Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall

http://arabcrunch.com/2013/08/palestinian-hacker-posts-facebook-bug-report-on-facebook-ceo-mark-zuckerbergs-wall.html

by ArabGeek • 13 years ago

81 78 13 years ago

arabcrunch.com

pella• 13 years ago

https://news.ycombinator.com/item?id=6229858

ArabGeek3• 13 years ago

He did that after facebook security team rejected his request to report a bug

DangerousPie2• 13 years ago

To be fair they rejected it because his "report" consisted of a link to a profile where he claimed to have exploited the bug, without any explanation of what he actually did. If he had at least given a rough indication of what the exploit was I am sure they would have reacted differently.

ArabGeek3• 13 years ago

"----Original Message to Facebook----- From: kha@hotmail.com To: Subject: post to facebook users wall .

Name: Ḱhalil E-Mail: khal@hotmail.com Type: privacy Scope: www Description: dear facebook team .

my name is khalil shreateh. i finished school with B.A degree in Infromation Systems .

i would like to report a bug in your main site (www.facebook.com) which i discovered it .

repro: the bug allow facebook users to share links to other facebook users , i tested it on sarah.goodin wall and i got success post link - > https://www.facebook.com/10151857333098885 -----End Original Message to Facebook----- "

borplk9• 13 years ago

That doesn't automatically make it ok for him to go ahead and exploit someone's profile for attention (for the 2nd time). He wrote a lazy report and knew they did not understand him. He could write a more detailed report and tell them that they have misunderstood him. Or he could write one in Arabic and ask them to get help from one of the Arabic-speaking employees.

After two messages back and forth, he says "i have no choice other than report this to mark himself". He did indeed have many other choices but he jumped straight to posting on Mark's profile which he knew will create a global shit-storm.

It's clear he wasn't very reluctant to posting on Mark's profile anyway. He was just waiting for them to ignore him so he can drop his "i have no other choice" line and go ahead.

tobykier• 13 years ago

wtf. We're not going to pay you because after we ignored you you went over our heads.

ArabGeek3• 13 years ago

"of course they didn't use their authority to view sarah’s privacy posts as Sarah share her timeline posts with her friends only."

jonson• 13 years ago

In my opinion..I think they should compensate him.They said he violated their terms...Their terms on the whitehat page is not even localised for other Languages. Too Bad.

mike-cardwell2• 13 years ago

In his first message, he demonstrates that his bug exists by showing that he exploited somebody elses account. This is obviously, never the way to make a bug report. Heck, it's probably even illegal. You shouldn't need to read a sites terms and conditions to know that doing this will be breaking them. It's an expensive lesson. Hopefully it will lead to him being more sensible in future. I have no sympathy.

orf• 13 years ago

He also gave no technical information at all. He gave more info on his education than the bug he found.

pampa2• 13 years ago

Denying bounty to a hacker on some bullshit "Terms of Service" violation excuse defeats the whole purpose of the bounty program.

Next time a hacker will just sell the exploit to somebody else, cash upfront, and wont bother reporting.

Sam_Odio• 13 years ago

While the instructions to report bugs on the whitehat page are not localized, the terms Facebook is referring to (https://www.facebook.com/legal/terms) are.

chiefalchemist• 13 years ago

Re: "We are unfortunately not able to pay you for this vulnerability because your actions violated our Terms of Service."

Poor Zuck, literally poor poor Zuck. #Sarcasm

Prediction: People will start finding holes, shorting the stock, exploiting the holes, then going public with the exploit and making their money once the stock dips.

Done correctly, that probably pays pretty damn well, yes?

yolajengoo• 13 years ago

Uh, no. How many security exploits do you think would impact Facebook's stock? This one? Investors do not care about minor bugs that are fixed quickly.

tlarkworthy• 13 years ago

This bug is a spammers paradise though, free advertising by posting on other people walls about products. Gold

jedbrown• 13 years ago

Simultaneously use the exploit on many investors' FB pages, perhaps starting with their children and families. Nobody cares about an exploit used on Zuck's wall and fixed soon after, but the perception would change if it was more personal and widespread.

adventured• 13 years ago

That would work great, in a James Bond movie.

unreal373• 13 years ago

No, not really. You need to risk a lot of capital to make any money at all.

