Slashdot Mirror
Security Researcher Makes His Point By Hacking Into Zuckerberg's Facebook Page
Eugriped3z writes "Whitehat Palestinian hacker Kahlil Shreateh submitted a bug report to Facebook's Whitehat bug reporting page not once, but twice. After it was ignored the first time and denied outright on the second occasion (which included links to an example as proof), he hacked Mark Zuckerberg's personal timeline, leaving both an explanation and an apology. From the article: 'In less than a minute, Shreateh's Facebook account was suspended and he was contacted by a Facebook security engineer requesting all the details of the exploit. 'Unfortunately your report to our Whitehat system did not have enough technical information for us to take action on it,' the engineer wrote in an email. 'We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue.' Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds. However, the company has refused to pay Shreateh for discovering the vulnerability because his actions violated Facebook's Terms of Service.'"
Screw them, the onus is on them to take action when someone reports a bug. If you don't have enough information when there is a security problem, maybe, JUST MAYBE, you should follow up with the submitter. If I was the submitter I'd just publish the exploit and be done with it.
Seems to me that Mark is just pissed at being embarrassed, there really is no justification for not paying him. He submitted the bug to their security team first before exploiting it in a harmless way.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
...people are still using Facebook?
I would think that $500 is pretty cheap.. Why piss off everybody who might help you?
Post what you know to their white-hate system: not reproducible with that information. No money.
Reproduce it yourself: violating TOS. No money.
So is he going to respond by firing some rockets at them?
WTF? Zuck's got a private army now? Maybe he got some Predators as a thank-you gift from the NSA.
I am not a crackpot.
After Facebook's stock plummet, Mark is pretty hard up for cash; maybe Kahlil Shreateh could cut junior some slack? Lets "face it", super hero underware for staff members is not cheap?
How much you want to bet it's because they don't want to be seen giving money to someone in Palestine?
Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds.
That's absolutely not worth the money. He's better off taking the publicity he got from this and turning it into a high-paying job.
"First they came for the slanderers and i said nothing."
Because we all know that any security exploit that breaks the TOS would never be used by a Black Hat.
As for not paying him, aren't these bug bounty systems meant to foster responsible disclosure? I'm pretty sure leveraging an attack you found does not count as such.
It's not 'leveraging an attack' when it's demonstrating the veracity of the claim, to a higher-up employee's wall because the lower level employee ignored you. If there's a problem with his behavior it's that he first posted on the wall of a friend of Zuck, who is not an employee and outside the bug reporting transaction. That was stupid, but a post to Facebook Security's page seems like fair game to demonstrate a problem.
That said, his bug report was complete shit and barely distinguishable from spam. How can he have an IS degree if he can't even write a decent bug report?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Good work, Facebook! Kinda resembles what happened at GitHub ~18 months ago: http://www.zdnet.com/blog/security/how-github-handled-getting-hacked/10473
If someone from Facebook reads this, and it's TL;DR; here are the next steps:
#1 apologize to the guy, acknowledge he reported the issue twice
#2 reinstate the account and pay him his reward
#3 fix the damn issue
What a joke. Face book should fire the guy costing 150,000 USD a year ( take home pay and all in cost to FB are not the same ) who wrote the offending code.
500 USD for a bug is an insult. How much do their QC people make a month? They failed, and they are getting a lot more than 500 USD.
#4 fire whoever is responsible for him being ignored.
now we need to go OSS in diesel cars
Refusing to pay because it violates terms of service? Wait wait, I'm now convinced all my online details are safe. Afterall the terms of service protects me from dishonest hackers, right?
Yes, Preditors are often overlooked. Just cover yourself with mud and smash them with a log and you'll be fine. Or stay out of the jungles which is their primary habitat.
Tell that to Danny Glover.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
You were warned repeatedly and ignored it. FU.
I think you are mistaking illegal versus violating terms of service. He did nothing illegal.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
To get to the corporate morass, they certainly wouldn't have to decline...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They pay $7,500 for an XSS bug, more for more serious bugs. Facebook better think about their program before a more serious bug is made public or exploited privately.
-- these are only opinions and they might not be mine.
Well what did he expect
When a Palestinian goes and invades the home (page) of someone called Zuckerberg.
Is despicable and horrible and would never happen in the real world.....oh hang on a minute
Don't tell them how it was done. No threats, no extortion, just don't tell them. Let them figure it out on their own dime.
FB is so for iPhone using grandparents that even their engineers don;t take threats seriously... really is anyone still using that thing?
You should check it out, you'd probably like it. With grammar like that, you'd fit right in!
"First they came for the slanderers and i said nothing."
What they meant to say was "That report is received by an intern who doesn't give a damn because we don't take security seriously."
Good to see they're still proactive. Somewhere around 2009 I came across a phishing scam to catch Facbook logins. On a whim I dug around the fake login page and I was able to glean over 15 thousand people's login info. I went to Facebook to do the right thing: "Hey, so and so is running a phishing scam and has their payload open to the WORLD.. might want to notify these thousands of people". The reply? A canned response: "So you are having trouble with your password information ..."
What a joke.
That's a very good point. Bug tracking systems (public and even private) should also have a way to track the reliability of submitters. I've been with the open source community since before "open source" was a phrase, and sadly from what I've seen, the community still seems to lack an understanding of the human side of things at pretty much all levels. And from how GNOME has been shaped through the years, it only seems to be getting worse.
Nonsense. My web site has perfect security. OK, it has zero reachability, but hey, you have to pay a price. ;-)
Ahh, the "Switched off and unplugged locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards" security model. A wise choice.
I can buy that the submitted report "did not have enough technical information" to take action, but your response is ... uh, eh fuck it?
How about you follow up by contacting the submitter for more information.
