Security Researcher Makes His Point By Hacking Into Zuckerberg's Facebook Page

Eugriped3z writes "Whitehat Palestinian hacker Kahlil Shreateh submitted a bug report to Facebook's Whitehat bug reporting page not once, but twice. After it was ignored the first time and denied outright on the second occasion (which included links to an example as proof), he hacked Mark Zuckerberg's personal timeline, leaving both an explanation and an apology. From the article: 'In less than a minute, Shreateh's Facebook account was suspended and he was contacted by a Facebook security engineer requesting all the details of the exploit. 'Unfortunately your report to our Whitehat system did not have enough technical information for us to take action on it,' the engineer wrote in an email. 'We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue.' Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds. However, the company has refused to pay Shreateh for discovering the vulnerability because his actions violated Facebook's Terms of Service.'"

Comments

Take it public

[scubamage]

Screw them, the onus is on them to take action when someone reports a bug. If you don't have enough information when there is a security problem, maybe, JUST MAYBE, you should follow up with the submitter. If I was the submitter I'd just publish the exploit and be done with it.

Re:Take it public

[gl4ss]

They don't follow up on anything, I checked.

It might be because they're so swamped or maybe it's that if they feel like it's not their bug then they don't do anything. Either way not very responsive.

Re:Take it public

[SQLGuru]

I read the guy's own post about it. He reported what he could do and not the steps required to exploit it. The Facebook team couldn't reproduce it as a bug (since there were no repro steps) and closed it as "not a bug".

So really, the problem was one of communication. The guy has the problem a lot of my clients/users have in that they don't give enough detail to investigate the bug and Facebook didn't really follow what he was trying to say (since he just sent them links saying "look what I did"). I'm not saying he didn't legitimately find an exploit and probably deserves some bounty ($500 is nothing to a company like Facebook), but Facebook should probably have some guidelines for how to submit bugs.

Aside - what any bug report needs:
* What action were you taking?
* What result did you observe?
* What result did you expect?
* Are there specific data values that always exhibit the symptom?
* Are there specific data values that do not exhibit the symptom?
* Reproduction steps (be as detailed as possible)
* Any other useful details about the bug (error messages, screen shots, etc.)

Re:Take it public

[Anonymous Coward]

I'm a QA analyst, and the quote: "We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue." is totally incorrect. An issue does not have to be reproducable in order to warrant some debugging and investigation.

Re:Take it public

[Skapare]

If YOU could read the guy's post, then that would be the WRONG place for him to put the details about how to reproduce it. Facebook engineers should have contacted HIM, directly, by a secure means, to get those details. If Facebook engineers expect exploits to be posted in a public forum, then it is THEY who are doing this wrong.

Re:Take it public

[Opportunist]

The severity of a problem determines whether it pays to investigate. An odd crash once a week with no repeatable underlying condition and no data loss doesn't warrant a through investigation.

A severe security hole DOES! Almost invariably. Anything that allows an attacker to gain access in some way IS a reason for an investigation. The crucial point here is that undoing the damage is nearly impossible. With a crash, you can reenter the data and undo the damage. With a security breach, the data is out and there is NO way you can undo the damage, once data is out, it IS out.

Re:Take it public

[Opportunist]

'scuse me, but 500 bucks is peanuts for a 0day full-access security hole in FB. Tack a few 0s to that and we'll start talking.

Re:Take it public

[Anonymous Coward]

I'm a programmer too. You ALWAYS respond to issues, even if it's just, "Can't Reproduce: Not enough info in bug report."

Re:Take it public

[GNious]

This is why you change the Bug Status from "New" to "Need More Information", and NOT to "Closed" or "Get Lost, Ass".

Re:Take it public

[dgatwood]

No, not almost invariably. Invariably. You always follow up on security hole bug reports. Always. If you do not do this, you are incompetent. Assuming this security researcher gave them a reasonable amount of time (the summary here doesn't say), then this is once again a demonstration of Facebook talking "secure" but implementing the opposite, hyping their bounty program while refusing to pay out.

For that matter, you should always follow up on non-security bug reports unless they're obvious garbage (e.g. porn site spam submitted to your bug reporting page by a bot). But security bugs? There's no excuse for not following up on those. Ever. EVER.

Re:Take it public

[Rob the Bold]

I'm a QA analyst, and the quote: "We cannot respond to reports which do not contain enough detail to allow us to reproduce an issue." is totally incorrect. An issue does not have to be reproducable in order to warrant some debugging and investigation.

