Slashdot Mirror
'I Hacked Facebook -- and Found Someone Had Beaten Me To It' (theregister.co.uk)
An anonymous reader shares an article on The Register: A bug bounty hunter compromises a Facebook staff server through a sloppy file-sharing webapp -- and finds someone's already beaten him to it by backdooring the machine. The pseudo-anonymous penetration tester Orange Tsai, who works for Taiwan-based outfit Devcore, banked $10,000 from Facebook in February for successfully drilling into the vulnerable system. According to Tsai, he or she stumbled across malware installed by someone else that was stealing usernames and passwords of FB employees who logged into the machine. The login credentials were siphoned off to an outside computer. According to Facebook security engineer Reginaldo Silva, the password-slurping malware was installed by another security researcher who had earlier poked around within Facebook's system in an attempt to snag a bug bounty.
May as well exploit the the machine for a while before revealing the bug.
“He’s not deformed, he’s just drunk!”
http://www.nirgoldshlager.com/2013/01/how-i-hacked-facebook-employees-secure.html
It amazes me that despite all of their problems, so many companies still trust Accellion. I think our installation was $50k.
If the universe is indeed a clever simulation, are you now discovering a hack with a hack in a universe that's been hacked and hacked until it resembles an infinity mirror?
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
$10,000 is peanuts for the login credentials of a ton of facebook employees.
In today's Internet, Facebook hacks YOU!
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Yet another reason why SSH password based authentication is so bad. Both SSH agent forwarding and SSH password based auth are best disabled. Then they can't intercept anything.
According to Facebook security engineer Reginaldo Silva, the password-slurping malware was installed by another security researcher who had earlier poked around within Facebook's system in an attempt to snag a bug bounty.
And this is why I have a problem with this whole "terminology" of the so-called "security researcher". Facts are facts and who ever it was that installed and left malware that "slurped" passwords and usernames clearly was not a "security researcher", but rather a run-of-the-mill hacker , or call him (almost certainly a him) what every you want, but NOT a "security researcher".
If you want news from today, you have to come back tomorrow.
Nope. Hat colour is a sign that the guys using the term have forgotten what it means entirely and are now just as confused as you always were. The problem with the security industry is that it's a bunch of script kiddies. Nothing more. There is no depth at all in the industry anywhere. Hence, no success except make-believe.
They are not hackers in any sense. Not a hacker in the older positive sense. Not a hacker in the "look ma Ima bein k-rad kewl wif ma komputor" poser sense for it no longer means anything at all -- see "hat colour". Not "researcher", since they're just doodling along. Not "scientist" since computer science already isn't and computer security science much less so, amazing how that is possible. (Go on, ask Abelson and Sussman how that works.)
So your use is in fact the "hip and trendy" bullshit, incited by hollywood and breathless but content-free reporting and marketeering, including the "ETHICAL" shouting match and the hat colour shtick. Hacker in the original sense was a meritocratic term, but has been smudged into unusability. Note that anybody calling themselves a hacker already were posers under the old term. We just have many more posers now, o child of '93. Hacker in the "dodgy stuff with a computer" sense always was the tool of the computer-illiterate wannabe, the script kiddie, the poser, the reporter, the nitwit. In that sense, hacker is very meta-useful, for it instantly tells us what you are. We know now, so thanks for that, I suppose.
He got sloppy seconds!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Aren't poking around in a system, and slurping passwords two different things?