Hacker News Reader

Comment by green_on_black | Hacker News Reader

He got $5k for an arbitrary remote execution bug? What a rip-off.

He received $5,000 for remote code execution on a server in a separate VLAN and containing no user data. Barring another vulnerability to commit something like server-side request forgery across the VLAN, that significantly reduces the actual severity of the vulnerability. You wouldn't be able to chain this execution to impact user accounts or other Facebook servers. You also wouldn't be able to exfiltrate sensitive user data. Realistically, what you'd have is a very privileged server for phishing attacks.

The severity of security vulnerabilities should be judged on their context, not on their classification or category.

I remember the guy who broke into a Facebook server then used the information stored on that server to get onto a more important server with user data. He either didn't receive a bounty or got a reduced bounty because the server he accessed was deemed unimportant and chaining hacks is against the rules or something.

Think it was this one: http://exfiltrated.com/research-Instagram-RCE.php (actually it's even worse than I thought with Facebook threatening legal action against him)

That's not at all the whole story.

Do you know the rest? That seems pretty damning. The researcher followed the bug bounty rules to the letter and Facebook applied a different set of rules, then intimidated his employer. It's also duplicitous for them to claim his bug as inconsequential, and his access as a huge privacy violation.

If Facebook wanted to discourage pivoting access, they should have clearly stated so as Google and Microsoft have.

The researcher did not follow the rules to the letter. They found an in-scope RCE vulnerability, then dumped and saved the filesystem contents and used them, after reporting the bug, to compromise Facebook's AWS configuration. You would get in trouble for doing that even on a contracted penetration test, let alone a bug bounty. To make matters worse, the researcher did all this in a fit of pique about not being awarded a higher bounty.

There's a whole thread on HN about this.

Here's Alex Stamos' writeup:

https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

The researcher's blog contains a reasonable rebuttal of Alex's write-up:

>In the case of Facebook, the rules can be seen at https://www.facebook.com/whitehat. There is no rule which states what to do when a vulnerability is discovered, but there are several which imply that my testing was valid. These include: Report a bug that could ... enable access to a system within our infrastructure Remote Code Execution Privilege Escalation Provisioning Errors

We both agree the initial RCE was in-scope. The researcher reported the RCE immediately, then reported the privilege escalation by weak user passwords, then reported the API key escalation.

Moreover, you're factually incorrect about the "fit of pique." The researcher stopped poking around immediately after receiving the email; he simply continued before Facebook contacted him. When Alex said,

Please be mindful that taking additional action after locating a bug violates our bounty policy.

There was no reference whatsoever to that policy in the official Bug Bounty guidelines. Alex fibbed. Indeed, how is a canonically "in-scope" privilege escalation supposed to work if researchers are to stop at the first bug?

Lastly, if Facebook's idea of defense-in-depth is a master API key to all Instagram S3 buckets, accessible from a simple diagnostic panel, any bug bounty program is merely window-dressing.

Not to mention the part where he engaged the researchers boss who was completely not a part of this research.

If you read Stamos' post more carefully, he explains exactly why he did that, and given that his alternative was to engage Facebook legal directly, the researcher should probably be glad that's what ended up happening.

Look, this is Hacker News, I know you can come up with 1,000 different random arguments for why Facebook was wrong and this guy was right. What I can tell you with confidence is that if you did what this researcher did as a contract pentester, you'd get your firm permanently fired from Facebook (or virtually any other major site you might have been testing), and would probably be immediately fired yourself. What he did was very much outside the norm for testing sites.

Remember, he didn't simply pivot. He back-pocketed credentials, didn't tell anyone he had them, and used them later to hit out-of-scope systems. Nobody is OK with that.

Makes sense; I don't know the pentesting industry too well, nor the norms of bug bounty programs. Certainly his sort of behavior would give me the heebie-jeebies if I ran security at a firm like that. Thinking more on it, I think he was edging black hat and used the rules lawyering as an excuse for pushing past an ethical limit.

You've changed my view.

I think this might be like the 3rd or 4th time I've managed to accomplish that the whole time I've been yelling at clouds on this site. Thanks!

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

>He back-pocketed credentials, didn't tell anyone he had them

It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

It's pentesting not penthieving. That's like saying military training is useless because they don't actually kill people.

> So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about.

He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it.

> It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario.

I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.

I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage.

Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.

Where are you pulling that number out of?

Honestly, just a gut feeling. (So, my ass.) I just feel like RCE should warrant somewhere around that much by default, even if the overall impact isn't high in a particular case. Some combination of potential impact and nature of the vulnerability/exposure should go into reward calculations, in my opinion.

But is RCE worth 15 because he got 5? If he'd gotten 1, would you say he deserved 5? Or 3?

I think I would've said something close to $15k either way. $5k isn't insulting (in my opinion) given the context. $1k would definitely be insulting.

Probably the same rather random place where $5000 got pulled out of in the first place

Please explain how you would go about valuing this bug.

He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?

You didn't read the article.

"09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."

From the HN guidelines:

Please don't insinuate that someone hasn't read an article.

Not applicable when it's obvious that the poster hasn't read the article, like in this case.

It's applicable precisely in that case.

To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.

It's not a hard rule to follow. You can just say 'The article says X'.

He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).

Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.

What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".

The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.

How are you quantifying that?

Reply on news.ycombinator.com