Slashdot Mirror
Security Community Raises $12k For Researcher Snubbed By Facebook
Trailrunner7 writes "Like most major Web and software companies, Facebook receives a lot of bug reports. And since the company started its bug bounty program, security researchers have become even more interested in looking for vulnerabilities in the Facebook ecosystem. But, as one researcher learned recently, not all bugs are created equal, and Facebook doesn't like people messing with its users – or its executives. That researcher, Khalil Shreateh, discovered a bug in the Facebook platform that enabled him – or any other user – to post comments on the walls of other users who aren't their friends. That shouldn't be possible under normal circumstances, so Shreateh reported the problem to Facebook through its bug bounty program, hoping to earn a reward from the company. Instead, the company told him he didn't provide enough information. So Shreateh went a step further and demonstrated the technique by posting a message to the wall of Facebook founder Mark Zuckerberg. On Aug. 19, after details of the incident became public, Marc Maiffret, a well-known security researcher and CTO of BeyondTrust, started a crowdfunding campaign to get Shreateh a reward for his work. As of Aug. 23, that campaign has raised more than $12,000 and Maiffret is in the process of transferring the funds to the researcher."
nothing more to say
And when it reaches a certain level, Facebook may swoop in with their lawyers and claim that it can block him receiving them back it's money earned from a technically criminal act.
I'd be interested in seeing his report, to see if he really did provide enough info or not on the bug. For $12K you ought to take the time to be pretty thorough in providing a reproducible bug report.
Congrats, and Facksh** can go get fuc**d.
They are so worried about users being hacked and attacked they ignored this bug. And posting it on Mark Fu**rberg, wasn't enough to motivate him to take this "bug bounty" more serious. This isn't a shock, getting hacked on Facebook is a pretty daily occurrence, but if users that have been hacked took there complaints to a blog, or even if some would create a site popular enough for these complaints to be publicly and widely exposed you'll see a quick turn around in how serious they will take the bounty program, and there neglected users....
Not trying to play devil's advocate here but any vulnerability researcher must understand that finding flaws is only half of the job. You must also be able to successfully explain and make understand each flaw to even non-technical people or your work is somewhat worthless.
Now it's true that one can expect a reasonable technical skill from the Facebook person reviewing your bug submissions, but they also, as they stated, go through a lot of invalid and spurious submissions a day.
So in case you are hoping for a reward, you better make your submission as clear as possible before going mad and go public. Also you should at least retry and send additional details before giving up on them (reports do not mention whether the researcher "repeatedly" tried to explain the vuln to them.
IMHO the lack of patience from the researcher illustrates he really does not care about making Facebook (or anything) more secure. Only money drives him. This is perfectly acceptable but no quite the image for raising money as if he were a true whitehat.
---------
Thinking never hurt anybody --MacGyver
Dude is going to have running water and good food for the first time in weeks.
That's a contradictio ad absurdum.
This must be seen as an absolute failure of Facebook's PR department. As soon as this story hit the tech media, they should have reverted the decision and paid him and excused. This is a serious hit to Facebook's standing as a good workplace. What would you feel as an employee in this situation?
I am now not sure what the word "researcher" mean? The link for the campaign page mentioned about "independent researchers." However, the summary used the word "one researcher." If I correctly recall from his own blog (Khali), he said he is an "unemployed" which is far from a "researcher." Besides, he happened to stumble on the security issue. This does NOT mean a "research"! This web page is simply to get "attention" from people in the community and should NOT be posted on ./ at all. The campaign owner guy, Marc Maiffret, is tainting real independent researcher's name...
Obviously the large corporate machinery at Facebook has caught and chewed up some very nice researcher, and the community once again comes in to right the wrong.
The problem is, by third parties paying him, it sets a precedent for rewarding Facebook's bad behavior. Make no mistake - the same idiots that refused the payout and who whitewashed it by claiming a ToS violation will be the same ones watching this effort and wondering how much more they can get away with.