For instance, to make even $10,000 on a 5% drop in Facebook stock, you would need to sell short $200,000 in Facebook stock and would need to have $100,000 in cash deposited with a broker (initial margin). If the stock goes up by even a penny, you would need additional margin to cover that. A young hacker with no money cannot make any by shorting stocks.

datadata• 13 years ago

You could create a much more leveraged position with options. With a put option buy, your maximum loss is capped, so you wouldn't need any additional margin.

khalilshr• 13 years ago

i cant reply to all of these comments , but i can say that i love facebook security team when they ignored me ;) thank you for your support . regards .

thephiga• 13 years ago

so did you get paid?

vadivlkumar• 13 years ago

Don't worry about your English, just continue to do what you are doing. But understand one thing, what you are doing is only worth to learn one or two. If FB is paying you are not is not really matters!

I was little irritated your English was criticized heavily! And it's more irritating when a security team misses to understand a security issue when I was able to understand

borplk9• 13 years ago

I applaud him for his expertise and finding the bug but here are some points Ḱhalil:

- You violated Facebook's terms of service by exploiting the bug on Sarah's profile. You shouldn't have done that.

- I understand that English is not your first language and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps. For example you have said "mark profile" instead of "Mark Zuckerberg's profile". That's just ambiguous language and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously.

- After they said it is not a bug, it is clear that they have misunderstood you because you failed to communicate clearly. You could write a more detailed report and tell them that they have misunderstood you. If not you could report in your first language and let them ask one of their Arabic-speaking employees.

- You violated the terms again by exploiting the bug on Mark's profile. It would be bad if it was any other Facebook user too. But you went straight for Mark which will obviously generate a lot of buzz and negative publicity and I'm sure he doesn't appreciate someone randomly posting something on his wall.

- Just because they fail to receive your bug report does not make it ok for you to go ahead and exploit it.

By exploiting the bug you had found twice you lose your whitehat status and you no longer deserve the bounty. Whitehat does not mean "white hat unless you fail to take my report then I will have to exploit your CEO's profile for the world to see".

If Facebook does pay you for the bug, it is just setting a bad example and will be encouraging similar behaviour.

After that, every other person who finds a bug too will do something funny to Mark's profile for attention.

s_q_b2• 13 years ago

The author clearly has a language barrier. Not all bug reports are going to come with sterling reports to back them. In the end, Ḱhalil fell back on the lingua franca of the internet: a working demonstration.

The onus is on the organization, not the bug reporter, to vet the information. From what I see, there was more than enough in the report to conclude there was a problem, and follow up.

If Facebook security fails in coding the application, in QR, and when a user files a bug report, it is awfully hard to place the blame with the bug reporter.

ressaid1• 13 years ago

I agree, and in the end, they finally broke the language barrier and comprehended the bug which I am sure they are working on fixing. They were able to get all the benefit of his work, why screw him on a measly little bounty?

dylangs10308• 13 years ago

This isn't a good summary of the events. His "lingua franca" is technically illegal, and violates Facebook's explicit and easily accessible Terms of Service.

There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention.

He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report.

Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.

dylangs10308• 13 years ago

Excellent summary, thanks. I don't think most of the people raising an outcry over Khalil not receiving any bounty understand that the Terms and Conditions are explicit and easily accessible. They also can't just set a precedent.

"Oh, if we don't understand your bug report, just post it on our founder/CEO's Facebook wall and it'll shoot right up to the top on our priority list."

I know everyone hates big companies but come on...the argument for Khalil to not be paid is very reasonable. I respect him for being able to find the bug but it's not a conspiracy. He could have sent back an email trying to be more clear, or ask for an Arabic-speaking employee.

Plus, Facebook is not a stingy company when it comes to paying security researchers. Just look at their Hall of Fame. It includes HN's 'homakov (Egor Homakov), who wrote an excellent blog post about finding a vulnerability in Facebook and his primary language isn't English. But he still found a way to report the vulnerability through responsible disclosure and he is very happy with the bounty he received.

Everyone thinks it's so cool and "sticking it to Facebook" and that Facebook is just some big bad company who doesn't care about the small folk. It's not like that at all, change your perspective.

vpeters252• 13 years ago

I thought the whole idea behind whitehat reports was to keep these exploits off the hands of malicious hackers.

Whoever made the decision not to pay this guy should check with Mark Zuckerberg. If Mark is still adhering to "the hacker way" he should embrace such clever ways of reporting exploits and invite any whitehat to test them on his or better, {the idiot who decided not to pay}'s profile.

Hacking and finding exploits requires thinking outside the box, by imposing rules and "terms of service" on them, Facebook might be defeating the whole purpose of the whitehat program.

