Hacker News Reader

Comment by sillysaurus3 | Hacker News Reader

If $12,500 seems like a lot of money, remember that Facebook theoretically loses $22,453 for every minute their website is down. In other words, they generate $12,500 every 33 seconds.

Paying out that sum of money to increase the number of people searching for security flaws is quite smart.

View on HN

$ 12,500 is not a lot of money for this kind of work, if he is hired to find the same bugs he will earn much more.

While this is absolutely true, I know some people that like to do this type of stuff for "fun" and the bounty is just icing on the cake. It also won't hurt him in finding that kind of work in the future.

Yeah, I feel it's more about earning respect than making a living.

"I made $10k just for a quick hack"[1] has enormous bragging value - it's both a large enough payout for that, and it can actually be used without going to jail. Much better than actually bringing Facebook down.

[1] It doesn't matter how much work went into finding the exploit, one can still brag about doing it left-handed in 5 minutes.

I understand your sentiment here, but that's a difficult comparison. Friends of mine make more money hunting bug bounties each year than their (competitive) full time salaries as consultants or developers.

These sorts of things are publicly verifiable - Michal Zalewski has commented on it before as a member of the Google appsec team, and if you look on Twitter for writeups from the same folks you come to the same conclusion. I have in mind one particular friend who literally bankrupted a bug bounty in three hours.

Another security researcher by the name of Nicholas Gregoire earned $35,000 combined from Yahoo and Facebook for a single vulnerability in each company - both server-side request forgery. He found it in Yahoo's YQL console, then decided to look elsewhere for it in a very deterministic fashion, and came across it in Parse (Facebook). He found many more bugs in a period of a few months, but he explicitly didn't look as seriously as some people do, which entails actively tracking acquisitions by companies like Google and Facebook.

It can be something of a meat grinder, but finding bug bounties is extremely profitable work. Then of course, having this work on a rèsumè is an immediate step up for getting interviews.

I completely understand the personal motivation behind solving this bounties but when you talk about people earning a lot of money you are talking about outliers. It is profitable work for very few elite security researchers. Most of computer security people will never find a bug in Google Chrome.

...especially if he can put that he's gotten that big a payout from Facebook's bug bounty program on his résumé.

This isn't (generally) about the absolute dollar amount. It's a prestige thing, it's a pride thing, and it's an accomplishment thing. For the preponderance of people that participate in bug bounties, the money is probably very much secondary.

Yet there's no way to tell FB about problems without having an account (that I could find in 5 minutes). I found potential phishing attempts in the Windows Store, suggested apps right from the start menu. MS refuses to do anything about phishing/scams on their store, and FB offers no way to contact them (I tried a few email addresses like legal@, to no response).

Yeah there's no way that's enough money to submit to creating a FB account. [only half-joking... EDIT: three-quarters?]

You can (and preferably should) use a Whitehat Test Account to perform your research/make your report: https://www.facebook.com/whitehat/accounts/

apps.facebook.com (Facebook Windows Store) is not in the scope of this bug bounty program though.

I'm just trying to let FB know of a potential phishing attempt that's targeting all Windows users. I don't care about the bounty, in fact I only care a: to teach MS a lesson and b: to annoy the "developers" scamming people. I don't care enough to sign up for FB. Every other company I've dealt with on this, except some of the large media companies, have been easy enough to contact about the problem.

To be clear, the issue is: Windows users using the Windows search feature, or directly using the Windows Store, are presented with fake FB apps claiming to be official. Contacting MS support gets useless replies, as they are trying to pump their app counts. Meanwhile, normal users end up installing a potentially malicious app, claiming to be the official FB app. FB needs to send a takedown.

things might have changed over the past 12 months, but if you report an app from the store app in windows 8, the report gets looked at and they were good about removing apps that had issues.

I say this since I went through this process myself about a year ago and the app I reported was taken down. full disclosure: I worked on the app store team, but didn't use any internal mechanism.

I've been going through this recently quite a bit. Reporting stuff is a waste of time, except for entertainment purposes.

I've reported all sorts of things. In nearly every single case, they say they cannot do anything. Even when there's a fake DropBox app "by" "@Microsoft". In that case, the CSR told me to try re-installing the app, that it worked for him. Zero understanding of the issue.

I've found a fake Windows Update on the Store. Reporting it got a generic response, until I emailed the MS security folks. Then it was removed in a few minutes. Meanwhile, they suggest I "Leave a review" or email the developer. Idiotic.

Netflix went back and forth with MS at least 3 times. Amazon had issues as well. Other ISVs tell me they can simply not get MS to be responsive about things.

Disney was the funniest response. Despite being a major Store publisher, there's all sorts of fake Disney stuff online. When I spoke to the Disney Store about it, the final suggestion was "don't go on it [the Windows Store]". Neato.

It's obvious MS is just padding the app numbers and no review is actually happening. It's a shame, since it undermines all the work; the Windows Store is a joke even with casual users. (Like even meeting random people on a plane and asking.) I emailed Satya. I emailed the GM of the Store. I emailed the Dev evangelist pushing the "let's pay people in third world countries 4 months salary for publishing 20 shitty wrap-a-webpage apps" program. No replies.

Here's a gallery of some gems: http://imgur.com/a/xvqZg#0

But nothing beats this awesomeness: http://imgur.com/fLOWMI4

I really hope they enable an Android compat layer. Even if it's slow, A: tons of random utility apps will be available, B: MS can enforce some quality instead of quantity.

I find it hard to believe MS isn't aware of these issues, unless no one actually uses it (Win10 makes it more in-your-face, though). Someone must have a bonus that's tied to "published app count". Neither Apple nor Google have these issues. The Store is worse than the Android Marketplace was.

For the seriousness of this bug 12k doesn't seem like much to me. I don't know if I would turn it in for that little. With my personal dislike of facebook, the alternative is so very, very tempting..

That alternative being...

Ruining his aunt's birthday memories?

It would ultimately be the hapless users who suffer in some way.

Doubt you would do any real damage, I believe in the past it has been noted that deleting photos on Facebook won't remove the actual images from their servers. So it is likely possible that they could simply identify photos deleted in this way and restore them.

I'm guessing the alternative he's referring to is the black market.

However I'm not sure if the risk being caught is considered in this. If you can get let's say, X times more in the black market but also risk 10 or 20 or whatever years in jail as well, I'm not sure those 12.5k seem that bad.

Edit: Or maybe doing extortion on someone? but how much could you get by threatening to delete someone's photos? I'm guessing not much... no?

Short FB, delete everyone's photos, buy FB.

And then go to jail. Great plan there...

Only if you are caught _and_ they can prove you did it, which isn't likely to be easy if you launch the attack from a botnet.

And when you inevitably do get caught red handed, don't worry, because you'll have a Greek Chorus of Internet commenters making t-shirts advocating your release and writing Boing Boing articles about how you got screwed. Unless your offense involves credit cards, the celebrity might be worth the (very minimal) sentence you'll end up with.

It probably also gives somebody discovering the flaw a disincentive for exploiting it just for fun and then bragging about it since there will be no payout in that case.

> Facebook theoretically loses $22,453 for every minute their website is down.

Any reference for this?

It was mentioned on a Techcrunch article[1]. Annual earnings/Time.

[1] http://techcrunch.com/2014/09/03/why-is-facebook-down/

Reply on news.ycombinator.com