Security Researcher Makes His Point By Hacking Into Zuckerberg's Facebook Page

Eugriped3z writes "Whitehat Palestinian hacker Kahlil Shreateh submitted a bug report to Facebook's Whitehat bug reporting page not once, but twice. After it was ignored the first time and denied outright on the second occasion (which included links to an example as proof), he hacked Mark Zuckerberg's personal timeline, leaving both an explanation and an apology. From the article: 'In less than a minute, Shreateh's Facebook account was suspended and he was contacted by a Facebook security engineer requesting all the details of the exploit. 'Unfortunately your report to our Whitehat system did not have enough technical information for us to take action on it,' the engineer wrote in an email. 'We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue.' Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds. However, the company has refused to pay Shreateh for discovering the vulnerability because his actions violated Facebook's Terms of Service.'"

Comments

Take it public

[scubamage]

Screw them, the onus is on them to take action when someone reports a bug. If you don't have enough information when there is a security problem, maybe, JUST MAYBE, you should follow up with the submitter. If I was the submitter I'd just publish the exploit and be done with it.

Re:Take it public

[gl4ss]

They don't follow up on anything, I checked.

It might be because they're so swamped or maybe it's that if they feel like it's not their bug then they don't do anything. Either way not very responsive.

Re:Take it public

[SQLGuru]

I read the guy's own post about it. He reported what he could do and not the steps required to exploit it. The Facebook team couldn't reproduce it as a bug (since there were no repro steps) and closed it as "not a bug".

So really, the problem was one of communication. The guy has the problem a lot of my clients/users have in that they don't give enough detail to investigate the bug and Facebook didn't really follow what he was trying to say (since he just sent them links saying "look what I did"). I'm not saying he didn't legitimately find an exploit and probably deserves some bounty ($500 is nothing to a company like Facebook), but Facebook should probably have some guidelines for how to submit bugs.

Aside - what any bug report needs:
* What action were you taking?
* What result did you observe?
* What result did you expect?
* Are there specific data values that always exhibit the symptom?
* Are there specific data values that do not exhibit the symptom?
* Reproduction steps (be as detailed as possible)
* Any other useful details about the bug (error messages, screen shots, etc.)

Re:Take it public

[Anonymous Coward]

I'm a QA analyst, and the quote: "We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue." is totally incorrect. An issue does not have to be reproducable in order to warrant some debugging and investigation.

Re:Take it public

[Skapare]

If YOU could read the guy's post, then that would be the WRONG place for him to put the details about how to reproduce it. Facebook engineers should have contacted HIM, directly, by a secure means, to get those details. If Facebook engineers expect exploits to be posted in a public forum, then it is THEY who are doing this wrong.

Re:Take it public

[Anonymous Coward]

I'm a programmer and it really depends on the severity of the issue. Without steps to reproduce, finding the cause of an issue can sometimes be like finding a needle in a haystack. So, if it's not a big deal, it's not worth the effort.

Re:Take it public

[Anonymous Coward]

The guy posted his e-mail that he sent to facebook as "proof" that he tried to go about it the correct way. I think it was on his personal blog.

Basically all he did is say "I posted to someone's timeline, this is a bug" and linked to the post he made. He didn't explain anything.

The communication was secure between him and facebook.

Re:Take it public

[Opportunist]

The severity of a problem determines whether it pays to investigate. An odd crash once a week with no repeatable underlying condition and no data loss doesn't warrant a through investigation.

A severe security hole DOES! Almost invariably. Anything that allows an attacker to gain access in some way IS a reason for an investigation. The crucial point here is that undoing the damage is nearly impossible. With a crash, you can reenter the data and undo the damage. With a security breach, the data is out and there is NO way you can undo the damage, once data is out, it IS out.

Re:Take it public

[Opportunist]

'scuse me, but 500 bucks is peanuts for a 0day full-access security hole in FB. Tack a few 0s to that and we'll start talking.

Re:Take it public

[Anonymous Coward]

I'm a programmer too. You ALWAYS respond to issues, even if it's just, "Can't Reproduce: Not enough info in bug report."

Re:Take it public

[GNious]

This is why you change the Bug Status from "New" to "Need More Information", and NOT to "Closed" or "Get Lost, Ass".

Re:Take it public

[dgatwood]

No, not almost invariably. Invariably. You always follow up on security hole bug reports. Always. If you do not do this, you are incompetent. Assuming this security researcher gave them a reasonable amount of time (the summary here doesn't say), then this is once again a demonstration of Facebook talking "secure" but implementing the opposite, hyping their bounty program while refusing to pay out.

For that matter, you should always follow up on non-security bug reports unless they're obvious garbage (e.g. porn site spam submitted to your bug reporting page by a bot). But security bugs? There's no excuse for not following up on those. Ever. EVER.

Re:Take it public

[Rob the Bold]

I'm a QA analyst, and the quote: "We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue." is totally incorrect. An issue does not have to be reproducable in order to warrant some debugging and investigation.

Maybe they just don't have the technology to request additional info from the reporter. Maybe that's not part of the protocol there. If it were my job to handle bug reports and I didn't want to be hassled with work, I'd require a complete bug description, including exact description of systems used and all steps to reproduce reported in exactly the format I'm expecting. I'd also make sure my instructions and description of the report format were just a little vague, so the user would be forced to fill in the blanks, further reducing the odds that the report would be "valid". Maybe I'd require some info that most bug reporters would think irrelevant or inapplicable to most bugs -- you know, just to tempt them to skip that part. Then I could pretty much close every ticket with "can't reproduce" and screw around on facebook all day -- for quality assurance purposes, of course.

Re:Take it public

[Gibgezr]

Yes, but maybe they did that, and still couldn't reproduce it
All he did was say "I can post to anyone's timeline", which is so vague as to be useless information. It gives them no hint as to what is broken, as the Timelines are probably integrated into huge swathes of the FB codebase. It truly was a needle in a haystack, and thus totally unverifiable. He needed to send the repro info.

Re:Take it public

[Anonymous Coward]

your suggestion is standard procedure and would be fine and fully justified. His procedure broke the law and he's bloody lucky if he doesn't end up arrested so in this case would say it's facebook which is showing some class.

 

Yes; the law is stupid. Publishing a fully working exploit will probably do more harm than using it. That however is the way it is written. The people who can fix that are the big corporations who paid for the computer laws. If Facebook came out and guaranteed they wouldn't prosecute such cases then they would deserve this type of warning. Until they do, anyone who gives it to them is being stupid.

oh and next time maybe the guy should take more care over anonymity.

Re:Take it public

[IndustrialComplex]

No, not almost invariably. Invariably.

I think he was referring to the fact that you do investigate something like, "Type 'fhee' in this field, send 3 page requests, and do XYZ, and you can access the timeline of an account".

But if the bug report was "Hey, I found this really severe security flaw, you think it's patched, but I've seen everything"

One is taken a bit more seriously than the other. Without the actual bug report, I can't say either way, but it could be a serious waste of time to investigate if you don't believe the submission.

Re:Take it public

[DavidD_CA]

I believe the person is referring to the hacker's own personal blog/story, not the post that the hacker made to Facebook -- which I presume is private.

Re:Take it public

[Anonymous Coward]

Agreed. The fact that FaceBook suspended his account should be sufficient reason not to help them at this point. After all if the claim he submitted two separate reports for this security fault and they essentially denied its existence, FaceBook should stop acting like a tin-pot dictator.

Re:Take it public

[X0563511]

Hell you should at least respond to the reporter! "Can you provide more detail?" and then waiting for said detail is infinity better than ignoring or rejecting it.

Re:Take it public

[X0563511]

Not to say you're wrong, but would it really have been so hard for them to reply asking for details? Simply closing it without even a response is not appropriate, even if it is a useless report.

As someone else said, if it was publicly viewable it was not an appropriate place to put the details. Perhaps he should have offered them (I have reproducibility details, please contact me) but really, the onus for that was on them and not him.

Re:Take it public

[jovius]

Incidentally I was just reading about the issue... Market research numbers from last year.

$5000 - $30,000 Adobe Reader
$20,000 - $50,000 Mac OSX
$30,000 - $60,000 Android
$40,000 - $100,000 Flash or Java Browser Plug-Ins
$50,000 - $100,000 Microsoft Word
$60,000 - $120,000 Windows
$60,000 - $150,000 Firefox or Safari
$80,000 - $200,000 Chrome or IE
$100,000 - $250,000 iOS

Re:Take it public

[Anonymous Coward]

If I were your supervisor and I heard you say...

If it were my job to handle bug reports and I didn't want to be hassled with work...

...I assure you, it would no longer be your job.

Re:Take it public

[Anonymous Coward]

Exactly. I once reported a bug which caused corruption of Linux configuration files. A simple change through an approved interface would eventually cause the keyboard to stop working because a configuration file was corrupted, making even rebooting a problem. I even got my company IT department involved to figure out what was going on. (The discovered the corrupted configuration file.) To recover it seemed the only path for me was to reinstall the OS. I'm not a Linux developer at all, just a victim of the bug, but I wanted to be helpful. I spent about 10 hours over several days attempting to reproduce the bug and eventually got it down to a series of steps with a 70% likelihood of causing the problem. I decided to report it through proper channels ... do A, B, and C and notice that this file is corrupted at this location. I figured I'd given someone enough information for a knowledgeable person to act on and was kind of proud of myself for going out of my way to help instead of just ranting about the horrible state of Linux.

The result was a message from the development team asking me to take the bug and work on a fix. When I responded that I wasn't in any position to do that I got a nasty "won't fix" status on the bug an a sarcastic remark that "that's the way the community works. If you want a bug fixed then you have to be willing to work on it yourself."

l figured the time I had put in to reproduce the problem and report it was my contribution. I don't know if it ever got fixed. I don't care. /rant

TL:DR When someone reports a bug and gives even the slightest details of how to reproduce it or indicates the consequences of the bug are serious, don't just slap him in the face and tell him to get lost. If you need more information then ask for it.