Maybe they just don't have the technology to request additional info from the reporter. Maybe that's not part of the protocol there. If it were my job to handle bug reports and I didn't want to be hassled with work, I'd require a complete bug description, including exact description of systems used and all steps to reproduce reported in exactly the format I'm expecting. I'd also make sure my instructions and description of the report format were just a little vague, so the user would be forced to fill in the blanks, further reducing the odds that the report would be "valid". Maybe I'd require some info that most bug reporters would think irrelevant or inapplicable to most bugs -- you know, just to tempt them to skip that part. Then I could pretty much close every ticket with "can't reproduce" and screw around on facebook all day -- for quality assurance purposes, of course.

Re:Take it public

[X0563511]

Hell you should at least respond to the reporter! "Can you provide more detail?" and then waiting for said detail is infinity better than ignoring or rejecting it.

Re:Take it public

[X0563511]

Not to say you're wrong, but would it really have been so hard for them to reply asking for details? Simply closing it without even a response is not appropriate, even if it is a useless report.

As someone else said, if it was publicly viewable it was not an appropriate place to put the details. Perhaps he should have offered them (I have reproducibility details, please contact me) but really, the onus for that was on them and not him.

Re:Take it public

[jovius]

Incidentally I was just reading about the issue... Market research numbers from last year.

$5000 - $30,000 Adobe Reader
$20,000 - $50,000 Mac OSX
$30,000 - $60,000 Android
$40,000 - $100,000 Flash or Java Browser Plug-Ins
$50,000 - $100,000 Microsoft Word
$60,000 - $120,000 Windows
$60,000 - $150,000 Firefox or Safari
$80,000 - $200,000 Chrome or IE
$100,000 - $250,000 iOS

Re:Take it public

[Anonymous Coward]

Exactly. I once reported a bug which caused corruption of Linux configuration files. A simple change through an approved interface would eventually cause the keyboard to stop working because a configuration file was corrupted, making even rebooting a problem. I even got my company IT department involved to figure out what was going on. (The discovered the corrupted configuration file.) To recover it seemed the only path for me was to reinstall the OS. I'm not a Linux developer at all, just a victim of the bug, but I wanted to be helpful. I spent about 10 hours over several days attempting to reproduce the bug and eventually got it down to a series of steps with a 70% likelihood of causing the problem. I decided to report it through proper channels ... do A, B, and C and notice that this file is corrupted at this location. I figured I'd given someone enough information for a knowledgeable person to act on and was kind of proud of myself for going out of my way to help instead of just ranting about the horrible state of Linux.

The result was a message from the development team asking me to take the bug and work on a fix. When I responded that I wasn't in any position to do that I got a nasty "won't fix" status on the bug an a sarcastic remark that "that's the way the community works. If you want a bug fixed then you have to be willing to work on it yourself."

l figured the time I had put in to reproduce the problem and report it was my contribution. I don't know if it ever got fixed. I don't care. /rant

TL:DR When someone reports a bug and gives even the slightest details of how to reproduce it or indicates the consequences of the bug are serious, don't just slap him in the face and tell him to get lost. If you need more information then ask for it.

Re:Take it public

[freezin fat guy]

They don't follow up on anything, I checked.

Nobody enjoys following up on things in which they have absolutely no interest.

Facebook have proven exceedingly reliable at not caring about their user's security or privacy.

Having living proof of a hack is especially annoying because it actually forces them to respond and improve user security. Fankly, I'm surprised they are pressing charges.

Re:Take it public

[tlhIngan]

No, not almost invariably. Invariably. You always follow up on security hole bug reports. Always. If you do not do this, you are incompetent. Assuming this security researcher gave them a reasonable amount of time (the summary here doesn't say), then this is once again a demonstration of Facebook talking "secure" but implementing the opposite, hyping their bounty program while refusing to pay out.

For that matter, you should always follow up on non-security bug reports unless they're obvious garbage (e.g. porn site spam submitted to your bug reporting page by a bot). But security bugs? There's no excuse for not following up on those. Ever. EVER.

Except that most are bogus. Yes, bogus.

Imagine you're Facebook and you're getting piles of "I can post on someone else's timeline!" Well, you can be 99.999% of those cases are probably one of user error - as in, the user reporting it could do it because the permissions said so.

