Comment by dsacco | Hacker News Reader

Comment by dsacco | Hacker News Reader

Good work. I see a lot of people are surprised at the amount received for this report. Yes, that is typical of both Facebook and Google (and to a lesser extent, Yahoo will pay large sums for particularly bad bugs). They are extremely generous - Facebook recently paid $5000 for a bug report that existed in their careers portal despite that infrastructure being entirely third party.

If anyone wants to try and replicate this sort of thing, consider this: the mobile applications (touch.facebook.com, iOS/Android apps) that Facebook use very often take advantage of legacy api calls and code that the main web application has long since disposed of.

A well known researcher, Stephen Sclafani ('ssclafani) receiced a bounty of $25,000 for arbitrary account takeover using the legacy api.

Legacy code is generally the first place to look for vulnerabilities. Legacy apis which are still allowed to exist for backwards compatibility are prime areas to search for bug bounties.

Good luck.

Another good place is at edges of systems, particularly where they rub each other in fraught ways. What's the rule that says that computer systems invariably take on the architecture of the organizations that make them? You can predict Terrible Code Exists Here by getting a list of team names from the target (trivial -- use LinkedIn or ask anyone who works there) and then figuring out where those teams have shipped half-assed worked-on-my-machine glue code to tie their systems together.

A common example: any handoff between a marketing site (or email) and a SaaS app more complicated than "Clicking this unchanging link takes you to a login form" almost certainly involves two teams and was somebody's perceived least important thing to do that day.

The "rule" that you're thinking of is Conway's Law: http://en.wikipedia.org/wiki/Conway%27s_law

I think this post is a hoax. A lot of things don't add up. I thought there would be more interesting security posts and this is the only post on the entire site. The site was registered just 2 days ago, see http://www.whois.com/whois/7xter.com . Then if you search on Google for the email that registered the site (laksshmanan51@gmail.com) you get this http://apnahindisms.blogspot.mx/2014/09/bewafa-shayari-in-hi.... that has "You can earn huge using your Facebook page. Please let me know if you are interested. Shoot me a mail laksshmanan51@gmail.com"

If anyone wants to try and replicate this sort of thing, consider this: the mobile applications (touch.facebook.com, iOS/Android apps) that Facebook use very often take advantage of legacy api calls and code that the main web application has long since disposed of.

Agreed. Touch/m.facebook.com have had major holes exist for long after they have been plugged on the main site. It was iframeable long after the main site wasn't (and thus subject to clickjacking). Also, for a long time you could invite anyone to events by Facebook ID by posting the correct calls to the mobile site, essentially without limit, even after the issue was fixed on the main site. Since custom messages could be embedded in the invitations, it was a spam free-for-all.

Philippe Harewood (@phwd on Twitter) mantains a list of published Facebook bug bounty reports. It's a very good resource for anyone looking to learn about bug bounties and web app security in general: https://www.facebook.com/notes/phwd/facebook-bug-bounties/70...

Reply on news.ycombinator.com