Hacker News Reader

> that in itself breaks their ToS for the bug bounty program

Except it doesn't?

Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.

Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.

You're actually correct. I think this situation is a bit more complicated than it seems at first.

Updated original reply.

I'd say it does.

Not interact with other accounts without the consent of their owners.

Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.

Obviously that's referring to facebook accounts.

Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent.

Also, the guy seems to only have verified that the credentials worked.

Reply on news.ycombinator.com