Facebook rewarded a 10-year-old for finding Instagram security flaw

http://www.theverge.com/tech/2016/5/3/11579972/facebook-10-year-old-hacking-instagram-security-bug-10k

by vvvv • 10 years ago

233 86 10 years ago

Zeimyth• 10 years ago

It makes me happy to see people who find and report bugs rather than hiding and exploiting them. I'm sure the monetary incentive doesn't hurt, either.

pgrote• 10 years ago

Agreed.

Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me.

Maybe there are more people who sell the exploits and you just don't hear about it as much as people who submit them to the corporations before publicizing them.

charlesdm2• 10 years ago

He's 10. Who is he going to sell this to? $10,000 is probably a gigantic amount of money to him.

k-mcgrady• 10 years ago

> "Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me."

The same reasons people don't steal from shops or commit other crimes:

1. Morals

2. Risk of getting caught and subsequent punishment

tptacek13• 10 years ago

I know, right? $10,000! Facebook is worth billions! Think what the black market might pay for a bug that would delete any Instagram comment!

saalweachter• 10 years ago

What's the marketplace like?

On the seller side, how easy is it to actually get paid? There's no point in trying to sell exploits if you're just going to get cheated, get busted selling to some sort of undercover law enforcement, or just go to a lot of trouble for not a lot of payoff.

From a buyer perspective, you need to have a way to verify an exploit, or else you're just buying a pig in a poke. And you need a way to monetize the exploit, or some other motivation. And you really have no way to know how long your exploit will remain functional.

(Or, you know, people could be basically good.)

tn13• 10 years ago

People do. There is an entire underground markets for exploits, hacked user databases/emails, Amazon AWS keys etc.

phasmantistes• 10 years ago

If you had this exploit, how would you have monetized it? Do you know who to talk to? Do you know where to go on the darkweb to find the people who know the people who have the money to actually pay you for this? Do you know how to negotiate with them to actually guarantee payment? Do you know how much an exploit which can only delete content -- not generate false content, or access ACL'd content -- is actually worth?

Long story short, companies offer guaranteed set-size rewards as a counterpoint to the black market's potential highly variant payouts.

rwallace• 10 years ago

Don't underestimate the value of money that's guaranteed instead of a hypothetical possibility, now instead of maybe sometime, yours free and clear instead of legally dodgy, that you can boast to friends and future potential employers about instead of hiding as a shameful secret.

betenoire• 10 years ago

A bird in the hand is better than two in the bush.

billyhoffman• 10 years ago

Don't underestimate the professional value of disclosing a vulnerability to the company And I don't solely Mean the value of the publicity and the exposure of being public about the disclosure. The security community is surprisingly small. Getting a one off splash story in a rag like Business Insider is nothing compared to building a back and forth with Someone like Alex Stamos.

eli• 10 years ago

If I find a wallet on the ground, I try to return it to the owner even if there's no reward and even if I'm not legally obligated to do so. I'd want someone who finds my wallet to do the same.

rajangdavis• 10 years ago

Off topic, but I once found a Magento SQL database backup from going to a robots.txt page for a company that I will not name. I told them how I was able to get to this file and laid out the other vulnerabilities with their site set up. I had access to all of their customer emails, all of their admin logins, encrypted passwords, and salts. Was able to find git credentials and a whole swathe of information that shouldn't be available...

They fixed the issue pretty fast, but what bugs me is that I didn't get a thank you. I wasn't looking to gain anything, but I figure telling someone that their site is exposed warrants some gratitude.

asimuvPR• 10 years ago

That's why I:

- Stopped reporting anything that is not an issue in the source code of an open source project. I do so in their mailing lists or issue tracker.

- Began to treat random internet bug reports with kindness and gratitude.

dogma1138• 10 years ago

I reported an xss in HP's pronq fortify login screen without getting as much as a thank you.

Fortify on pronq is their SAAS application security scanner for those who were wondering.

morganvachon• 10 years ago

That, and it's great that Facebook offers an incentive to bug hunting, rather than treating the researchers like criminals, as some companies are known to do. I don't care for a lot of what Facebook does and how they do it, but this in particular is awesome of them.

userbinator• 10 years ago

I don't think it's that simple of a decision, or one that could be generalised to all cases. What if you found an exploit that let you break a widespread form of DRM, access normally paywalled information, or gain control of a device that you rightfully own but the manufacturer locked down against you? It really depends on your moral/philosophical stance, but all the money in the world wouldn't make me report any of those. That's why the idea of someone so young already thinking of becoming a "security researcher" bugs (no pun intended) me, because they all seem to inevitably end up proponents of "security that oppresses" in some form or another.

ashitlerferad2• 10 years ago

A recent manifesto around that:

http://pastebin.com/raw/0SNSvyjJ

"Leaking documents, expropriating money from banks, and working to secure the computers of ordinary people is ethical hacking. However, most people that call themselves "ethical hackers" just work to secure those who pay their high consulting fees, who are often those most deserving to be hacked."