Re:Take it public

[freezin fat guy]

They don't follow up on anything, I checked.

Nobody enjoys following up on things in which they have absolutely no interest.

Facebook have proven exceedingly reliable at not caring about their user's security or privacy.

Having living proof of a hack is especially annoying because it actually forces them to respond and improve user security. Fankly, I'm surprised they are pressing charges.

Re:Take it public

[tlhIngan]

No, not almost invariably. Invariably. You always follow up on security hole bug reports. Always. If you do not do this, you are incompetent. Assuming this security researcher gave them a reasonable amount of time (the summary here doesn't say), then this is once again a demonstration of Facebook talking "secure" but implementing the opposite, hyping their bounty program while refusing to pay out.

For that matter, you should always follow up on non-security bug reports unless they're obvious garbage (e.g. porn site spam submitted to your bug reporting page by a bot). But security bugs? There's no excuse for not following up on those. Ever. EVER.

Except that most are bogus. Yes, bogus.

Imagine you're Facebook and you're getting piles of "I can post on someone else's timeline!" Well, you can be 99.999% of those cases are probably one of user error - as in, the user reporting it could do it because the permissions said so.

Likewise, Microsoft probably receives a bunch of equally annoying reports of "If I do X, I could do Y and HAXXOR!". Except X requires admin priviledges, in which case you're doing Y as admin and yes, that's expected behavior when you're admin. In fact, instead of doing Y, if you can do X, just do HAXXOR and you're done and save yourself the effort. (A surprisingly large number of reports involve either getting admin as a prerequisite or having it already).

And unfortunately, when you get thousands of such reports an hour by "security researchers", you need something to do first round culling of the bogus from the possibly requiring investigation.

Re:Take it public

[freezin fat guy]

Oops, should read "I'm surprised they AREN'T pressing charges"

Few things must infuriate Zuckerburg and cohorts more than addressing the security or privacy of their users.

Re:Take it public

[fzammett]

Exactly, and I'm surprised people are arguing anything but this. Even for a report that you completely believe to be bogus, what time does it take to reply "hey, can I get more info?" Best case, it WAS bogus, and you never hear from the person again. You "wasted" all of 30 seconds. For a company like Facebook, that should be a trivial investment when the downside of an ACTUAL security problem is so bad. Assuming the report that they didn't reply in any way is accurate, then THIS is where Facebook fell down worst, and it's what is inexcusable.

Re:Take it public

[thaylin]

So you would fire someone because they were hypothesizing that someone may not want to do work, and that if they did not want to do work they would be vague about setting up the documentation?

He did not claim he did not want to do the work....

Re:Take it public

[dgatwood]

Basically all he did is say "I posted to someone's timeline, this is a bug" and linked to the post he made. He didn't explain anything.

Bzzt. If Facebook's logging weren't broken, that should be all they need. The existence of the post itself, having been posted to a wall where he should not have been allowed to post, should have been enough to determine trivially that the bug was real. Further, the post's database record should contain the posting IP address and the ID of the server that handled the request. From there, they should have been able to look at the server's request logs to determine precisely how the attack happened (assuming the researcher was using a structurally valid URL in the request, as opposed to exploiting a null character handling bug in the web server itself).

But even if they looked at the logs and couldn't figure out what happened, IMO, it is still completely unacceptable to just close a bug like this. It's one of those bugs that, if real, is borderline catastrophic in scope. You do not close a bug like that as "cannot reproduce". You contact the originator and say, "Hey, can we get more information about this? We need to try to reproduce the problem."

It's sad that it takes somebody posting on the CEO's Facebook page to get the attention of Facebook's security staff. This means one of two things: they are grossly mismanaged or are woefully understaffed—probably the latter, IMO. Either way, it tells me that Facebook does not take security seriously enough. If bug screeners do not have time to properly follow up on bugs that are this severe, then they need to double or even triple the number of screeners.

Also, this brings into serious question the way that Facebook screens bugs in the first place. Where I work, a bug like this would have been tagged as a security bug the moment it came in. This causes additional people to review the bug, significantly reducing the likelihood of a serious mistake. Closing the bug without asking for more information strongly suggests that a single, hopelessly overworked individual made a mistake, and that the company as a whole failed to have proper processes in place to ensure additional review that would otherwise have caught that mistake quickly and followed up with the original reporter. Not good. Not good at all.

And as long as I'm criticizing Facebook's security practices, IMO, a service like this should have several publicly visible, official security testing accounts for precisely this purpose, with various restrictions on various posts, etc. so that security researchers can properly hammer on their site's security. For example, there should be an official test account that looks an awful lot like Mark Zuckerberg's account. If a researcher is able to post on the wall of that account, there can be no doubt whatsoever about the fact that a bug exists. Likewise, there should be more complex accounts with various security settings, complete with a list of that content and the expected behavior (e.g. you should not be able to read the barcode image entitled "nude_selfie_for_my_boyfriend.jpg").

In short, I suspect there's plenty of blame to go around for this error. What matters is not who gets blamed, but rather how Facebook fixes their processes to ensure that such mistakes do not get made in the future. And I would emphasize that this does not involve firing anyone. People make mistakes. That's why processes are supposed to be designed to mitigate those mistakes. A company like Facebook is big enough that they should know this. If they don't, then perhaps this object lesson will get their attention and cause them to change their ways. If not, it's time to run, not walk, to a competing service.

Either way, what the researcher did was IMO wholly appropriate. He initially performed the smallest attack that could potentially have proven that there was a flaw. When the first report was casually dismissed, he then escalated that attack,

Re:Take it public

[Anonymous Coward]

Facebook engineers should have contacted HIM, directly, by a secure means, to get those details.

No.
They simply do not have the time or manpower to respond to every last report of "I can haxxor" or "I was haxxored and they keep doing it".

If YOU could read the guy's post

The parent said he read the guy's BLOG POST. +5 Insightful, ya right.

If you want to know how to submit a report, go to https://www.facebook.com/whitehat and click on SUBMIT REPORT. It's not a fucking public forum.

Also, pay attention to the section which states that you are supposed to use a TEST ACCOUNT to reproduce the problem, not hack the Big Z's timeline. Maybe if this guy had taken the time to FOLLOW THE PROCESS he'd have got results. As it was, he didn't.

Re:Take it public

[Minwee]

Maybe they just don't have the technology to request additional info from the reporter.

That makes sense. After all, why would you expect a company like Facebook to have any way of communicating with their own users?

Re:Take it public

[dgatwood]

Imagine you're Facebook and you're getting piles of "I can post on someone else's timeline!" Well, you can be 99.999% of those cases are probably one of user error - as in, the user reporting it could do it because the permissions said so.

Even if you're right, and 99% are bogus, there's no excuse for having a process where you choose "Not a bug" instead of "Need more information" with a request for steps to reproduce. That should be drilled into employees as the only valid response until they are relatively certain that the problem was user error. This culling was premature; you must assume that the bug *might* need investigation until it is clear that it does not. Anything less is negligence.

But the bigger problem is that there's no good way for Facebook to be certain that it wasn't user error unless the account is known (by Facebook) to have settings that should have prevented posting. That's what makes the CEO's page an obvious choice. IMO, there's also no excuse for a company the size of Facebook to not provide an account that is preconfigured to not allow posts so that if a researcher successfully posts on it, the subsequent security bug report has automatic credibility (and, hopefully, additional logging by Facebook's servers, immediate reaction from their security response team, etc.). Perhaps call the test account Zark Muckerberg.

Re:Take it public

[Frobnicator]

Assuming the report that they didn't reply in any way is accurate, then THIS is where Facebook fell down worst, and it's what is inexcusable.

Seems like Facebook employees forgot the reason they pay for the bounty program in the first place. It is to provide an incentive to report it to the company rather than reporting it to the black market for exploits.

A few seconds on Google will show the going rates of black market zero-day exploits for various services. Facebook was offering $500, but now won't pay. Black market rates he can still get about $40,000. (Note that $500USD is a year's salary in most of Pakistan.)

If he doesn't have the ethics, or if he really wants the money and thinks being in Pakistan makes him outside Facebook's reach, he can still get about 80 years' salary ($40,000) on the black market.

Re:Take it public

[Anonymous Coward]

It's not easy when it's anonymous and the bug report is "Now I can haxxorz da fazeb00k!!!!11!!!"

Re:Take it public

[ShanghaiBill]

So, if it's not a big deal, it's not worth the effort.

If there is not enough info to reproduce the bug, then they should email the submitter and ask for more info. They should never just ignore the report.

Relevant xkcd

Re:Take it public

[Anonymous Coward]

So when you say "depends on the severity of the issue", do you consider a flaw that allows a user to post to an account of any user to be a severe flaw? I do. I'd rather other people didn't post as me. Facebook dropped the ball plain and simple.

Re:Take it public

[Krojack]

I'm a programmer and it really depends on the severity of the issue. Without steps to reproduce, finding the cause of an issue can sometimes be like finding a needle in a haystack. So, if it's not a big deal, it's not worth the effort.

Oh hell yeah. So true.

I had a client keep reporting about a problem with their web page. I along with no one in the office could reproduce it. Seeing as the client was in town, I went to their office and was able to reproduce the problem. Turns out it was an extension they had installed. I told them to disable all extensions beforehand and they said they did. Lets say they ended up paying a hefty service fee. They tried to dispute it but failed.

Re:Take it public

[the_B0fh]

This is one of those posts that need a +6.

Re:Take it public

[jones_supa]

If I were your supervisor and I heard you say...

If it were my job to handle bug reports and I didn't want to be hassled with work...