Likewise, Microsoft probably receives a bunch of equally annoying reports of "If I do X, I could do Y and HAXXOR!". Except X requires admin priviledges, in which case you're doing Y as admin and yes, that's expected behavior when you're admin. In fact, instead of doing Y, if you can do X, just do HAXXOR and you're done and save yourself the effort. (A surprisingly large number of reports involve either getting admin as a prerequisite or having it already).

And unfortunately, when you get thousands of such reports an hour by "security researchers", you need something to do first round culling of the bogus from the possibly requiring investigation.

Re:Take it public

[fzammett]

Exactly, and I'm surprised people are arguing anything but this. Even for a report that you completely believe to be bogus, what time does it take to reply "hey, can I get more info?" Best case, it WAS bogus, and you never hear from the person again. You "wasted" all of 30 seconds. For a company like Facebook, that should be a trivial investment when the downside of an ACTUAL security problem is so bad. Assuming the report that they didn't reply in any way is accurate, then THIS is where Facebook fell down worst, and it's what is inexcusable.

Re:Take it public

[dgatwood]

Basically all he did is say "I posted to someone's timeline, this is a bug" and linked to the post he made. He didn't explain anything.

Bzzt. If Facebook's logging weren't broken, that should be all they need. The existence of the post itself, having been posted to a wall where he should not have been allowed to post, should have been enough to determine trivially that the bug was real. Further, the post's database record should contain the posting IP address and the ID of the server that handled the request. From there, they should have been able to look at the server's request logs to determine precisely how the attack happened (assuming the researcher was using a structurally valid URL in the request, as opposed to exploiting a null character handling bug in the web server itself).

But even if they looked at the logs and couldn't figure out what happened, IMO, it is still completely unacceptable to just close a bug like this. It's one of those bugs that, if real, is borderline catastrophic in scope. You do not close a bug like that as "cannot reproduce". You contact the originator and say, "Hey, can we get more information about this? We need to try to reproduce the problem."

It's sad that it takes somebody posting on the CEO's Facebook page to get the attention of Facebook's security staff. This means one of two things: they are grossly mismanaged or are woefully understaffed—probably the latter, IMO. Either way, it tells me that Facebook does not take security seriously enough. If bug screeners do not have time to properly follow up on bugs that are this severe, then they need to double or even triple the number of screeners.

Also, this brings into serious question the way that Facebook screens bugs in the first place. Where I work, a bug like this would have been tagged as a security bug the moment it came in. This causes additional people to review the bug, significantly reducing the likelihood of a serious mistake. Closing the bug without asking for more information strongly suggests that a single, hopelessly overworked individual made a mistake, and that the company as a whole failed to have proper processes in place to ensure additional review that would otherwise have caught that mistake quickly and followed up with the original reporter. Not good. Not good at all.

And as long as I'm criticizing Facebook's security practices, IMO, a service like this should have several publicly visible, official security testing accounts for precisely this purpose, with various restrictions on various posts, etc. so that security researchers can properly hammer on their site's security. For example, there should be an official test account that looks an awful lot like Mark Zuckerberg's account. If a researcher is able to post on the wall of that account, there can be no doubt whatsoever about the fact that a bug exists. Likewise, there should be more complex accounts with various security settings, complete with a list of that content and the expected behavior (e.g. you should not be able to read the barcode image entitled "nude_selfie_for_my_boyfriend.jpg").

In short, I suspect there's plenty of blame to go around for this error. What matters is not who gets blamed, but rather how Facebook fixes their processes to ensure that such mistakes do not get made in the future. And I would emphasize that this does not involve firing anyone. People make mistakes. That's why processes are supposed to be designed to mitigate those mistakes. A company like Facebook is big enough that they should know this. If they don't, then perhaps this object lesson will get their attention and cause them to change their ways. If not, it's time to run, not walk, to a competing service.

Either way, what the researcher did was IMO wholly appropriate. He initially performed the smallest attack that could potentially have proven that there was a flaw. When the first report was casually dismissed, he then escalated that attack,

Re:Take it public

[dgatwood]

Imagine you're Facebook and you're getting piles of "I can post on someone else's timeline!" Well, you can be 99.999% of those cases are probably one of user error - as in, the user reporting it could do it because the permissions said so.

Even if you're right, and 99% are bogus, there's no excuse for having a process where you choose "Not a bug" instead of "Need more information" with a request for steps to reproduce. That should be drilled into employees as the only valid response until they are relatively certain that the problem was user error. This culling was premature; you must assume that the bug *might* need investigation until it is clear that it does not. Anything less is negligence.