Hacker: I found a major exploit in your system. Here are the details.
Facebook engineers: (to themselves) Shit, he may be right but we can't reproduce it and we don't want to get into trouble. Just sweep it under the rug.
Hacker: I filed a major bug report and you didn't respond, here are more details in case you needed more help.
Facebook engineers: (to themselves) Oh fuck. That is going to be a lot of work to fix. File this one under the rug again. I hope I get a better offer from Google or Apple before the shit hits the fan.
Hacker: (hacks Zuckerberg's account) That will get their attention.
Zuckerberg to FB engineers: WHAT THE FUCK! How did this happen! I want answers now or heads start rolling!
FB engineers: Shit Shit Shit Shit Shit... contact that guy and see what he did ASAP! Oh god oh god oh god..........
Facebook/Zuckerberg: This is a major embarrassment but I still don't want to give that little bastard any credit for exposing our laziness. Reward denied.
Most universities (even in the U.S.) don't teach that skill. I'm not at all surprised. Even many fully employed software developers write terrible initial reports. My experience has been that on average, bug reports go back to the originator a couple of times just to collect the basics, and that's not including the number of times that the engineers bounce bugs back with suggestions like "Try [x] and see if that works" that are intended both to help the person get up and running and to determine the scope of the problem more fully.
Check out my sci-fi/humor trilogy at PatriotsBooks.
This. As soon as a bug bounty program is shown to not actually pay out when a real security flaw is found, it becomes a worthless program. From now on, instead of telling Facebook, the not-insignificant percentage of hackers for whom the bounty was the only reason to report it to FB will simply disclose the flaw immediately, resulting in a significant reduction in the site's security for everyone.
Check out my sci-fi/humor trilogy at PatriotsBooks.
This is probably worth the risk of seeing more aggressive hackers in the future.
Have you people actually seen the email-conversation between him and facebook?
Well if you have, you know HE is just a moron for making it public as he didn't send facebook a step-by-step on how to recreate the bug, all he did was say 'he I can post a message on someonelses wall without being a friend'.. and after facebook asked some details all he did was post a link to a post he made.. the man is a moron, if he's a "security researcher" then he should at least know how to do a proper bug-report.. Facebook get's so many fake bug-reports (with photoshopped images) from people who hope they can get a bounty..
IANAL, but this case sounds like it might be a good candidate for an unjust enrichment lawsuit. If Zuckerborg refuses to pay the $500 bounty on the grounds that FB terms of use were violated, then shouldn't they pay the hacker "fair market value" for identifying the bug? After all, FB openly solicited bug reports from the general public with a promise of compensation. And did FB not implement new safeguards after they found out the exploit was legitimate, as evidenced by Zuckerberg's hacked page?
If my neighbor hires a painter, and the painter paints my house instead of my neighbor's house, and I stand by and watch the painter work on my house without informing the painter he is working on the wrong house, then I am obligated to pay the painter the amount he would have charged my neighbor for the work performed. Absent any written agreement, the amount due would be based on the fair market value of the labor performed plus a generally accepted markup for the cost of materials.
So now I'm curious, what would be the fair market value for finding an exploit that would allow a hacker to alter Mr. Zuckerberg's own FB page? Given that the IRS can tax certain unsaleable items based on "illicit market" value, could the "street value" of Mr. Shreateh's findings be considered for valuation given that there is no "fair" market value, since such a value implies that there exists a market, meaning more than one possible customer legally able and willing to make an offer for such findings?
Read more: http://lancasteronline.com/article/local/607346_IRS-values-stolen-or-illegal-items-at-black-market-rate.html#ixzz2cRIxNEoC
Mark considers himself a haxor, so do many others that use his app. Some are smarter then others, this one proved he was, and went so far as to show the creator of facebook he was, instead of 500$ , I would have asked for a job, and some cigars, love those cigars, and maybe a bottle of tequila.... but never money!
Its the principle of it all
This XKCD seems appropriate. The first time I saw it I almost fell out of my chair laughing. At my previous company I practically had to write a doctoral thesis to get simple obvious bugs fixed.
Perhaps Shreateh can get asylum in Russia.
Have gnu, will travel.
He reported the bug BEFORE he violated the facebook TOS.
So Facebook is just using the TOS violation as an excuse for *retroactive* denial of the bounty *he had already earned*.
Realisitically, what are the chances that even the most vile possible behavior by Facebook will even scratch their bottom line?
Facebook delenda est.
a jew's company really has refused to pay a palestinian money, and now spend real time and energy trying to make it look like the palestinian's fault. You couldn't script it.
If Facebook won't pay him the $500, we should pass the hat around. Such chutzpa should be encouraged.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Oh, come on moderators. -1 offtopic? I'm exactly on topic responding to parent. Is it because you find him funny (and totally unable to understand gpp), but the truth is too inconvenient for you?
I speak bad about Palestine (which has epic violence problems), and it doesn't matter that I throw Israel under the bus too? I spoke bad about the "victims" therefore I must be a bad person, and must be modded down? There is no excusing anyone who stands up for the violent, hateful, racist scumbags that shoot rockets from Palestine at Israel's civilians.
If they wanted real change, the rest of the world is ready to be sympathetic... but can't be while Palestine's moron population is trying to prove just how terrible it can be. The murderous lunatics are only slowing peace down. The real victims are the dead and suffering, on both sides of the wall. Yes, I guess I actually am calling for people to think of the children.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
It's illegal but not criminal. The recourse is civil.
FB will simply disclose the flaw immediately, resulting in a significant reduction in the site's security for everyone.
Why bother disclosing the flaw at all?
They'll probably just anonymously announce that they found it; hint that it might be available for the right price, if someone is sufficiently interested.