...I assure you, it would no longer be your job.

Read his post fully. He was exactly describing how someone would handle bug reports badly.

Re:Take it public

[liamevo]

Pakistan != Palestine

Re:Take it public

[dgatwood]

This bug wasn't a case of pretending to be somebody else, I don't think, but rather, a case of being able to post on a timeline where posting should not have been allowed—a permissions bug. But still, yes, they dropped the ball... into the Grand Canyon.

Re:Take it public

[Anonymous Coward]

It's not just Facebook. Have you tried contacting Netflix or Google? It's nearly impossible, and they never respond. Even Twitter went downhill quickly in the user-responsiveness category. It's pretty amazing how unresponsive most major internet-based companies are; the only good ones I can think of are retailers or ISPs.

Re:Take it public

[dgatwood]

They simply do not have the time or manpower to respond to every last report of "I can haxxor" or "I was haxxored and they keep doing it".

The latter is almost invariably a problem with the user's computer, and even if it isn't, there's no possibility that the user has enough information to be helpful. However, Facebook should have the ability to flag what appears to be your own post when reporting a problem, and Facebook should at least take the time to determine whether the post occurred through password compromise, from a third-party FB app, or appears to have been actually posted by that user from a computer that had a valid cookie. Then, the system should send an automated message to the user indicating how he/she can protect him/herself from that attack in the future. This process could be entirely automated, giving the user the ability to follow up only in the case of a third-party FB app having made the post (which is likely a real security bug, or at best, an app developer violating the developer TOS).

Also, pay attention to the section which states that you are supposed to use a TEST ACCOUNT to reproduce the problem, not hack the Big Z's timeline.

Which he did, and they dismissed his bug report, so he took the only step that he thought could prove, in FB's eyes, that the flaw was legitimate.

What I find particularly interesting is how many ACs are defending Facebook in this. It almost makes me wonder if there's an astroturfing campaign going on, either officially or unofficially, by employees of either FB or a third-party firm hired to defend them. Just saying.

Re:Take it public

[Existential Wombat]

Either way, what the researcher did was IMO wholly appropriate.

Yes but he's probably going to jail for it.

Re:Take it public

[HiThere]

Sorry, but that's wrong. You are ignoring scalability.

OTOH, they should have responded by setting up an account with good logging, etc., and asked him to demonstrate by posting to it's timeline. And THAT should give them enough information.

As a second thought, that account should be a template that they can easily and quickly run up "as needed". Because I'm sure they get many such reports, and they probably always respond to them in the same way.

Re:Take it public

[HiThere]

You wonder? I was taking it for granted that Facebook was trying to suppress the story with an astroturfing campaign.

P.S.: While that action is thoroughly immoral, many companies do the same thing. Which is why when I saw the "anonymous coward" posts popping up, I just presumed an astroturfing campaing to suppress the report (or, in this case, defend their [in]actions).

Re:Take it public

[Anonymous Coward]

Facebook is being cheap. Pay the man and be thankful!

Re:Take it public

[skine]

To be fair, the summary does say that $500 is the minimum.

According to the Forbes article posted by jovius, Facebook's average payout is a few thousand.

Re:Take it public

[Anonymous Coward]

This is why you change the Bug Status from "New" to "Need More Information", and NOT to "Closed" or "Get Lost, Ass".

Well I can tell you've never worked at Red Hat.

Re:Take it public

[Muros]

Pakistan != Palestine

Palestine GDP per capita (From the always correct and unfailingly infallible wikipedia, but I'll use it anyway)

$1924 (West Bank)
$876 (Gaza)

We're not talking orders of magnitude in difference.

Re:Take it public

[Stan92057]

Yes it does, now if everyone went by your logic Cough everyone and there cousins will submit junk just to waste FB time. Dont you people think even a little?

Re:Take it public

[Stan92057]

Ya blame FB for people not reading the rules. Hes smart enough to figure out a flaw but stupid enough not to read the submitting rules ya......

Re:Take it public

[Opportunist]

Yes, any crash should be examined. Sadly, this isn't a perfect world and I have finite resources. I cannot send my security people on a wild goose chase whenever something crashes somewhere. Else I'd probably burn through a year's budget within a few weeks.

A decade ago I would have agreed with you. The perspective changes a lot when your problem changes from getting a perfect solution to getting an affordable one.

The sad reality of the corporate world. You simply start taking risks because covering them becomes too expensive.

Re:Take it public

[dgatwood]

Sorry, but that's wrong. You are ignoring scalability.

In what way?

Re:Take it public

[Dreamportal]

Saying that Facebook is just stating the obvious. They hire kids straight out of college, and expect quality software from them. These guys don't know how to implement anything remotely securely, and when someone calls them out, they ban them. Typical reactionary BS, if you ask me. They wouldn't last a day in the environment I work in (a.k.a. the real world). And yes, he should just make it public. What can they do that they haven't already done?

Re:Take it public

[SeaFox]

It's not just Facebook. Have you tried contacting Netflix or Google? It's nearly impossible, and they never respond. Even Twitter went downhill quickly in the user-responsiveness category. It's pretty amazing how unresponsive most major internet-based companies are; the only good ones I can think of are retailers or ISPs.

So the businesses where people are paying the company for a product or service?
I wonder if there's a correlation here...

Re:Take it public

[Anonymous Coward]

How about, I got one:

They don't give a shit.

There, I said it. These guys are so busy with the real operation of data-mining that they honestly don't give a shit if some whiz-kid can hack and post on someone's wall. What's the worst that'll happen? Facebook folks rarely are bothered by problems, witch is probably why they use facebook in the first place. If I were the facebook guys, I'd not care either. I mean they have a large user base, and that was the point from the beginning. So to tell them that the thing isn't functioning as it should, they're thinking to themselves, "Oh, yes it is..." It's the same thing that a doctor would do if you told him that you didn't like the scar that he left you with. He'll tell you, "Well, you're alive though, right?" Facebook folks will say, "Well, you can still convince yourself that you have a social structure in your life, right?"

Re:Take it public

[lgw]

Facebook has pretty good analytics. They should certainly be able to review the logs associated with the post and check the submitters claims. After all - they put hadoop and such on the map.

Re:Take it public

[rHBa]

Would it be white, grey or black hat hacking to gain access to the bug reporting system and escalated the bug report so that someone actually actioned it?

After all, if you can get Zuckerberg access to Facebook you could probably fix a few things for them...

Re:Take it public

[ScoLgo]

About eight months ago, I contacted netflix when someone 'stole' my credit card info and opened a new account with them. Did the online chat thing and their rep had it all fixed (at the netflix end of things at least) within 15 minutes. It was painless and easy.

No, I don't work for netflix and am not affiliated in any way. There are certainly things about them that I don't like but I can't complain about their customer service.

Re:Take it public

[Anonymous Coward]

I didn't realize Netflix was free.

Re:Take it public

[georgewad]

Do you work for Dell?

Re:Take it public

[Myopic]

By secure means? Maybe they could message him on Facebook or something.

Re:Take it public

[Kalriath]

Giving Google money doesn't make their customer support any faster. Trust me on that.

Re:Take it public

[Anonymous Coward]

I pay for Netflix, genius.

Re:Take it public

[Anonymous Coward]

>When I responded that I wasn't in any position to do that I got a nasty "won't fix" status on the bug an a sarcastic remark that "that's the way the community works. If you want a bug fixed then you have to be willing to work on it yourself."

And that, children, is why Apple and Microsoft will be in business forever.

Re:Take it public

[dbIII]

Either way I doubt even Facebook could touch somebody there in court.

Re:Take it public

[mikeiver1]

If they say they pay $500.00 for a bug and then refuse to acknowledge and pay you for a righteous bug you would just walk away? I think not. Fuck Facebook. They got what they deserve and if they refused to pay me and also locked my account to boot I would make security exploits of their system a side job and put each one in the wild without reporting it to them so as to cause as much damage and trouble to them. I don't have a facebook account. Never have and never will since I think the whole FB thing is for assholes. That and if they are giving you something for free than it isn't free and you are the product. Boycott facebook!

Re:Take it public

[Anonymous Coward]

(Note that $500USD is a year's salary in most of Pakistan.)

1) He is not from Pakistan
2) The salary for a person with his background would be around $600 a month not a year (sometimes more)

Re:Take it public

[Anonymous Coward]

Palestine, not Pakistan. No, they're not the same, whatever you may think.

Re:Take it public

[Anonymous Coward]

Do I have to report this for taxes?

Re:Take it public

[HiThere]

Yeah, but if they did detailed logging of every access they wouldn't be able to do that. Scalability. You can store detailed logging of selected events easily. And detailed means you log things like the number of milliseconds between different messages. That's not usually important, but sometimes it is. But you can't do that kind of thing on a large scale.

OTOH, I read later that they *do* have test pages. So perhaps they should have just sent him to one of them, and had him show them. I *trust* that they have *those* pages set to do detailed logging.

Re:Take it public

[scubamage]

I think that's pretty solidly grey hat. You're technically breaking the law by accessing a system you're not supposed to and without authorization, but you're doing it entirely for benevolent reasons directly benefitting the party whose security you're compromising.

Re:Take it public

[mysidia]

I'm a programmer too. You ALWAYS respond to issues, even if it's just, "Can't Reproduce: Not enough info in bug report."

Status: Open -> Closed: Wontfix
Resolution: -> Invalid
Notes: Can post on random other users' timelines, contrary to privacy settings -- not a bug, it's a feature.

Re:Take it public

[mysidia]

that "that's the way the community works. If you want a bug fixed then you have to be willing to work on it yourself."

Any developer who is worth their salt, would tell you that's bullshit.

Software defects are not only the concern of the person who encounters them. The project is doomed to failure if the developers won't take responsibility for their work and going the extra mile to ensure its quality.

