Zero Click Facebook Account Takeover and Two-Factor Authentication Bypass

medium.com

41 pointsahiknsr4 comments

I can't tell if this is legit or not, due to the typos, writing style, etc. I name searched this person and found some tweets of them collecting two other bug bounties from Facebook.

https://twitter.com/yaalaab/status/1603827006243733520/photo...

https://twitter.com/yaalaab/status/1431371005654618117/photo...

https://twitter.com/yaalaab/status/1268659389625483265/photo...

He got $3000 for finding this bug, which seems unusual since it sounds like the most catastrophic thing possible. Facebook also paid him $15000 two years ago for another bug bounty, so I can't imagine how bad that one must have been. Glad to hear the rewards for white hat hacking are so lucrative. He'd probably be better off applying for a job at Facebook as one of their janitors, cleaning the toilets of clueless SWEs.

Yeah wtf.. 3k is a disgustingly low amount for such a high-profile vulnerability, if true.

Perhaps he is not English, at least he understands a few of them. As for you, I am almost certain that you do not understand anything else. The world is full of languages, and Facebook does not care about language more than the loophole.

Holy moly

Reply on news.ycombinator.com