Any exploit violates Facebook's terms anyways. By not paying, Facebook is telling the whitehat community "go ahead, do our QA for us, we will only pay you if we feel like it"

unreal373• 13 years ago

That's not true. There was a very easy way to find and demonstrate this bug without violating the TOS. The TOS clearly says, you can't target someone with your hack without their permission.

The hacker could have created two accounts he owned and controlled, who are not Facebook friends. He could have used one to post to the other's wall. Viola, bug proven and bounty collected.

borplk9• 13 years ago

If a person is whitehat, it is understood, and by definition, they will not use the found bug for a bad purpose or sell it on black market.

Whitehat does not mean "I will responsibly disclose the vulnerability for as long as there's good money and rewards otherwise I will exploit it or sell it to someone else".

Facebook or any other company with bounty programs are not competing against the black market and trying to out-bid the bad guys by attracting the black hat hackers to wear a white hat and disclose the bug to Facebook for some money.

"we will only pay you if we feel like it"

Facebook isn't saying that. They are saying "we can not pay you because you violated our terms of service" which is truly an under-statement. It should be like "we can not pay you because you exploited the bug on our CEO's profile and another one of our users and have created negative PR and damaged our reputation"

But even if they did say "we will only pay you if we feel like it", as far as whitehats are concerned that should not change their incentives and behavior because, again, whitehats, by definition are not those who disclose the bugs for money and rewards.

If you are a grey/black hat only wearing the white hat when the money is good enough then Facebook is not interested in dealing with you in the first place.

negamax• 13 years ago

Oh come on. This is such a corporate PR stand. The guy had taken the perfect step by posting the exploit on Mark's wall. He tried twice with best way available to him to report the bug. Is Facebook saying he should have adhered to a particular way for doing a service to them? Good luck in making him paint in the bad light. Next person will simply upload the video on Youtube and won't even bother reporting anything.

throwaway4202• 13 years ago

>> If Facebook does pay you for the bug, it is just setting a bad example and will be encouraging similar behaviour.

I strongly disagree.

Despite not following the process by the book, I think it is clear that he attempted to act in good faith and had trouble with language/cultural issues. It's not like he posted porn or something on Zuckerberg's profile.

I think that going out of their way to stiff this guy out of a few bucks makes it all the more likely that any future vulnerabilities that are discovered by foreigners will just be sold to spammers/hackers. And this makes the internet a worse place.

Facebook saved a few bucks but just lost a big PR war here that Facebook will reward you for disclosing vulnerabilities.

Facebook should have paid the guy and used this event as a reminder about the best practices and procedures to follow.

yashkadakia• 13 years ago

I want to step in here - Facebook is in no-way trying to save a few bucks. I've reported a few bugs to Facebook and they go out of their way to pay you greater sums depending on the severity.

You just have to be professional and disclose in-detail with steps to reproduce.

thezilch2• 13 years ago

What a load of crap.

I understand that English is not your first language (no I don't; I'll deride your command of it at every turn, going forward) and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps (every whitehat reporter CAN NOT be expected to understand how or what to adequately include in a PoC; it is _Facebook_ who is shown to be lazy in their responses, failing to point the reporter to the rules, appropriate [localized] steps, and ANYTHING of value to help the reporter). For example you have said "mark profile" instead of "Mark Zuckerberg's profile" (lol, idiot). That's just ambiguous language (see, I really don't understand nor can forgive you for being an English speaker) and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously (unlike the mistakes made by Facebook; woe is them who can't be arsed to not even have boilerplate guidance and just shrug off reporters; cool story bro).

[...] you failed to communicate clearly (idiot).

borplk9• 13 years ago

Very informative commentary with your "lol" and "idiot" brackets.

Maybe Facebook sucks and can't be bothered with helping the reporter.

That does not make it ok for the reporter to go ahead and exploit it.

And for what it's worth, I'm not a English speaker either so I can understand and forgive someone for not being a English speaker too.

His report is very short and lazily written. It's not about the level of language skills. It's about the time and effort he put in on disclosing the vulnerability.

Using simple language he could have written a step by step guide explaining the problem.

The point is, regardless of Facebook's behavior, it is not ok for him to go ahead and exploit the bug on two different users one of them being the CEO of the company. And he did not put in enough effort to make them understand what he's talking about. He could have given it another shot with more details.

Facebook is not trying to "save" money on the bounty program. The budget is already allocated and no one is sitting there crying over the couple of thousands of dollars and trying to stop people from getting it.

