Facebook bug hunter paid $10K by community, not company | Hacker News Reader

Facebook bug hunter paid $10K by community, not company

zdnet.com

30 pointsgeektips23 comments

I'm happy for the guy and all, but Facebook is doing the right thing by not paying the bounty. They specifically bar messing with real user data, while they could have handled the original report better that's still not justification. If you bend the rule once, everyone will want you to bend the rule "just one more time" for them.

I haven't been paying close attention to this, so forgive the ignorance if I'm wrong: didn't he try to use the correct channels, but was turned away?

The big idea as I understand it is:

He proved the bug on a live account instead of one of the prescribed test accounts

He reported it as "this is a bug" not as "this is the procedure to use in order to reproduce the bug"

He demonstrated critical inability to report the steps required to reproduce the bug.

It must get to the point where this money faucet receives hundreds of people submitting "bugs" where their friend has really left their account logged in and it's been exploited via social engineering, or some other "not a bug", so bugs are closed when they're submitted with not enough information.

I understand and subscribe to this strategy myself.

You missed the part where FB -- admit to and are fixing -- lack any process to deal with those that are either not aware or don't understand the process. At no point do they instruct the reporter that it'd be helpful to provide more steps and that he should not be using live accounts to demonstrate the PoC. Nay, they merely shrugged him off and stated his actions were "not a bug."

You know, I went looking for help on something this morning (why does ntop crash so much?) and at first all I could find was a post asking a similar question, and a reply about how to ask the question better.

The GP replied (paraphrased) "there are a lot of posts on this board asking for help and 95% of the replies are about how to ask the question better. You would do well to try and read between the lines a little bit, just try interpreting and answering some questions instead of just posting all about how poorly the questions are asked."

The point is, that guy wasn't offering money. He was supporting free software. I agree it's easy to make a blanket response for posts not providing enough information, but if they can't fill out the form correctly enough for the reviewer to duplicate the result, why should they get the money?

Just to close the loop, I did find another post eventually where the author explains he "is aware" that ntop crashes frequently when it's configured to monitor multiple interfaces, and you should use the SVN builds since they are more robust. The bug still exists in FreeBSD and I update my ports tree every day.

Searching for "ntop quits" again to put some dates on these posts, I see the complaint was in 2003 and the post addressing my issue was in 2011. I guess it still hasn't been fixed, but the software is still well-known. Anecdotes are like...

From that description, he sounds smart, but not well versed in proper protocols.

Seems like there should be a way to filter such bug reports (a web form?).

That's completely inaccurate. He responsibly disclosed the bug but Facebook security didn't have the right privacy settings turned on and was completely unresponsive to a huge security hole. So he did something non-malicious to get their attention and it was fixed in 5 minutes. See how that works?

Your reply seems like the best, but it makes me angrier than the rest. You're lucky I only have one button! (upvote)

The whole point was that the legitimate channels all ignored him, so he had to take it one level further.

No, please go read what happened. He messed with real user data prior to to his attempted reporting of the bug. In fact the only thing he sent to the FB team was a link to a real user who he had messed with

This. It is really starting to piss me off that nearly every article so far fails to mention that he messed with a real user account BEFORE he even tried to report the bug. This matters because this (messing with real users) is why FB isn't paying him. Sure FB handled the poorly written "bug report"... poorly. But he was already not going to get paid before he even sent the bug report.

From my understanding he messed with real accounts when Facebook didn't take the issue seriously, shrugging him off rather than discussing with him.

Facebook should have rewarded him. Instead turning him away only makes a white hat hacker turn black hat and sell the exploit to the back market for far more than he would have initially got from Facebook.

No, he messed with real user data and then attempted to report it. Even if the FB employee had followed up correctly with him, he's still have broken the rule.

Yes, he messed with real data, but he appears to have no idea that is a problem, given the blog post that spawned these numerous threads about the events that transpired. FB did not follow up with him; did not explain the rules; he had no idea he had wronged anyone and thus expected a bounty (Re: his blog post to the public). FB could have avoided all of this and probably without the bounty; they could have explained the rules better and made sure he understood why no bounty was plausible.

From his blog post:

     i report that exploit through whitehat --> www.facebook.com/whitehat

So he clearly found the whitehat page. While English may not be his first language he clearly has some higher level understanding. The phrasing of "don't mess with data" is pretty clear:

    make a good faith effort to avoid privacy violations

And if you look at testing accounts, it's also quite clear (emphasis mine):

Please use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other accounts without the consent of their owners.

I don't purport to know the reporter's acumen. It's not clear, at all, that he read (and all of) nor understood the "Info" page; he could have simply skimmed or went directly to the "Report" page. He could have located the page only after having produced the PoC.

What is crystal clear though, FB could have responded better; they admit to that. The reporter has no obligation to them, especially when they won't give him a minute of their time. I'm not here to suggest one way or another on the bounty; there are obviously legal aspects that are not very interesting; he got his from the community, instead.

Again, the fiasco -- bounty or not -- might have been avoided by FB having better responses -- boilerplate even -- to coach the reporter; in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken. Rules had to be broken -- again -- to escalate the issue; it's not even clear that using test accounts to demo the PoC would have produced a different response from "not a bug."

    >in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken.

Err, how do you come to that conclusion? It is against FB's ToS to knowingly muck with userdata that isn't yours or that you don't have permission to access. It doesn't matter what you're doing, knowingly messing with user data is against the ToS.

And while yes, the FB staff member could have responded better I'm not terribly surprised or upset with how they did respond. Most of the text of the email was describing the author's lack of job. The "report" was simply a link with no real information. When sifting through bug reports, this one exudes "this isn't an actual bug"

I completely agree. It's not like Facebook didn't pay just because they didn't feel like it. They couldn't pay without rewarding a blatant violation of their ToS. If they paid once, then they would have to start paying any researcher who abused the vulnerability before reporting it.

Not a bad pay day for a critical bug. Forget the black market, hypothetically speaking I wonder how much an ad agency would have paid for something like this if they can use/abuse it for a week before fb catching on (assuming the agency is unscrupulous).

Imagine... being able to post ads on anyone's timeline!

Now THAT is something you could make profit with!

Did anyone here donate to this guy? If so, can you explain why you did it?

I didn't, but I suppose many have facebook accounts and would prefer people like him keep giving information about exploits to facebook instead of selling the information to the highest bidder as a "zero day" or just leaving it unfixed so someone less scrupulous can find it and use/sell it for nefarious means.

It could also be people who like to see facebook and/or its figure head with egg on face, who want to encourage this fellow (and others) to mess with Zuckerberg's profile again for that entertainment value.

I also didn't, but some of the articles on the subject paint "the guy" as a down-on-his-luck hacker in developing country and ancient computer hardware trying to do the right thing. It's presented as almost a charity donation or a scholarship to someone in less than affluent circumstances.

Reply on news.ycombinator.com