But the bigger problem is that there's no good way for Facebook to be certain that it wasn't user error unless the account is known (by Facebook) to have settings that should have prevented posting. That's what makes the CEO's page an obvious choice. IMO, there's also no excuse for a company the size of Facebook to not provide an account that is preconfigured to not allow posts so that if a researcher successfully posts on it, the subsequent security bug report has automatic credibility (and, hopefully, additional logging by Facebook's servers, immediate reaction from their security response team, etc.). Perhaps call the test account Zark Muckerberg.

Re:Take it public

[Frobnicator]

Assuming the report that they didn't reply in any way is accurate, then THIS is where Facebook fell down worst, and it's what is inexcusable.

Seems like Facebook employees forgot the reason they pay for the bounty program in the first place. It is to provide an incentive to report it to the company rather than reporting it to the black market for exploits.

A few seconds on Google will show the going rates of black market zero-day exploits for various services. Facebook was offering $500, but now won't pay. Black market rates he can still get about $40,000. (Note that $500USD is a year's salary in most of Pakistan.)

If he doesn't have the ethics, or if he really wants the money and thinks being in Pakistan makes him outside Facebook's reach, he can still get about 80 years' salary ($40,000) on the black market.

Re:Take it public

[Krojack]

I'm a programmer and it really depends on the severity of the issue. Without steps to reproduce, finding the cause of an issue can sometimes be like finding a needle in a haystack. So, if it's not a big deal, it's not worth the effort.

Oh hell yeah. So true.

I had a client keep reporting about a problem with their web page. I along with no one in the office could reproduce it. Seeing as the client was in town, I went to their office and was able to reproduce the problem. Turns out it was an extension they had installed. I told them to disable all extensions beforehand and they said they did. Lets say they ended up paying a hefty service fee. They tried to dispute it but failed.

Re:Take it public

[dgatwood]

They simply do not have the time or manpower to respond to every last report of "I can haxxor" or "I was haxxored and they keep doing it".

The latter is almost invariably a problem with the user's computer, and even if it isn't, there's no possibility that the user has enough information to be helpful. However, Facebook should have the ability to flag what appears to be your own post when reporting a problem, and Facebook should at least take the time to determine whether the post occurred through password compromise, from a third-party FB app, or appears to have been actually posted by that user from a computer that had a valid cookie. Then, the system should send an automated message to the user indicating how he/she can protect him/herself from that attack in the future. This process could be entirely automated, giving the user the ability to follow up only in the case of a third-party FB app having made the post (which is likely a real security bug, or at best, an app developer violating the developer TOS).

Also, pay attention to the section which states that you are supposed to use a TEST ACCOUNT to reproduce the problem, not hack the Big Z's timeline.

Which he did, and they dismissed his bug report, so he took the only step that he thought could prove, in FB's eyes, that the flaw was legitimate.

What I find particularly interesting is how many ACs are defending Facebook in this. It almost makes me wonder if there's an astroturfing campaign going on, either officially or unofficially, by employees of either FB or a third-party firm hired to defend them. Just saying.

Re:Take it public

[HiThere]

Sorry, but that's wrong. You are ignoring scalability.

OTOH, they should have responded by setting up an account with good logging, etc., and asked him to demonstrate by posting to it's timeline. And THAT should give them enough information.

As a second thought, that account should be a template that they can easily and quickly run up "as needed". Because I'm sure they get many such reports, and they probably always respond to them in the same way.

Won't pay?

[schneidafunk]

Seems to me that Mark is just pissed at being embarrassed, there really is no justification for not paying him. He submitted the bug to their security team first before exploiting it in a harmless way.

Re:Won't pay?

[Nerdfest]

Perhaps they should pay him extra and thank him ... he could have done much, much, worse, and from a dummy account. He quite obviously wanted to help. Being a dick to people trying to help you is not a great way to encourage others.

Re:Won't pay?

[schneidafunk]

Exactly. You raise a good point, he used his personal account, which ended up getting suspended.

Re:Won't pay?

[afidel]

Ding! Next time maybe he sells it on the black market instead of trying repeatedly to inform a company that obviously doesn't give a crap about security.

Re:Won't pay?

[IronOxen]

Actually, he also exposed a bug in the bug reporting system that prevents it from responding to and or acknowledging the exact type of vulnerabilities it was designed to find. It was obviously repeatable since the vulnerability was reported twice and was ignored both times. He should be paid for that one as well.

