Slashdot Mirror

← Back to Stories (view on slashdot.org)

Facebook's Biggest Bounty Yet To Hacker Who Found "Keys To the Kingdom"

Posted by timothy on from the yeah-let's-talk dept.

mask.of.sanity writes "Facebook has paid out its largest bug bounty of $33,500 for a serious remote code execution vulnerability which also returned Facebook's etc/passwd. The researcher could change Facebook's use of Gmail as an OpenID provider to a URL he controlled, and then sent a request carrying malicious XML code. The Facebook response included its etc/passwd which contained essential login information such as system administrator data and user IDs. The company quickly patched the flaw and awarded him for the proof of concept remote code execution which he quietly disclosed to them."

5 of 111 comments (clear)

  1. Wow by Anonymous Coward · · Score: 5, Insightful

    Stingy reward. That would have fetched quite a bit more on the black/open market.

  2. Re:Crime does pay by sandytaru · · Score: 5, Insightful

    Yes, but now he's got a couple of white hat security firms considering offering him more than whatever he's making now, without the risk of jail time to boot.

    --
    Occasionally living proof of the Ballmer peak.
  3. /etc/password or /etc/shadow? by Nimey · · Score: 5, Informative

    All /etc/password contains on a properly configured modern system is userid, login name, login shell, and home directory. /etc/shadow is where the hashed passwords are stored, readable only by privileged accounts.

    About all /etc/passwd gains an attacker is a list of good login names.

    --
    Hail Eris, full of mischief...

    E pluribus sanguinem
  4. Re:/etc/password, not /etc/shadow! by Nimey · · Score: 5, Interesting

    And, let's be honest, /etc/password sounds scary, and is probably the most attention-getting thing this guy could have said to the average person.

    --
    Hail Eris, full of mischief...

    E pluribus sanguinem
  5. Re:Crime does pay by vux984 · · Score: 5, Insightful

    $33,500? He probably could have gotten WAY more on the black market. This is ultimately the problem with stingy bug bounties.

    How is it a problem?

    Its a fact of life that we are daily confronted between the choice to do the right thing and the choice to screw someone over for money.

    My neighbor went on vacation, they gave me the keys to the house to water the plants, and bring in her mail. I could turn a tidy profit passing the information that the house is empty to a ring of thieves, steal her identity, and strip her car.

    Or I can just water the plants and usually receive a bottle of wine or other small thank you gift.

      I had the 'keys to her kingdom', and she repaid my responsible behaviour with a token. Should I complain she's being stingy, and call it a huge problem too?