Ultimately, this is bad business practice for Facebook because this strategy will devolve into grey hats and black hats going for the jugular every time, and less white hats trying to do the right thing. Or maybe this just means people will realize on their own what I keep telling them - avoid using Facebook wherever possible. That will, unfortunately, be found out the hard way during the next big publicized data breach.
Looks like it would be better to just sell to umm someone rather than try report to facebook for $500.
How much of that is "Screw you, Facebook" dollars?
One one hand, as he says he could've made a ton of money selling this hack to a spammer and ended up harassing MILLIONS of users. On the other hand, hacking a CEOs account isn't the most diplomatic or responsible way to handle the situation and it sounds like his English is a little rough. If you're a locksmith, staging a break-in probably isn't the best way to get a bank's business.
I swear to God...I swear to God! That is NOT how you treat your human!
He posted his "bug report". It was a few words, just saying "there is a bug" with no hint of what bug or what the exploit could possibly be. It then had a broken link to an uninteresting post, a post that was private.
To my mind, it doesn't even qualify for the complaint department, much less was it anything close to being a proper report of a security issue.
Further, in response to Facebook comments pointing out that his message was very hard to read due to the pre-school level grammar, spelling, and use of capitals, he said "don caar nver fic red undrlin words" (or something to that effect), so he KNOWS his messages are nearly unreadable and he "don caar". If I get a message where the spelling is completely wrong, the grammar is completely wrong, and the use of capitals is completely wrong, I'd probably suspect that the claim is completely wrong as well.
It is a sophisticated surveillance tool anyway. Also, sort of a part time job you don't get paid for.
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE
I hope they take part of that money and set it up as a reward for publically disclosing Facebook vulnerabilities online.
That way those security researchers can still get some kind of a reward if Facebook doesn't take them seriously.
And, more importantly, Facebook will be forced to take them more seriously in the future.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
that 12K should cover at least some of the court costs and fees.
He "exceeded his access privileges" or whatever the language used in the CFAA is. The CFAA is so loose that I would surprised if he didn't violate it somehow in doing this.
And you know what, you morons who modded me flamebait, I don't think it should be considered a legal issue. However it probably is a violation of the CFAA and courts tend to look very favorably on taking away any funds that appear to be proceeds related to a crime. Heck, prisoners are often blocked from selling media rights to their stories so they cannot profit.
Had Mr. Shreateh not been Palestinian, I'm forced to wonder if Mr. Facebook's reaction would have been different.
The bug report can be found on the reporters blog:
http://khalil-sh.blogspot.ru/p/facebook_16.html
It's actually pretty shitty and does not even explain anything. Facebook had nothing to go off of except a basic description. The summary of this article has more detail than the reporter provided to Facebook.
Except that this "bank" explicitly says it will reward people who can bypass the lock. I think it is more like " If you're a locksmith, staging a break-in into the director's office probably isn't the best way to get a bank's business."
Except that facebook doesn't have a designated "safe" target. Pardon the pun. XD
Hearing an average Americans sentiments towards America. I cannot imaging the vitriol that would come from someone in that part of the world.
This has been true since the late 80s, see the Computer Fraud and Abuse Act.
Thanks for that link.
Facebook isn't going to pay money if someone tells them there's a bug. They know there are plenty of bugs. They are going to pay if you give them information that helps them fixing a bug, and what he posted didn't help them in any way.
Yes, a system admin could use administrative powers to log in as the target user and would have seen a random youtube video posted on somebody's wall. Which demonstrates nothing without an explanation of what it's supposed to demonstrate.
To the helldesk graduate reading his message, and to anyone else, it was a broken link - an error saying "no such page".
The Facebook rep should have asked for further information - and that's exactly what they did.
....it was inserted on $Date and should....
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Basically, Facebook already knows about these type of "bugs", people should NOT be using Facebook.