registering peoples' deaths. This was, apparently, in order to give his funeral director company a leading edge.

Does Matasano never get cranks asking for stuff of a similar nature?

[ Parent | on HN ]
Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @01:51PM (#5800096)
There's a difference between a functioning market for something and your ability to one-off 1:1 contracts for things. Hyperbolic comparison: you can also pay to have someone killed, but random people on the Internet don't have access to a market for putting out hits.
[ Parent | on HN ]
Re:Facebook paid $4.5K for disclosure of my user account exp... by shawabawa3 on Friday May 31, 2013 @10:34AM (#5798841)
Just to clarify, "drive-by clientside RCE" means remote execution on the browser just by visiting a website? Like one of the recent Java 0-days?
[ Parent | on HN ]
Re:Facebook paid $4.5K for disclosure of my user account exp... by tptacek on Friday May 31, 2013 @11:02AM (#5798999)
Yes.
[ Parent | on HN ]