Re:Won't pay?

[Nemesisghost]

So you are saying they should pay him and thank him, because he committed a worse offence than he did?

Yes. He tried to use their own method for reporting such problems. If he had just hacked it outright before telling them, then that'd be a different story. But when a company fails to use the information provided to them from their own communication channels, especially when it seems that they did so to screw someone out of a reward, then they deserve what they go & should still pay up.

Re:Won't pay?

[Chris Mattern]

No they aren't, because *finding* a security flaw is not the same thing as illegally *exploiting* a security flaw. If you need a proof of concept, you can hack your own account.

Re:Won't pay?

[Redmancometh]

Okay better put: when hackers seek vengeance they have the means to wreak havoc. An a huge number of them revel in the opportunity.

Re:Won't pay?

[ArhcAngel]

Hacking into someone's account is a criminal offence.

It was not hacking since Facebook said themselves it was not a bug. Therefore it must be a feature and taking advantage of a feature is not hacking. Now if someone were to take advantage of that feature on my account I would sue Facebook for providing said feature and point to their own forum as evidence.

Re:Won't pay?

[Nidi62]

How is a Palestinian going to get arrested by Pakistani authorities?

Re:Won't pay?

[Opportunist]

Vengeful? Oh please. But next time he might sell it to someone else.

There's no shortage of parties interested in 0day exploits for FB...

Re:Won't pay?

[Opportunist]

*gasp*

That they are interested in protecting their assets! Imagine someone could come and siphon away all the info without paying them!

Re:Won't pay?

[parkinglot777]

Well, you should not overlook that there may be other factors involved in these parties...

The bug reporter
1)Did he describe how to reproduce the bug step-by-step?
2)Did he describe the set up to reproduce the bug in detail?
3)How understandable was his email to native English speakers?

The FB team
1)How many similar bug reports do they get each day?
2)What the procedure do they use in bug investigation?
3)How much concern they have to each bug report?

1st email:
the bug allow facebook users to share links to other facebook users , i tested it on sarah.goodin wall and i got success post
http:

2nd email:
of course you may cant see the link because sarah's timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority .
this is a picture shows that post :

Now, your reply assumes that the bug reporter clearly explains how to reproduce the bug. What I see from his blog post that the first email is only the "result image" of what he did which cannot be a proof! Why? You should be able to answer that if you know any photo editor software. The second email is not much better than the first. It added a little more preparation to reproduce the bug, but it is still too vague. This is a type of "bug report" from an end user who does NOT understand what "step-by-step" is.

Being said that, you also assume that the FB team has nothing to do at all. There is always a reason for whatever one does; however, the reason may or may not be acceptable to the general public. At least, you need to put yourself into other's shoes in order to understand it better. The work load of validating bug reports could be a lot more than you think. When monetary system is involved, there are always some people who attempt to exploit the system. In this case, I guarantee that there are plenty of fake bug reports sending to their team. When you have seen a lot of fake bug reports and you need to invalidate them, you would likely be sceptical toward any bug report at first. If there is no step-by-step procedure in place, you may apply the simplest way to deal with -- in this case attempt to post something on someone else's time line that is not in your friend list. Then the second report said you have to be a friend of the person. You may assume that it is not a bug because the person is in your "friend" list, and that you have permission to post on their timeline (assume that the person permission is set to allow friends to post).

Anyhow, I do blame both sides. I blame the reporter because he gave an incomplete bug report which makes sense to him but not others at the time. Then he escalates his action and steps over the line. I blame the FB team because they did not scrutinize on every single bug report but rather make an assumption in order to do less work. If I were to judge this, I would not reward the reporter still because of his second action (steps over the line). I hope that the reporter loses his attitude and learn from this situation that he should be more professional in the field. The mistake he did (now) is not serious but rather excellent experience for him to be more clear and careful in the future.

PS: For those who said why he did not use a dummy account to do the test, I half agree. Seeing his blog, it seems that he does not know how to disguise his connection on the Internet, using a dummy account does not help...

Re:Won't pay?

[afidel]

Considering that Instagram followers and Likes are worth more than credit card numbers on the black market I'd assume the ability to manipulate timelines would find some significant value.

Re:Won't pay?

[t0y]

He linked to the post in goodin's wall that shouldn't exist. If a server is on fire you don't need steps to reproduce to prove that something's wrong.

I'm Amazed...