In a professional setting, the developer who responded to a user, IT admin's bug report or another programmer's bug report like that would be fired.

Re:Take it public

[vidnet]

If you'd read TFA, you'd have seen the bug reports.

The first was a proof of concept that just didn't work.

The second was one was an explanation that was very difficult to understand, and was interpretted as a feature working as intended.

The reason why they won't pay now is obviously that they don't want all future exploit reports to come in the form of posts on Zuckerberg's timeline. People would love to do that with impunity, and it would not look good for Facebook.

Re:Take it public

[mysidia]

Maybe they just don't have the technology to request additional info from the reporter. Maybe that's not part of the protocol there. If it were my job to handle bug reports and I didn't want to be hassled with work, I'd require a complete bug description, including exact description of systems used and all steps to reproduce reported in exactly the format I'm expecting.

This is why good companies implement some form of separation of duties when deciding how employees will execute their job.

The person who specifies the conditions under which a bug report can be rejected, should not be the same as the person responsible for handling the reports, OR at least someone else with the project's interests and customer's interests at heart above and beyond the developers' desire to be as "efficient", "lazy", or have as little work as possible --- should be involved in the process of setting the rules and approving them, and on occassion -- reviewing the performance and compliance of the bug handlers.

Re:Take it public

[mysidia]

'scuse me, but 500 bucks is peanuts for a 0day full-access security hole in FB. Tack a few 0s to that and we'll start talking.

Posting a message to someone else's timeline isn't exactly a 0day full-access hole.

It's more like a potentially spam/malicious link-facilitating bug.

Re:Take it public

[dgatwood]

Until a few hundred celebs' walls get spammed and they declare en masse that they're all moving to Google+, followed shortly thereafter by a fan exodus. Facebook might not take security seriously enough at times, but even they aren't clueless enough to think that they can ignore it entirely.

Re:Take it public

[Anonymous Coward]

he is not from Pakistan he is Palestinian

Re:Take it public

[Anonymous Coward]

Pakistan?

Re:Take it public

[Anonymous Coward]

I think it was much more white hat in this capacity. They didn't take him seriously, he's obviously ESL challenged and adamantly reporting a bug. He wants them to fix it. Isn't there a single Arabic speaker employed by facebook?

His options when he posted to Zuck's wall:

-Use it to harass friends and enemies alike
-Sell it on the market
-Post it to FD and watch EVERYONE exploit it
-Pretend like he never knew and forget about it
-Prove it maliciously to them (click this embedded URL, I dare you)
-Prove it non-maliciously and apologetically

He chose the last and basically begged for further contact. This goes back to the pre-Full-Disclosure mailing list full-disclosure debates on Bugtraq. The debates got pretty heated before the fork of lists, with Elias/Aleph1 and David advocating responsible disclosure and many people pissed about the RD reccomendation of Bugtraq. This issue was the heart of the deabate. WTF do researchers do when the vendor ignores your report?

Re: Take it public

[Anonymous Coward]

we use a product we pay $2000 a year for support. I found a bug last year that was pretty serious - gave them a proper writeup, how to reproduce, how to work around it... and got a reply from them that their software was clearly perfect and we 'must be doing something stupid'. And 'use the forum' (no, dumbass, we have a support contract and by the way your forum has been offline for months). We only just found a showstopper with no workaround in their latest version.. I see no point in reporting it.. my time is better spent migrating to another product (If I had my way we'd have done that already but management said no. Now we do that or don't release).

OTOH I've never had anything other than courteous responses from OSS projects.. so it's not being paid that makes good support.. A shit developer is a shit developer no matter how much they're on.

Re:Take it public

[lgw]

But you can't do that kind of thing on a large scale.

Why, to do that you'd have to dedicate tens of thousands of machines just to log collection and analysis, invent a whole new approach to databases that scales out that much, and a whole ecosystem of applications around it! Yeah, Facebook did all that, long ago. Remember what their real product is: the analytics are more important than the site itself.

Re:Take it public

[minstrelmike]

If I were your supervisor and I heard you say...

If it were my job to handle bug reports and I didn't want to be hassled with work...

...I assure you, it would no longer be your job.

That depends on _your_ supervisor dud, I mean dude.
What if he told you any $500 bounty payout came out of your department's budget?
I am curious to know whether it is due to laziness or greed and at what level in the organization the laziness/greed occurs.

Re:Take it public

[minstrelmike]

You wonder? I was taking it for granted that Facebook was trying to suppress the story with an astroturfing campaign.

Ditto. Wish I had mod points.

Re:Take it public

[minstrelmike]

Facebook is being cheap. Pay the man and be thankful!

or hire him.

Re:Take it public

[ThomasMcA]

If you put that much effort into doing your job instead of avoiding it, you might actually become a decent QA analyst.

Re:Take it public

[Anonymous Coward]

Palestine not Pakistan

Re:Take it public

[Anonymous Coward]

I agree. Fuck Facebook and that thieving whiner suckerberg. stay off their site and kill their business! they are scum

Re:Take it public

[bdwebb]

Maybe they just don't have the technology to request additional info from the reporter.

The largest social media site on teh internets does not have the technology to request additional information? I'm assuming here (and I don't think this is too much of an assumption) that they are using a pre-existing reporting or ticketing platform and every single software suite released to perform this function since the early 90s has had this type of functionality. Even if they rolled their own and used inspiration from other platforms, there is no way this feature would have been left out.

Taking this even FURTHER...oh wait...we're talking about incompetence on the technical staff at Facebook, right? Totally plausible.

Re:Take it public

[bdwebb]

High five for reason. Where are my mod points when I need them?

Re:Take it public

[tom arnall]

sounds like they don't want to keep their word on the bounty. FB smells of suits, increasingly and at an accelerating rate.

Re:Take it public

[Anonymous Coward]

He's probably a real supervisor, which would explain how much of an idiot he appears to be.

Re:Take it public

[Anonymous Coward]

Yeah there are probably zillions of logs that are just summarized. Maybe get him to log onto a test shard with extra logging and post there.

Won't pay?

[schneidafunk]

Seems to me that Mark is just pissed at being embarrassed, there really is no justification for not paying him. He submitted the bug to their security team first before exploiting it in a harmless way.

Re:Won't pay?

[vswee]

Agreed. Also, hackers are not really the people you'd want to shortchange. They're a vengeful bunch I've heard.

Re:Won't pay?

[Nerdfest]

Perhaps they should pay him extra and thank him ... he could have done much, much, worse, and from a dummy account. He quite obviously wanted to help. Being a dick to people trying to help you is not a great way to encourage others.

Re:Won't pay?

[schneidafunk]

Exactly. You raise a good point, he used his personal account, which ended up getting suspended.

Re:Won't pay?

[afidel]

Ding! Next time maybe he sells it on the black market instead of trying repeatedly to inform a company that obviously doesn't give a crap about security.

Re:Won't pay?

[Anonymous Coward]

Lumping people together loosely by profession and then giving them generalized personality traits, are we? How ignorant.

Re:Won't pay?

[gnasher719]

Perhaps they should pay him extra and thank him ... he could have done much, much, worse, and from a dummy account. He quite obviously wanted to help. Being a dick to people trying to help you is not a great way to encourage others.

Hacking into someone's account is a criminal offence. So you are saying they should pay him and think him, because he committed a worse offence than he did?

Re:Won't pay?

[IronOxen]

Actually, he also exposed a bug in the bug reporting system that prevents it from responding to and or acknowledging the exact type of vulnerabilities it was designed to find. It was obviously repeatable since the vulnerability was reported twice and was ignored both times. He should be paid for that one as well.

Re:Won't pay?

[Anonymous Coward]

And they should pay him more than $500 for being assholes.

Re:Won't pay?

[poetmatt]

this is facebook. they're not in the business of security or privacy. what do you expect?

Re:Won't pay?

[Nemesisghost]

So you are saying they should pay him and thank him, because he committed a worse offence than he did?

Yes. He tried to use their own method for reporting such problems. If he had just hacked it outright before telling them, then that'd be a different story. But when a company fails to use the information provided to them from their own communication channels, especially when it seems that they did so to screw someone out of a reward, then they deserve what they go & should still pay up.

Re:Won't pay?

[Anonymous Coward]

Hacking into someone's account is a criminal offence.

In that case, as Facebook are offing a bounty on security flaws, they are encouraging people to break the law.

Re:Won't pay?

[Chris Mattern]

No they aren't, because *finding* a security flaw is not the same thing as illegally *exploiting* a security flaw. If you need a proof of concept, you can hack your own account.

Re:Won't pay?

[Anonymous Coward]

Does having the CIA get them arrested by Pakistani authorities for wire tapping count as "extra pay"? Just curious, because you know that will happen next.

Re:Won't pay?

[Anonymous Coward]

LOL. You're new to the world, aren't you.

Ignorant, he may be. Truthful, he may also be.

You figure out how it can be both.

Re:Won't pay?

[CanHasDIY]

Ding! Next time maybe he sells it on the black market instead of trying repeatedly to inform a company that obviously doesn't give a crap about security.

Exactly - fuck me once, shame on you, fuck me twice...

Re:Won't pay?

[Redmancometh]

Okay better put: when hackers seek vengeance they have the means to wreak havoc. An a huge number of them revel in the opportunity.

Re:Won't pay?

[ArhcAngel]

Hacking into someone's account is a criminal offence.

It was not hacking since Facebook said themselves it was not a bug. Therefore it must be a feature and taking advantage of a feature is not hacking. Now if someone were to take advantage of that feature on my account I would sue Facebook for providing said feature and point to their own forum as evidence.

Re:Won't pay?

[CanHasDIY]

No they aren't, because *finding* a security flaw is not the same thing as illegally *exploiting* a security flaw. If you need a proof of concept, you can hack your own account.

