8 ms·
How I got a $3,500 USD Facebook Bug Bounty
- tommi 14y agoI bet Blackhat Vulnerability Program would've payed lot more.
- kmfrk 14y agoOf course it would. That's the idea of blackhat.
- lucian303 14y agoYeah, the OP is a really nice person. Because FB doesn't deserve this, not for $3.5k, maybe for $35k but more for around $350k to $3.5m. Guaranteed by contract.
- tptacek 14y agoFor XSS? No.
- xSwag 14y agoWith CPA + FB traffic on such a large scale, one could easy make $50k+ in a week with multiple CPA networks.
- tptacek 14y agoKnowing what little I do about the market for browser code execution vulnerabilities, I am very skeptical that there is a black hat market that pays 5 figures for XSS.
- deleted 14y ago[deleted]
- tptacek 14y agoIf you have evidence of a market that pays 5 figures for XSS, I'd sure be interested in hearing about it.
- raverbashing 14y agoDo they give you a CC number you can use as much as you want?
- rmc 14y agoThat goes against some people's conscience and they would find it immoral to do the wrong thing. (i.e. you won't get that warm fuzzy feeling of doing the right thing with the blackhat market)
- killahpriest 14y agoWhenever people teaching others about security mention XSS, I've always wondered does it really even happen in the real world? I'm sure everybody escapes their input. Turns out there's a reason XSS is so often mentioned. Even Dropbox and Facebook fell prey to it (although in this case the input wasn't from the web, but rather from their desktop application/service partner).
- reginaldo 14y agoI recently found a pretty simple one on https://accounts.google.com/ https://accounts.google.com/, which is arguably Google's most valued domain. I believe XSS is the most common vulnerability these days. One doesn't even have to be able to inject javascript per se. Only a CSS style is enough in many cases.
- TomAnthony 14y agoThe bounty for that page is ~$10k or such, no? Did you get anything?
- reginaldo 14y agoActually it is $3133.7 (eleet). I got it, of course. The security team at Google is, simply put, awesome.
- clockstrikesten 14y agoCSS? I thought that only applied to extremely old versions of IE.
- giulianob 14y agoThe problem I see is that if you aren't using a templating engine which automatically escapes things, people will make mistakes. Even then, there's times that you need to output raw HTML and perhaps end up forgetting to escape the part that was user input.
- 14y ago
- gklitt 14y agoProps to Facebook for being so responsible about fixing this bug. After seeing so many blog posts about companies not responding to emails from whitehats finding XSS vulnerabilities (http://www.troyhunt.com/2012/08/why-xss-is-serious-business-and-why.html http://www.troyhunt.com/2012/08/why-xss-is-serious-business-...), it's comforting to see someone take such reports seriously.
- rmc 14y agoThis is the point of responsible disclosure. Tell the company, wait a week or whatever, if they do nothing, then it's ethnical for you to tell the world.
- shimon_e 14y agoI submitted a report to facebook about privacy setting circumvention. Didn't receive a response. Didn't receive a bounty. Facebook DID fix the bug after some months. Feel a bit cheated that a billion dollar company couldn't take the time to respond... if I had the time I'd follow up with them.
- loceng 14y agoProbably wanted to avoid more flack related to privacy concerns ...
- shimon_e 14y agoIn that case they should have expedited a cheque in the mail. I thought they are offering money so we aren't tempted to sell it to malicious parties.
- aw3c2 14y agoPublish it afterwards!
- ssclafani 14y agoTo report a security or privacy vulnerability to Facebook use their Report a Security Vulnerability form: http://www.facebook.com/whitehat/report/ http://www.facebook.com/whitehat/report/ Anyway else and you risk your report not being received.
- shimon_e 14y agoI did.
- AustinGibbons 14y agoBummer to hear, I too reported a privacy setting circumvention, and I did receive compensation. I think a big part of it is being the first person to report the error.
- arice 14y agoI'm very sorry you had this experience. We would never intentionally ignore a legitimate bug report. If you could send me a message (link in profile) with the e-mail address you used, I'd be happy to get to the bottom of this.
- wilfra 14y agoI submitted an error (and a solution) in their open graph docs that caused a bug if anybody copy/pasted the code from their site. The error was fixed within hours, however I never got any money or even an email :(
- aw3c2 14y agoPublish it afterwards!
- JoachimSchipper 14y agoIt's more of a "security bug bounty". I'm sure they appreciate your fix, but that's not really the point of the program. ;-) (This is quite clear from http://www.facebook.com/whitehat/bounty/. http://www.facebook.com/whitehat/bounty/.)
- tomjen3 14y agoWauw, so all that happens if you save dropboxs ass is that you get a special mention on their special page that very few people know about? Why even bother to tell them then?
- phxrsng 14y agoThey also give you a pretty large amount of storage for life.
- patio11 14y agoThe security community has curious norms for social status, when viewed from the outside. This is true of many communities. (A brief sampling: karma on HN looks crazy to Japanese salarymen. An open-floorplan desk closest to the window looks crazy to an American academic. "Your name, in small print, first among three names in a dead-tree publication that no one reads." sounds pretty crazy to most HNers.) There's very curious mating rituals for selling security consulting. Ask Thomas for the specifics -- he's far better versed in them than I am. Suffice it to say that "I owned X -- here's proof" is very much not of zero value while you're doing that dance.
- tptacek 14y agoWell, one obvious answer would be, "don't bother to tell them". Of course, it's hard to think of what else you might do with a Dropbox web finding. I sort of doubt there's a liquid market in Dropbox vulnerabilities. For one thing, vulnerabilities that do have markets tend to have patch lifecycles longer than "instantaneously fixed as soon as target finds out about vulnerability". You can also choose to publish on your own website. This buys you not a whole lot more than just informing Dropbox, except to signal to the professional market that you will go out of your way not to help people like Dropbox when you find a bug. Nobody in the whole wide world is obligated to do free research for Dropbox. That's not what pages like these are meant to imply.
- tomjen3 14y agoThanks for the illumination. I don't have any specific issue with dropbox, I am just tired of doing free work for coorporations in return for a small increment in some integer in some databse (hn, reddit or /. karma) when that. Increment isn't worth either money nor is going to get me laid.
- pera 14y agoI submitted a critical vulnerability (session hijacking), they asked me if I'd some solution in mind, I give them my solution, they never contacted me again. I'm pretty sure they do the same with 99% of bugs reports, the 1% is just for having people publishing articles like this one to get attention from crackers so they keep sending reports. If you're looking for money (or even a simple "thanks") don't go to the facebook whitehats bs.. just post it on full-disclosure or whatever...
- jbverschoor 14y agolol.. I found a bug in paypal which allowed me to transfer funds from one account to another, even though this was prohibited. I got nothing. Maybe next time I'll just post this stuff for random people on twitter to find
- clockstrikesten 14y ago"Next time" is a bit optimistic; I'd suspect this was the only time in your life you'll have ever found a bug that extreme.
- robmcvey 14y agoBAM!
- tokipin 14y agowait facebook has like millions of bugs -.- though maybe UI glitches aren't considered bugs