[DexterIsADog]

...people are still using Facebook?

That's a catch 22

[i kan reed]

Post what you know to their white-hate system: not reproducible with that information. No money.
Reproduce it yourself: violating TOS. No money.

Re:That's a catch 22

[Nerdfest]

Sell it on the open market, plenty of money.

Re:What next?

[Rob the Bold]

So is he going to respond by firing some rockets at them?

WTF? Zuck's got a private army now? Maybe he got some Predators as a thank-you gift from the NSA.

Not worth it

[phantomfive]

Facebook has a policy that it will pay a minimum $500 bounty for any security flaws that a hacker finds.

That's absolutely not worth the money. He's better off taking the publicity he got from this and turning it into a high-paying job.

Re:$500 is a lot of money

[phantomfive]

Have you looked at Facebook's stock recently? It's getting close to the IPO price.

Re:$500 is a lot of money

[camperdave]

Underware? Is that some sort of page 0 TSR, or BIOS xploit, or something?

Re:Devil's Advocate

[bill_mcgonigle]

As for not paying him, aren't these bug bounty systems meant to foster responsible disclosure? I'm pretty sure leveraging an attack you found does not count as such.

It's not 'leveraging an attack' when it's demonstrating the veracity of the claim, to a higher-up employee's wall because the lower level employee ignored you. If there's a problem with his behavior it's that he first posted on the wall of a friend of Zuck, who is not an employee and outside the bug reporting transaction. That was stupid, but a post to Facebook Security's page seems like fair game to demonstrate a problem.

That said, his bug report was complete shit and barely distinguishable from spam. How can he have an IS degree if he can't even write a decent bug report?

A great way to alienate the white-hat community.

[fuzzytv]

Good work, Facebook! Kinda resembles what happened at GitHub ~18 months ago: http://www.zdnet.com/blog/security/how-github-handled-getting-hacked/10473

If someone from Facebook reads this, and it's TL;DR; here are the next steps:

#1 apologize to the guy, acknowledge he reported the issue twice
#2 reinstate the account and pay him his reward
#3 fix the damn issue

Re:Guilty of being Palestinian

[Chris Mattern]

$0. They didn't give him money becuase a) it was a shit bug report and b) corporations are innately averse to giving out money to *anybody*, even if there's a policy saying they have to. Palestine has nothing to do with it.

Re:A great way to alienate the white-hat community

[Skapare]

#4 fire whoever is responsible for him being ignored.

Cheapskates

[Anonymous Coward]

Refusing to pay because it violates terms of service? Wait wait, I'm now convinced all my online details are safe. Afterall the terms of service protects me from dishonest hackers, right?

Re: What next?

[CanHasDIY]

Yes, Preditors are often overlooked. Just cover yourself with mud and smash them with a log and you'll be fine. Or stay out of the jungles which is their primary habitat.

Tell that to Danny Glover.

Re:500 USD?

[Impy the Impiuos Imp]

$5000 would be a better starting bounty. What are they expecting, 100,000 bugs?

Re:Minions!!!

[Opportunist]

To get to the corporate morass, they certainly wouldn't have to decline...

Google has a much better bounty program...

[slashkitty]

They pay $7,500 for an XSS bug, more for more serious bugs. Facebook better think about their program before a more serious bug is made public or exploited privately.

Re:Not worth it, possible troll

[phantomfive]

FB is so for iPhone using grandparents that even their engineers don;t take threats seriously... really is anyone still using that thing?

You should check it out, you'd probably like it. With grammar like that, you'd fit right in!

Re:500 USD?

[Entropius]

Probably. Have you ever used Facebook? It's buggier than an entomology lab.

Re: Very different...

[dannys42]

That's a very good point. Bug tracking systems (public and even private) should also have a way to track the reliability of submitters. I've been with the open source community since before "open source" was a phrase, and sadly from what I've seen, the community still seems to lack an understanding of the human side of things at pretty much all levels. And from how GNOME has been shaped through the years, it only seems to be getting worse.

Re:Jordan

[Minwee]

There is no website that has a good security

Nonsense. My web site has perfect security. OK, it has zero reachability, but hey, you have to pay a price. ;-)

Ahh, the "Switched off and unplugged locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards" security model. A wise choice.

Not enough technical info? So... get some more

[FuzzNugget]

I can buy that the submitted report "did not have enough technical information" to take action, but your response is ... uh, eh fuck it?

How about you follow up by contacting the submitter for more information.