Which is still illegal (because even though it's "your account," you still have to run the exploit on someone else's network), and still a violation of the ToS.

Re:Won't pay?

[Mike]

Hacking into someone's account is a criminal offence.

Well, therein lies [a] problem. Any such law is completely bogus in the first place.

Re:Won't pay?

[Nidi62]

How is a Palestinian going to get arrested by Pakistani authorities?

Re:Won't pay?

[Opportunist]

Vengeful? Oh please. But next time he might sell it to someone else.

There's no shortage of parties interested in 0day exploits for FB...

Re:Won't pay?

[Opportunist]

*gasp*

That they are interested in protecting their assets! Imagine someone could come and siphon away all the info without paying them!

Re:Won't pay?

[LordLimecat]

We're saying that not paying him has made it so that hackers will simply not bother next time, and will instead sell the exploit on the black market.

Re:Won't pay?

[parkinglot777]

Well, you should not overlook that there may be other factors involved in these parties...

The bug reporter
1)Did he describe how to reproduce the bug step-by-step?
2)Did he describe the set up to reproduce the bug in detail?
3)How understandable was his email to native English speakers?

The FB team
1)How many similar bug reports do they get each day?
2)What the procedure do they use in bug investigation?
3)How much concern they have to each bug report?

1st email:
the bug allow facebook users to share links to other facebook users , i tested it on sarah.goodin wall and i got success post
http:

2nd email:
of course you may cant see the link because sarah's timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority .
this is a picture shows that post :

Now, your reply assumes that the bug reporter clearly explains how to reproduce the bug. What I see from his blog post that the first email is only the "result image" of what he did which cannot be a proof! Why? You should be able to answer that if you know any photo editor software. The second email is not much better than the first. It added a little more preparation to reproduce the bug, but it is still too vague. This is a type of "bug report" from an end user who does NOT understand what "step-by-step" is.

Being said that, you also assume that the FB team has nothing to do at all. There is always a reason for whatever one does; however, the reason may or may not be acceptable to the general public. At least, you need to put yourself into other's shoes in order to understand it better. The work load of validating bug reports could be a lot more than you think. When monetary system is involved, there are always some people who attempt to exploit the system. In this case, I guarantee that there are plenty of fake bug reports sending to their team. When you have seen a lot of fake bug reports and you need to invalidate them, you would likely be sceptical toward any bug report at first. If there is no step-by-step procedure in place, you may apply the simplest way to deal with -- in this case attempt to post something on someone else's time line that is not in your friend list. Then the second report said you have to be a friend of the person. You may assume that it is not a bug because the person is in your "friend" list, and that you have permission to post on their timeline (assume that the person permission is set to allow friends to post).

Anyhow, I do blame both sides. I blame the reporter because he gave an incomplete bug report which makes sense to him but not others at the time. Then he escalates his action and steps over the line. I blame the FB team because they did not scrutinize on every single bug report but rather make an assumption in order to do less work. If I were to judge this, I would not reward the reporter still because of his second action (steps over the line). I hope that the reporter loses his attitude and learn from this situation that he should be more professional in the field. The mistake he did (now) is not serious but rather excellent experience for him to be more clear and careful in the future.

PS: For those who said why he did not use a dummy account to do the test, I half agree. Seeing his blog, it seems that he does not know how to disguise his connection on the Internet, using a dummy account does not help...

Re:Won't pay?

[Anonymous Coward]

How is a Palestinian going to get arrested by Pakistani authorities?

It's called outsourcing for plausible deniability.

Re:Won't pay?

[Anonymous Coward]

Also since he's a palestinian he must implicitly support terrorists. Too far? Generalising is fun!

Re:Won't pay?

[Anonymous Coward]

Dunno. But I'll bet it'd have Iran's finger prints all over it!!!! *foams at mouth*

Re:Won't pay?

[Anonymous Coward]

hahaha .. you made my day!
this should be rated funny as well as insightful!

Re:Won't pay?

[asmkm22]

Apparently, he should have just sold it on the black market since Facebook is trying to weasel out of paying over a technicality, no pun intended.

Re:Won't pay?

[Anonymous Coward]

this is facebook. they're not in the business of security or privacy. what do you expect?

Well, I wasn't expecting The Spanish Inquisition!

Re:Won't pay?

[Anonymous Coward]

So you are saying they should pay him and thank him, because he committed a worse offence than he did?

Yes. He tried to use their own method for reporting such problems. If he had just hacked it outright before telling them, then that'd be a different story. But when a company fails to use the information provided to them from their own communication channels, especially when it seems that they did so to screw someone out of a reward, then they deserve what they go & should still pay up.

By this reasoning I should be allowed to kick down your door if you don't answer when I ring the doorbell.

The only ethical thing to do if you discover a security vulnerability is to inform the owner of the system. Any other action (reveling the vulnerability to the public, using the vulnerability for your own profit, using the vulnerability to "make a point", etc.) is at best a jerk move and at worst illegal. That does not change just because you informed the owner first.

Re:Won't pay?

[Anonymous Coward]

Exactly. The next time it's likely that it will go directly to 0-day. Why bother to report when they'll just ignore it and jack you around anyway?

Re:Won't pay?

[coughfeeman]

'Cause the Black Market be all like, "If only we could post on anyone's FB timeline! Combined with the 4 question marks we've gathered, we can have all the Bitcoins!"

Re:Won't pay?

[afidel]

Considering that Instagram followers and Likes are worth more than credit card numbers on the black market I'd assume the ability to manipulate timelines would find some significant value.

Re:Won't pay?

[Anonymous Coward]

"An a huge number of them revel in the opportunity."

No, you don't know a huge number of "hackers", you base this on perceptions based on media portrayals.
And the people who do vandalism don't usually disclose their bugs TWICE beforehand.

Re:Won't pay?

[t0y]

He linked to the post in goodin's wall that shouldn't exist. If a server is on fire you don't need steps to reproduce to prove that something's wrong.

Re:Won't pay?

[flabordec]

Your analogy is completely wrong: it would be correct if my house had a very fancy security system, there is a note on the front that says "I will give $500 to anyone who detects a problem with my security", you rang to tell me you found one vulnerability but I decided to ignore you because I don't want to pay you and then you broke into my house and left a polite note apologizing for it but mentioning that you do, in fact, have a way to break the system. Still illegal, but if there is a jerk in the story it is Facebook for not ignoring the bug reports and not paying bounties.

Re:Won't pay?

[Myopic]

What would be your legal claim in your lawsuit?

Re:Won't pay?

[mysidia]

The only ethical thing to do if you discover a security vulnerability is to inform the owner of the system. Any other action (reveling the vulnerability to the public, using the vulnerability for your own profit, using the vulnerability to "make a point", etc.) is at best a jerk move and at worst illegal.

Facebook not paying the bounty is a jerk move. Personally, I think the next step in response to that, is to try to shame Facebook into treating people more responsibly --- one way of doing so would be to leverage the vulnerability using any legal method that would embarrass Facebook, or show them that their behavior has unintended consequences.

Re:Won't pay?

[mysidia]

Your analogy is completely wrong: it would be correct if my house had a very fancy security system, there is a note on the front that says "I will give $500 to anyone who detects a problem with my security", you rang to tell me you found one vulnerability but I decided to ignore you because I don't want to pay you and then you broke into my house and left a polite note apologizing for it but mentioning that you do

Naw... it's more like you have a Hotel that offers a bounty if you can find a bug in their electronic lock system securing all the hotel rooms.

You report a bug, and they ignore you, so you take it upon yourself to find one of the Hotel owner's rooms protected by the electronic locking system... you defeat it, and you use the defeat just to slip a little sign in the window, where the whole world can see it, and run off.....

Re:Won't pay?

[mysidia]

Well, therein lies [a] problem. Any such law is completely bogus in the first place.

Hacking into an account is not. Gaining access to a computer system without authorization, or utilizing access in excess of your authorized privilege might be.

Most hacking crimes would be Denial of Service, Wire Fraud, or Theft of service.

On the other hand, if you find some person's private intimate details buried in the trash, by some company's employee that carelessly threw out a printout, Name, Address, Social security, etc -- and you just gather that information, store it in a database, to leverage for marketing purposes --- have you committed a crime? Probably not.

Re:Won't pay?

[parkinglot777]

And that's why I blame FB team to not scrutinize on bug report. Have you ever been in an environment that you and a few other people have to deal with hundreds of hundreds of new vague bug report every day for months, and that you are one of them to verify and fix them? I am not saying that you could use that as an excuse not to be careful, but I am saying that it leads to what FB team did. It may or may not be acceptable depends on who is looking at the issue.

Re:Won't pay?

[Redmancometh]

How can you nitpick that with no sense of scale? You have no idea what a "huge number" means in the context of my statement.

Way to be a douche just to be a douche.

I'm Amazed...

[DexterIsADog]

...people are still using Facebook?

Re:I'm Amazed...

[Anonymous Coward]

Hurr durr. It's easy to be amazed by that if you don't speak to anyone outside of your geek echo chamber.

Re:I'm Amazed...

[Anonymous Coward]

Area Man Constantly Telling Everyone He Doesn't Use Facebook

Re:I'm Amazed...

[Anonymous Coward]

Yeah, it's pretty active website. You should check it out sometime!

Re:I'm Amazed...

[Anonymous Coward]

The younger generation is moving away from it...primarily because of parents being on there. Twitter and all other manner of anonymous rapid publishing make Facebook seem unused by comparison.

Re:I'm Amazed...

[Opportunist]

Yup. Not only that, but you can see how the "geek" community (and those that want to be seen as such) are moving away for its "commercial" reek. Since every company and their dog need to muscle in, FB is about as hip as disco.

refuse to pay?