topbru• 10 years ago

Any details on how it worked?

ssclafani• 10 years ago

"The problem lay in a private application programming interface (the slice of code allowing certain outside access) that wasn’t properly checking the person deleting the comment was the same one who posted it, the spokesperson added."

http://www.forbes.com/sites/thomasbrewster/2016/05/03/facebo...

randyrand2• 10 years ago

I'm hoping the bug was a little more complicated than just "we forgot to check." That's a pretty dumb mistake to make...

porter2• 10 years ago

Awesome kid, but how was this risk only worth $10k to facebook? Needs a few more zeros behind it.

porter2• 10 years ago

no idea why this is getting downvoted.

tptacek13• 10 years ago

Because it's an extraordinarily silly comment. If Facebook hadn't paid $10,000 for this bug, the next bidder in line would have been unlikely to pay more than $50.

voltagex_• 10 years ago

Perhaps it's because you're being unrealistic? A version of this comment seems to pop up in every bug bounty related thread.

blazespin• 10 years ago

lol: "In 2015 alone, 210 researchers received $936,000 with an average payout of $1,780."

teraflop• 10 years ago

Maybe they mean "average per vulnerability", not "average per person".

azinman2• 10 years ago

Payed out to over 800 researchers? Wow that's a lot of security bugs. I wouldn't have guessed so many were possible. Imagine if they didn't have such a program!

pbhjpbhj2• 10 years ago

Do Facebook face some sort of liability under COPPA for allowing [condoning?] this under 13 yo - I'm presuming without verifiable parental consent prior to use - to use their services?

Perhaps the time for Facebook to fight COPPA (for better or worse) is coming soon?

envy2• 10 years ago

In this case, seeing as COPPA is a US law and the kid in question is from Finland (and thus likely under Facebook's EU subsidiary), I'm guessing not.

pbhjpbhj2• 10 years ago

Anticipating this objection I looked at some COPPA info briefly (I'm in the UK, in not that familiar with USCs) and it suggested that the jurisdiction was based on location of the controlling company or the servers (either being sufficient) and not location of the children accessing the service. That makes sense as otherwise company's could just use offshore servers and bypass the regulation.

Asparagirl• 10 years ago

Meanwhile, Apple remains one of the only big tech companies to not have a bug bounty program.

eyeareque• 10 years ago

what about cisco, oracle, juniper, fireeye, palo alto, etc.? There are more companies who don't than do, hopefully it changes in the near future though.

mrep• 10 years ago

You've forgotten the biggest of them all: Amazon [1].

[1]: I consider them the biggest of them all considering how much of the web is powered by AWS (just imagine if you found an exploit to give you full access to all of AWS), but that's just my opinion.

altoz• 10 years ago

Anyone else see this headline and thought, "Some government gave them a 10-year-old?"

zodPod• 10 years ago

YES lol This was my first thought as well! "Facebook awarded a 10 year old"

ssorallen• 10 years ago

Haha yes, that's exactly how I interpreted it. Removing the "with $10,000" from the actual headline made this a bit ambiguous.

jonah2• 10 years ago

A ten year old with $10,000. ;) That's more money than most kids that age have to their name.

NovaS1X• 10 years ago

Actually yes. I had to read a few times before it clicked.

partycoder• 10 years ago

That wouldn't be a real reward, more like a liability.

ck2• 10 years ago

Trying to remember that other incident, not with facebook, maybe microsoft, where it was a teenager and they wouldn't pay them because they weren't 18+

So good on Facebook (this once).

ETA: it was paypal http://seclists.org/fulldisclosure/2013/May/163

danjoc2• 10 years ago

$10,000? Not to diminish what this child did in any way, but that is 4x what the person received who obtained access to

Static site content

Source code

SSL key pairs

iOS and Android app signing keys

iOS push notification keys

Email server credentials

Twitter, Facebook, Tumblr, Foursquare, and Flickr API keys

http://exfiltrated.com/research-Instagram-RCE.php

onewaystreet• 10 years ago

Because he broke the rules: https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...

danjoc2• 10 years ago

I believe that particular opinion has been discussed to death here before, so I won't address it.

The point I was trying to make is the market value seems wildly different from what Facebook pays out. The pricing gives me the impression that Facebook's bug bounty program is more concerned with public relations than it is about improving Facebook security.

ldom22• 10 years ago

jesus when I was 10 years old I was barely programming on actionscript, which is now dead. Now at 28 I can't even make that kind of money in an entire year

tpallarino• 10 years ago

That's awesome. Good for this kid.

satyajeet23• 10 years ago

Damn, facebook paid for a warm fuzzy PR moment.

The bug is worth $100.

Facebook rewarded a 10-year-old for finding Instagram security flaw

Related Stories