$500 bait

[LoRdTAW]

Hacker: I found a major exploit in your system. Here are the details.
Facebook engineers: (to themselves) Shit, he may be right but we can't reproduce it and we don't want to get into trouble. Just sweep it under the rug.
Hacker: I filed a major bug report and you didn't respond, here are more details in case you needed more help.
Facebook engineers: (to themselves) Oh fuck. That is going to be a lot of work to fix. File this one under the rug again. I hope I get a better offer from Google or Apple before the shit hits the fan.
Hacker: (hacks Zuckerberg's account) That will get their attention.
Zuckerberg to FB engineers: WHAT THE FUCK! How did this happen! I want answers now or heads start rolling!
FB engineers: Shit Shit Shit Shit Shit... contact that guy and see what he did ASAP! Oh god oh god oh god..........
Facebook/Zuckerberg: This is a major embarrassment but I still don't want to give that little bastard any credit for exposing our laziness. Reward denied.

Re:Devil's Advocate

[dgatwood]

How can he have an IS degree if he can't even write a decent bug report?

Most universities (even in the U.S.) don't teach that skill. I'm not at all surprised. Even many fully employed software developers write terrible initial reports. My experience has been that on average, bug reports go back to the originator a couple of times just to collect the basics, and that's not including the number of times that the engineers bounce bugs back with suggestions like "Try [x] and see if that works" that are intended both to help the person get up and running and to determine the scope of the problem more fully.

Re:This is so bad

[dgatwood]

This. As soon as a bug bounty program is shown to not actually pay out when a real security flaw is found, it becomes a worthless program. From now on, instead of telling Facebook, the not-insignificant percentage of hackers for whom the bounty was the only reason to report it to FB will simply disclose the flaw immediately, resulting in a significant reduction in the site's security for everyone.

BS..

[SuperDre]

Have you people actually seen the email-conversation between him and facebook?
Well if you have, you know HE is just a moron for making it public as he didn't send facebook a step-by-step on how to recreate the bug, all he did was say 'he I can post a message on someonelses wall without being a friend'.. and after facebook asked some details all he did was post a link to a post he made.. the man is a moron, if he's a "security researcher" then he should at least know how to do a proper bug-report.. Facebook get's so many fake bug-reports (with photoshopped images) from people who hope they can get a bounty..

Unjust Enrichment

[Sentrion]

IANAL, but this case sounds like it might be a good candidate for an unjust enrichment lawsuit. If Zuckerborg refuses to pay the $500 bounty on the grounds that FB terms of use were violated, then shouldn't they pay the hacker "fair market value" for identifying the bug? After all, FB openly solicited bug reports from the general public with a promise of compensation. And did FB not implement new safeguards after they found out the exploit was legitimate, as evidenced by Zuckerberg's hacked page?

If my neighbor hires a painter, and the painter paints my house instead of my neighbor's house, and I stand by and watch the painter work on my house without informing the painter he is working on the wrong house, then I am obligated to pay the painter the amount he would have charged my neighbor for the work performed. Absent any written agreement, the amount due would be based on the fair market value of the labor performed plus a generally accepted markup for the cost of materials.

So now I'm curious, what would be the fair market value for finding an exploit that would allow a hacker to alter Mr. Zuckerberg's own FB page? Given that the IRS can tax certain unsaleable items based on "illicit market" value, could the "street value" of Mr. Shreateh's findings be considered for valuation given that there is no "fair" market value, since such a value implies that there exists a market, meaning more than one possible customer legally able and willing to make an offer for such findings?

Read more: http://lancasteronline.com/article/local/607346_IRS-values-stolen-or-illegal-items-at-black-market-rate.html#ixzz2cRIxNEoC

haxormania

[hesaigo999ca]

Mark considers himself a haxor, so do many others that use his app. Some are smarter then others, this one proved he was, and went so far as to show the creator of facebook he was, instead of 500$ , I would have asked for a job, and some cigars, love those cigars, and maybe a bottle of tequila.... but never money!
Its the principle of it all

CNR

[The Grim Reefer]

This XKCD seems appropriate. The first time I saw it I almost fell out of my chair laughing. At my previous company I practically had to write a doctoral thesis to get simple obvious bugs fixed.

bullshit

[shentino]

He reported the bug BEFORE he violated the facebook TOS.

So Facebook is just using the TOS violation as an excuse for *retroactive* denial of the bounty *he had already earned*.