[Anonymous Coward]

I would think that $500 is pretty cheap.. Why piss off everybody who might help you?

Re:refuse to pay?

[idontgno]

Why piss off everybody who might help you?

Why not crush everybody who might embarrass you?

Or, as another sharp analyst put it:

Upon this a question arises: whether it be better to be loved than feared or feared than loved? It may be answered that one should wish to be both, but, because it is difficult to unite them in one person, is much safer to be feared than loved, when, of the two, either must be dispensed with.

In context, that means that if you can make people afraid of trying to hack you, you don't need their respect (or actual competence on your part) to avoid being hacked. Once you've fully domesticated the sheep, you can expect that they won't test their fences any more.

Of course, this strategy is pre-ordained to fail: the psychology of black-hat is full of a kind of irrational sense of invincibility. Like many other sociopaths, they're always the ones most surprised when they're busted. So the lessons of fear are lost on them. But it certainly seems cheaper to the service provider than actually hardening and resolving exploitable holes.

Re:refuse to pay?

[Opportunist]

Why not crush everybody who might embarrass you?

Because of groups like Anonymous. They get a kick out of embarrassing people who get really upset about it.

What next?

[Anonymous Coward]

So is he going to respond by firing some rockets at them?

Re:What next?

[Rob the Bold]

So is he going to respond by firing some rockets at them?

WTF? Zuck's got a private army now? Maybe he got some Predators as a thank-you gift from the NSA.

Re: What next?

[Anonymous Coward]

Yes, Preditors are often overlooked. Just cover yourself with mud and smash them with a log and you'll be fine. Or stay out of the jungles which is their primary habitat.

Re: What next?

[CanHasDIY]

Yes, Preditors are often overlooked. Just cover yourself with mud and smash them with a log and you'll be fine. Or stay out of the jungles which is their primary habitat.

Tell that to Danny Glover.

Re:What next?

[Anonymous Coward]

The only predators Zuckerberg has are the ones in his support group, but The Clap might have let him keep the leather mask and ball gag from the last "meeting".

That's a catch 22

[i kan reed]

Post what you know to their white-hate system: not reproducible with that information. No money.
Reproduce it yourself: violating TOS. No money.

Re:That's a catch 22

[Nerdfest]

Sell it on the open market, plenty of money.

Re:That's a catch 22

[Anonymous Coward]

I don't know that I'd go so far as to say their system is racist against white people...

Re:That's a catch 22

[NatasRevol]

It's much more likely that you have to put in a description of things whites hate. Like baseball. And snow.

Re:That's a catch 22

[greg1104]

Post what you know to their white-hate system

Facebook says that white hate also violates the TOS.

Re:That's a catch 22

[Anonymous Coward]

Post what you know to their white-hate system

That's racist.

Devil's Advocate

[Anonymous Coward]

The messages he sent to facebook's bug reporting system read a lot like spam. The first two started with: "my name is khalil shreateh.
i finished school with B.A degree in Infromation Systems . "

Can't really blame them for not taking it too seriously to begin with. As for not paying him, aren't these bug bounty systems meant to foster responsible disclosure? I'm pretty sure leveraging an attack you found does not count as such.

Re:Devil's Advocate

[bill_mcgonigle]

As for not paying him, aren't these bug bounty systems meant to foster responsible disclosure? I'm pretty sure leveraging an attack you found does not count as such.

It's not 'leveraging an attack' when it's demonstrating the veracity of the claim, to a higher-up employee's wall because the lower level employee ignored you. If there's a problem with his behavior it's that he first posted on the wall of a friend of Zuck, who is not an employee and outside the bug reporting transaction. That was stupid, but a post to Facebook Security's page seems like fair game to demonstrate a problem.

That said, his bug report was complete shit and barely distinguishable from spam. How can he have an IS degree if he can't even write a decent bug report?

Re:Devil's Advocate

[dgatwood]

How can he have an IS degree if he can't even write a decent bug report?

Most universities (even in the U.S.) don't teach that skill. I'm not at all surprised. Even many fully employed software developers write terrible initial reports. My experience has been that on average, bug reports go back to the originator a couple of times just to collect the basics, and that's not including the number of times that the engineers bounce bugs back with suggestions like "Try [x] and see if that works" that are intended both to help the person get up and running and to determine the scope of the problem more fully.

$500 is a lot of money

[LifesABeach]

After Facebook's stock plummet, Mark is pretty hard up for cash; maybe Kahlil Shreateh could cut junior some slack? Lets "face it", super hero underware for staff members is not cheap?

Re:$500 is a lot of money

[phantomfive]

Have you looked at Facebook's stock recently? It's getting close to the IPO price.

Re:$500 is a lot of money

[camperdave]

Underware? Is that some sort of page 0 TSR, or BIOS xploit, or something?

Re:$500 is a lot of money

[rwyoder]

Have you looked at Facebook's stock recently? It's getting close to the IPO price.

It actually closed a little *over* the IPO price on several days last week.

Re:$500 is a lot of money

[Anonymous Coward]

Meanwhile the NASDAQ average market increase is 30% since the launch of the facebook IPO. So buying shares in facebook as opposed to just about anything else was a great way to lose a quarter of your wealth.

Re:$500 is a lot of money

[mysidia]

Have you looked at Facebook's stock recently? It's getting close to the IPO price.

Its recent stock price is full of hot air; hopes, dreams, and other imaginary stuff, and cannot be justified based on either the company's current, anticipated, or remotely likely future growth at massive levels, let alone based on their intrinsic value.

I expect them to have a 50% or greater haircut, when the market comes to grips with their irrational exuberance in regards to FB.

They can do everything right and still "plummet", because their pricing is pie in the sky. FB is in no danger of become bankrupt, and they certainly do have a non-zero intrinsic value; it's just not 1000 times earnings.

Re:$500 is a lot of money

[phantomfive]

If that happens, I wonder if they'll be able to keep their employees around, or if all the good ones will just leave.

Re:$500 is a lot of money

[mysidia]

If that happens, I wonder if they'll be able to keep their employees around, or if all the good ones will just leave.

If they'll bail out just because of some price swings of publicly traded stock, or they were just there because of insanely high valuations, then they are not very good employees.

You don't work for a company based on its stock price. You invest in a company's shares based on its stock price being below what you believe the shares will be worth; or what you believe those shares will eventually be worth relative to the market and relative to your opportunity costs in regards to other options for investing your cash.

Guilty of being Palestinian

[Anonymous Coward]

How much you want to bet it's because they don't want to be seen giving money to someone in Palestine?

Re:Guilty of being Palestinian

[Chris Mattern]

$0. They didn't give him money becuase a) it was a shit bug report and b) corporations are innately averse to giving out money to *anybody*, even if there's a policy saying they have to. Palestine has nothing to do with it.

Re: Guilty of being Palestinian

[Anonymous Coward]

0% ... Take your victim card somewhere else. I'm fed up with the feminism victim card and really don't have the time or patience for the Palestinian victim card.
I'm sure you'll see this posting as attack on Palestinians... All victims see it that way.

Re:Guilty of being Palestinian

[jittles]

$0. They didn't give him money becuase a) it was a shit bug report and b) corporations are innately averse to giving out money to *anybody*, even if there's a policy saying they have to. Palestine has nothing to do with it.

Maybe Facebook's coffers are so empty that they can't afford to pay a $500 bounty?

Re:Guilty of being Palestinian

[Anonymous Coward]

It's idiotic remarks like this that make me wonder why the summary had to mention he was Palestinian. I can't figure out how that's important in the slightest to what we're discussing here.

Not worth it

[phantomfive]

Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds.

That's absolutely not worth the money. He's better off taking the publicity he got from this and turning it into a high-paying job.

Are all security hacks a TOS violation?

[Anonymous Coward]

Because we all know that any security exploit that breaks the TOS would never be used by a Black Hat.

The true reason?

[Anonymous Coward]

Could the true reason be that palestine is being embargoed by the U.S. and Facebook can't send the guy money even if they wanted to?

A great way to alienate the white-hat community.

[fuzzytv]

Good work, Facebook! Kinda resembles what happened at GitHub ~18 months ago: http://www.zdnet.com/blog/security/how-github-handled-getting-hacked/10473

If someone from Facebook reads this, and it's TL;DR; here are the next steps:

#1 apologize to the guy, acknowledge he reported the issue twice
#2 reinstate the account and pay him his reward
#3 fix the damn issue

500 USD?

[ebonum]

What a joke. Face book should fire the guy costing 150,000 USD a year ( take home pay and all in cost to FB are not the same ) who wrote the offending code.

500 USD for a bug is an insult. How much do their QC people make a month? They failed, and they are getting a lot more than 500 USD.

Re:500 USD?

[Anonymous Coward]

Face book should fire the guy ... who wrote the offending code.

When it's original Zuckercode, they might not be willing to take that step.

Re:500 USD?

[Impy the Impiuos Imp]

$5000 would be a better starting bounty. What are they expecting, 100,000 bugs?

Re:500 USD?

[Anonymous Coward]

The problem with bug bounties also has to do with how you count them and not all bugs being created equal. You could get a ton of minor GUI glitches worth like five dollars each or one big one of "Hey, if you enter this in the login field you can output all of the personal data and then enter this to destroy their database."

Re:500 USD?

[Anonymous Coward]

What are they expecting, 100,000 bugs?

Sounds about right.

Re:500 USD?

[Entropius]

Probably. Have you ever used Facebook? It's buggier than an entomology lab.

Re:500 USD?

[Anonymous Coward]

How much do their QC people make a month? They failed, and they are getting a lot more than 500 USD.

Chances are fairly good that they did in fact catch it, but it was ignored or overlooked by management.

Re:500 USD?

[gameboyhippo]

I'm not sure where anybody has gotten the idea that code is always going to be perfect the first time through even with the most cautious developer. Programming is complex and, especially in the field of security, new breaches are invented all the time. For some, it may not be the developer's code at all, but a library or runtime that the code uses. At the end of the day, programmers who deal with the most complex issues are most likely going to make a mistake somewhere in their code. Yes unit testing and functional testing can mitigate that, but an expectation for code to be 100% bulletproof 100% of the time is silly.

Re:500 USD?

[fuzzytv]

The nastiest (security) issues I've stumbled upon usually happened at the boundary of multiple components (developed by various teams and therefore multiple individuals). None of them was really the single offender, it was mostly about incorrect assumptions / pieces reimplemented through the lifetime / specifications not detailed enough (well, is there such thing as a complete specification?). And those are the most difficult issues to debug / identify.

So "fire the guy who wrote the offending code" may not be as simple as it sounds. And even the best developers I know do a mistake from time to time.

Minions!!!

[Anonymous Coward]

Looks like Facebook is rapidly declining into the corporate morass. WAKE UP Facebook!!

Re:Minions!!!

[Opportunist]

To get to the corporate morass, they certainly wouldn't have to decline...

Re:A great way to alienate the white-hat community

[Skapare]

#4 fire whoever is responsible for him being ignored.

Cheapskates

[Anonymous Coward]

Refusing to pay because it violates terms of service? Wait wait, I'm now convinced all my online details are safe. Afterall the terms of service protects me from dishonest hackers, right?

Irony is hard

[Anonymous Coward]

sarcasm is harder. wow people are touchy

This is so bad

[Anonymous Coward]

I mean, you ask people to send bugs to you, you even offer to pays.. and now for obscure reason you don't? And after that you want me to "trust" you?
Hacker are not people who follow "rules" and/or TOS. That's why they find bugs!

Re:This is so bad

[dgatwood]

This. As soon as a bug bounty program is shown to not actually pay out when a real security flaw is found, it becomes a worthless program. From now on, instead of telling Facebook, the not-insignificant percentage of hackers for whom the bounty was the only reason to report it to FB will simply disclose the flaw immediately, resulting in a significant reduction in the site's security for everyone.

Re:This is so bad

[Anonymous Coward]

It was not an obscure reason. It was a plainly obvious reason. The Jews don't like getting pwned by the Palestinians.

Re:This is so bad

[mysidia]

FB will simply disclose the flaw immediately, resulting in a significant reduction in the site's security for everyone.

Why bother disclosing the flaw at all?

They'll probably just anonymously announce that they found it; hint that it might be available for the right price, if someone is sufficiently interested.

BRIGHT EYES

[Anonymous Coward]

you know who you are

Trying to save face...

[oh_my_080980980]

You were warned repeatedly and ignored it. FU.

Easy to remedy...

[Anonymous Coward]

Fire the idiot(s) who denied the bug existed and hire Kahlil to replace them. Simple.

Not illegal

[schneidafunk]

I think you are mistaking illegal versus violating terms of service. He did nothing illegal.

Re:Not illegal

[CanHasDIY]

If that were the case, I likely wouldn't have listed both.

Pretty sure compromising a remote system that does not belong to you without permission is a violation of the Computer Fraud and Abuse Act.

Re:Not illegal

[IcarusMoth]

So, American laws now apply to foreign nationals who are not in America? That's awesome! U-S-A! U-S-A! Unless of course he's a foreign national outside the legal borders of America and therefore not subject to American laws. ...one of the two...

Re:Not illegal

[CanHasDIY]

So, American laws now apply to foreign nationals who are not in America?

A) Have you been sleeping the past decade or so? If the non-American government acquiesces to the US Government demands, then yes, apparently they do. Not that I agree with the practice.

B) The dude in question is a Palestinian. Really, if you know anything about US/Isreali/Palestinian relations, that should be all I have to say.

The childishness in the center of your statements was completely without necessity.

Re:Not illegal

[schneidafunk]

Maybe you should read up on the law instead of speculating; It relates to financial institutes & the government. Or you could RTFA and see that it states clearly "his actions violated Facebook's Terms of Service".

Re:Not illegal

[X0563511]

CFAA: the worst, most overreaching, over-broad, and over-abused set of laws to ever "grace" our legal system.

Well, next to interstate commerce.

Re:Not illegal

[CanHasDIY]

Maybe you should read up on the law instead of speculating; It relates to financial institutes & the government.

The law states that the CFAA is limited to systems that "have a compelling federal interest;" considering that it's well known that the government monitors facebook traffic, and possibly even has equipment running at the facebook datacenter, it's not a stretch to see how they could apply the CFAA to social media traffic. Again, don't agree with the practice, but I can see the potential for charges.

Or you could RTFA and see that it states clearly "his actions violated Facebook's Terms of Service".

Are you really claiming that one cannot both violate a ToS and a law simultaneously? Just because one was mentioned and not the other does not mean that the other is not a distinct possibility - it could mean that whoever wrote TFA failed to do their due diligence.

Re:Not illegal

[IcarusMoth]

I'm sorry if you thought that it was childish. I think that the Team America World Police view of international laws and policies that you expressed bordered on insipid.

Sure, the USA/Israeli semi-religious, hemi-apocalyptic, demi-political, mutually sycophantic, sociopathy enabling relationship; and tacit acceptance of antagonism towards the Palestine and it's people does complicate the issue. But, it only does so insomuch as Israel might send in the Mossad, crack some skulls, and the US will say "You did a bad thing, Izzy. Here is another few billion dollars not to do it again."

But there you go expecting the Palestinians to extradite someone who is apparently bright and more over, reasonably minded to a country that gives 9x the annual aid to their unfriendly, oppressive neighbor. Seems that you are not understanding the realities of international justice and the treaties governing enforcement of international laws.

Re:Not illegal

[CanHasDIY]

But there you go expecting the Palestinians...

I elicited no such expectation, so please refrain from putting words in my mouth; I have no idea where your hands have been.

Re:Not illegal

[sjames]

If I were a lawyer, I might argue that offering the bounty on bugs implies permission to look for bugs.

He should sit on it for a week, then repeat.

[Anonymous Coward]

He should sit on it, and let them stew over it waiting for the head cheese to come down on them for not fixing it.

Then repeat his feat again next week to remind the head cheese to take action.

Re:Jordan

[Anonymous Coward]

There is no website that has a good security

Nonsense. My web site has perfect security. OK, it has zero reachability, but hey, you have to pay a price. ;-)

Google has a much better bounty program...

[slashkitty]

They pay $7,500 for an XSS bug, more for more serious bugs. Facebook better think about their program before a more serious bug is made public or exploited privately.

Re:Google has a much better bounty program...

[Anonymous Coward]

Facebook better think about their program before a more serious bug is made public or exploited privately.

Almost certainly too late.

Small claims court

[Anonymous Coward]

Or Judge Judy. AFIK no lawyers allowed.

stupid me

[Anonymous Coward]

Well what did he expect
When a Palestinian goes and invades the home (page) of someone called Zuckerberg.
Is despicable and horrible and would never happen in the real world.....oh hang on a minute

Well if they won't pay up

[DrXym]

Don't tell them how it was done. No threats, no extortion, just don't tell them. Let them figure it out on their own dime.

Re:Not worth it, possible troll

[Anonymous Coward]

FB is so for iPhone using grandparents that even their engineers don;t take threats seriously... really is anyone still using that thing?

Re:Facebook is scum, break it.

[Anonymous Coward]

As a shareholder, I support this statement!

Re:Not worth it, possible troll

[phantomfive]

FB is so for iPhone using grandparents that even their engineers don;t take threats seriously... really is anyone still using that thing?

You should check it out, you'd probably like it. With grammar like that, you'd fit right in!

Very different...

[Anonymous Coward]

In a commercial testing context, the submitter has a much bigger obligation and level of accountability. If he opens a bug, that bug should be treated unequivocably as a real problem and should be closely examined. Also, the submitter is obligated to respond and work together with the developer. The submitter also can be trusted to more accurately indicate the severity of a problem.

In an open bug tracking system, things change. People will file bugs with almost no detail that might be a real problem or just some rant abusing a bug tracker as a soap box. Attempts to request follow up information are frequently not responded to as the submitter just fired and forgot. As such it's easy to get a bit distrusting of legitimacy of reports knowing that most of the time it isn't an actionable report and that trying to solicit feedback that would change the situation will be fruitless.

Re: Very different...

[dannys42]

That's a very good point. Bug tracking systems (public and even private) should also have a way to track the reliability of submitters. I've been with the open source community since before "open source" was a phrase, and sadly from what I've seen, the community still seems to lack an understanding of the human side of things at pretty much all levels. And from how GNOME has been shaped through the years, it only seems to be getting worse.

Not securing a service is criminal too.

[Anonymous Coward]

So for not closing this exploit, FB is in SERIOUS SHIT with the law for their millions of users.

Re:Not securing a service is criminal too.

[mysidia]

It's illegal but not criminal. The recourse is civil.

translation

[slashmydots]

What they meant to say was "That report is received by an intern who doesn't give a damn because we don't take security seriously."

Job offer

[Anonymous Coward]

Seems to me, the "bureaucrat" responding to the bug report should be fired and Kahlil should be offered a job.

Same old same old

[Arith]

Good to see they're still proactive. Somewhere around 2009 I came across a phishing scam to catch Facbook logins. On a whim I dug around the fake login page and I was able to glean over 15 thousand people's login info. I went to Facebook to do the right thing: "Hey, so and so is running a phishing scam and has their payload open to the WORLD.. might want to notify these thousands of people". The reply? A canned response: "So you are having trouble with your password information ..." What a joke.

Re:Jordan

[Minwee]

There is no website that has a good security

Nonsense. My web site has perfect security. OK, it has zero reachability, but hey, you have to pay a price. ;-)

Ahh, the "Switched off and unplugged locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards" security model. A wise choice.

Not enough technical info? So... get some more

[FuzzNugget]

I can buy that the submitted report "did not have enough technical information" to take action, but your response is ... uh, eh fuck it?

How about you follow up by contacting the submitter for more information.

$500 bait

[LoRdTAW]

Hacker: I found a major exploit in your system. Here are the details.
Facebook engineers: (to themselves) Shit, he may be right but we can't reproduce it and we don't want to get into trouble. Just sweep it under the rug.
Hacker: I filed a major bug report and you didn't respond, here are more details in case you needed more help.
Facebook engineers: (to themselves) Oh fuck. That is going to be a lot of work to fix. File this one under the rug again. I hope I get a better offer from Google or Apple before the shit hits the fan.
Hacker: (hacks Zuckerberg's account) That will get their attention.
Zuckerberg to FB engineers: WHAT THE FUCK! How did this happen! I want answers now or heads start rolling!
FB engineers: Shit Shit Shit Shit Shit... contact that guy and see what he did ASAP! Oh god oh god oh god..........
Facebook/Zuckerberg: This is a major embarrassment but I still don't want to give that little bastard any credit for exposing our laziness. Reward denied.

Nice job sparing 500$, facebook!

[roscocoltran]

This is probably worth the risk of seeing more aggressive hackers in the future.

BS..

[SuperDre]

Have you people actually seen the email-conversation between him and facebook?
Well if you have, you know HE is just a moron for making it public as he didn't send facebook a step-by-step on how to recreate the bug, all he did was say 'he I can post a message on someonelses wall without being a friend'.. and after facebook asked some details all he did was post a link to a post he made.. the man is a moron, if he's a "security researcher" then he should at least know how to do a proper bug-report.. Facebook get's so many fake bug-reports (with photoshopped images) from people who hope they can get a bounty..

Re:BS..

[Anonymous Coward]

" and after facebook asked some details all he did was post a link to a post he made.. the man is a moron"

After seeing that post they should have checked to see if he had permission to post on Zuckerberg's wall and from that deduce that the guy was telling the truth and asked him for more information on reproducing the bug.

But what did they do? Fuck all until the shit hit the fan.
  Lazy Morons.

Re:BS..

[someone1234]

Well, they found the bug after he demonstrated the vulnerability, so this security team sucks.
They should probably create a test account and let people try and vandalize that.
Anyway, they should have paid the 500 bucks regardless if the guy is a moron or not.
He pointed out a real vulnerability. This actions increased the worth of Facebook (well, it would have been increased more if the sec team is not a bunch of jerks).

Unjust Enrichment

[Sentrion]

IANAL, but this case sounds like it might be a good candidate for an unjust enrichment lawsuit. If Zuckerborg refuses to pay the $500 bounty on the grounds that FB terms of use were violated, then shouldn't they pay the hacker "fair market value" for identifying the bug? After all, FB openly solicited bug reports from the general public with a promise of compensation. And did FB not implement new safeguards after they found out the exploit was legitimate, as evidenced by Zuckerberg's hacked page?

If my neighbor hires a painter, and the painter paints my house instead of my neighbor's house, and I stand by and watch the painter work on my house without informing the painter he is working on the wrong house, then I am obligated to pay the painter the amount he would have charged my neighbor for the work performed. Absent any written agreement, the amount due would be based on the fair market value of the labor performed plus a generally accepted markup for the cost of materials.

So now I'm curious, what would be the fair market value for finding an exploit that would allow a hacker to alter Mr. Zuckerberg's own FB page? Given that the IRS can tax certain unsaleable items based on "illicit market" value, could the "street value" of Mr. Shreateh's findings be considered for valuation given that there is no "fair" market value, since such a value implies that there exists a market, meaning more than one possible customer legally able and willing to make an offer for such findings?

Read more: http://lancasteronline.com/article/local/607346_IRS-values-stolen-or-illegal-items-at-black-market-rate.html#ixzz2cRIxNEoC

Re:Unjust Enrichment

[mysidia]

If my neighbor hires a painter, and the painter paints my house instead of my neighbor's house, and I stand by and watch the painter work on my house without informing the painter he is working on the wrong house, then I am obligated to pay the painter the amount he would have charged my neighbor for the work performed.

Wait: no. There's a problem with that. You can't have part of your house painted, and then have the painter stop: that would look horrible.

I have a right to not have my house painted against my will. But if someone starts painting my house; I have a right to not have a combination of discolored old paint and patches of new paint.

The painter owes me to make it right. He's got to complete the job, or pay me to have someone fix it.

Re:Jordan

[Anonymous Coward]

So what you are saying is that you are a script kiddie and can be safely ignored because you are zero technical skills

haxormania

[hesaigo999ca]

Mark considers himself a haxor, so do many others that use his app. Some are smarter then others, this one proved he was, and went so far as to show the creator of facebook he was, instead of 500$ , I would have asked for a job, and some cigars, love those cigars, and maybe a bottle of tequila.... but never money!
Its the principle of it all

Programmers should be forced to work in the QA dep

[Anonymous Coward]

Some programmers are just arrogant people who assume everyone else is stupid and that it's always user error. I've worked for a large Norwegian browser company which I won't name, and it was the same thing there. No matter how detailed the bug report, and despite the fact that I was sitting less than 40 meters away so they could just have popped in for a demonstration, a lot of the reported bugs would just be closed with "cannot reproduce". It's just incredibly frustrating to work with people like that.

CNR

[The Grim Reefer]

This XKCD seems appropriate. The first time I saw it I almost fell out of my chair laughing. At my previous company I practically had to write a doctoral thesis to get simple obvious bugs fixed.

Mess with Facebook?

[PPH]

Perhaps Shreateh can get asylum in Russia.

bullshit

[shentino]

He reported the bug BEFORE he violated the facebook TOS.

So Facebook is just using the TOS violation as an excuse for *retroactive* denial of the bounty *he had already earned*.

Re:bullshit

[Anonymous Coward]

He didn't report anything. He made a baseless claim. Did you read his disclosures?

Facebook is being evil, yet again.

[runeghost]

Realisitically, what are the chances that even the most vile possible behavior by Facebook will even scratch their bottom line?

Facebook delenda est.

Next target?

[Anonymous Coward]

"However, the company has refused to pay Shreateh for discovering the vulnerability because his actions violated Facebook's Terms of Service.'"

Sounds like a great idea....deny the hacker who got into your system $ 500.00. Can't imagine what he might try to hack into next...........ca-ching. (still laughing tho...violated FB TOS.....smh)

Bug tracking metrics favor rejection

[Anonymous Coward]

Perhaps it has not bubbled up, but I am surprised that no one has mentioned that "days open" is one of the primary bug tracking metrics, which makes for a strong incentive to close bugs as quickly as possible. When you find yourself in a department that is judged on how fast bugs are closed, you start to realize that the easiest way to protect your "days open" metric is to not open bugs until you have to. In some cases, that means asking for more data from the submitter; in other cases that means rejecting the bug as not reproducible.

The sad fact is that implementing performance metrics raises an incentive to game the system.

Sup guys...

[Anonymous Coward]

Fuck Facebook.

Don't give them

[Anonymous Coward]

Don't give them the information tell them to fuck off !

oh dear...

[Anonymous Coward]

a jew's company really has refused to pay a palestinian money, and now spend real time and energy trying to make it look like the palestinian's fault. You couldn't script it.

just a suggestion

[roc97007]

If Facebook won't pay him the $500, we should pass the hat around. Such chutzpa should be encouraged.

Re:Jordan

[Anonymous Coward]

Without the guards.

The guards can still be paid off; even if you pay them well; since well is less than infinite; and that means there is some value of money between well and infinite that they can be offered.

Stupid, soft-headed moderators

[gd2shoe]

Oh, come on moderators. -1 offtopic? I'm exactly on topic responding to parent. Is it because you find him funny (and totally unable to understand gpp), but the truth is too inconvenient for you?

I speak bad about Palestine (which has epic violence problems), and it doesn't matter that I throw Israel under the bus too? I spoke bad about the "victims" therefore I must be a bad person, and must be modded down? There is no excusing anyone who stands up for the violent, hateful, racist scumbags that shoot rockets from Palestine at Israel's civilians.

If they wanted real change, the rest of the world is ready to be sympathetic... but can't be while Palestine's moron population is trying to prove just how terrible it can be. The murderous lunatics are only slowing peace down. The real victims are the dead and suffering, on both sides of the wall. Yes, I guess I actually am calling for people to think of the children.

An easier way to filter through bug reports..

[Anonymous Coward]

1) Create dummy account. Monitor the account at least daily.
2) Invite people to hack dummy account, with an objective of either finding information not shown to public or adding a "contact me" message to dummy account.
3) If a person manages to do anything of such to dummy account, consider the hack valid and request further information.
4) After any such disclosure or after every month, do a full reset of account with new passwords and such.

Given what we know about Zuck

[Anonymous Coward]

You're an idiot if you use anything he's involved with

The man is a scumbag.

Facebook Handled It Correctly

[Anonymous Coward]

I hope some of you are able to read the "security researcher's" two disclosures to Facebook. In broken English they both basically said "I figured out how to hack you. I'm a student who can't find work. Give me my reward." with zero proof. Facebook handled this case appropriately. First time I've ever said that.

False information

[Anonymous Coward]

Plain and simple : they PUBLISHED the fact that they pay people who find and report security flaws and OPENLY ignore reports? Seems like they're hanging on to their $500 by skin of their grimey lying teeth. I hate Facebook and now admire this guy. They should pay him MORE than $500 for having to go thru the trouble of hacking their stupid page. I hate to know how many times this happens from people who aren't just trying to REPORT THE BUG :/ Good Grief