If anything, he has caused damage to Facebook's image and reputation due to the negative publicity, greater than the amount he was going to be paid.

So yes, if you post on Mark Zuckerberg's profile and create a news shit-storm of negative publicity against Facebook they are not going to thank you and pay you money.

hcarvalhoalves2• 13 years ago

After they said it is not a bug, it is clear that they have misunderstood you because you failed to communicate clearly. You could write a more detailed report and tell them that they have misunderstood you.

Right. He could also make a detailed flow diagram, or maybe fly to US and demonstrate in loco how it works. Give me a break...

If I send a bug report and some lazy engineer replies back in laconic fashion with "It's not a bug" I would also have exploited the CEO profile. They should be thankful he didn't simply sold the exploit, it had the potential to be huge.

borplk9• 13 years ago

A lazy engineer doesn't automatically result in a warrant for exploiting the bug on the CEO's (or anyone's) profile.

No corporation will come forward and say "thank you for exploiting two of our users including our CEO and generating lots of negative PR for us. Here have this money for being a good boy and not selling the bug in the black market".

That's not how whitehat works.

Udo2• 13 years ago

It's not just the language barrier or the ethics of disturbing someone's profile though.

His emails read like a job application with some vague hints at an exploit that may or may not be real. I'd say he expected a job offer or at least an interview as compensation for eventually revealing the bug. In his perception, going ahead and posting on Zuckerberg's timeline was just another step toward that goal.

Breaking the rules is a somewhat glorified thing in hacker circles, and this may have contributed to his attitude. Of course, what they don't tell you when they say "break all the rules" is that only works out if you actually win in the end. And winning is an event often contingent on getting someone important to like you.

For what it's worth, all of that probably wasn't done in bad faith, but it wasn't a constructive process either. It's something someone very inexperienced would do if they were desperate for a job in the USA. It's understandable behavior, and if I was on the relevant FB team I'd at least given him something to recognize his efforts. If in doubt, do the generous thing (and be it only for publicity's sake).

borplk9• 13 years ago

By giving him anything they would be encouraging violation of their terms of service.

I'm no fan of Facebook but as a corporation they are doing the right thing.

walid• 13 years ago

Considering the language barrier I have to shoot down some of your assumptions.

- I understand that English is not your first language and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps. For example you have said "mark profile" instead of "Mark Zuckerberg's profile". That's just ambiguous language and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously.

The part where Khalil writes "mark profile" is the way it is said in Arabic because Arabic has no capitalization. There is no "apostrophe + s" in Arabic either.

The violation of TOS is a obviously a violation, but the language barrier thing again. The TOS is not in Arabic.

Finally:

- Just because they fail to receive your bug report does not make it ok for you to go ahead and exploit it.

The word "exploit" is not the right word here. He didn't exploit the bug, he demonstrated it, albeit in a poor way but it wasn't an exploitation.

thezach• 13 years ago

I made a facebook security vulnerbility report Friday afternoon and have recieved absolutley no response from them.... its getting rather disgusting

dylangs10308• 13 years ago

Give them a few days? Companies like Microsoft receive 200,000 bug reports each day, and each one has to be examined to determine authenticity. Plus, you sent it before the weekend.

It's not "disgusting"...you just need to be patient.

jliptzin• 13 years ago

Join the club...I've never received a response from them about basic issues.

Now I am a Facebook advertiser with a $30k monthly budget...I thought surely then I'd get some responses from them (for example, when I was unable to make changes to my ad campaign, including daily budget, for WEEKS, due to a javascript bug), but still left completely in the dark.

coolsunglasses• 13 years ago

They're partying/sleeping.

ryandrake2• 13 years ago

If the Facebook security team responded more thoughtfully, we wouldn't even be reading about this as news. Instead of:

    "This is not a bug" (essentially, "go away")

...they could have said:

    "Thanks for the report. It seems that English may not be your first language, so to be very clear, in order to check this issue, we will need these pieces of information (A, B, C). Please feel free to reply in your language, and we will have a native speaker help translate."

If I was the researcher, the callous "go away" response would have convinced me that it would be more fruitful to sell the exploit to a spammer (who would pay HANDSOMELY to be able to post to anyone's wall).

ronaldx• 13 years ago

I agree with your point but I disagree with your method. I agree that they should also offer a means to communicate in other languages, if they have that capacity.

But, your choice of sentence structure - with clauses and formal social graces - would be hugely more difficult for a non-native speaker to parse correctly.

If the goal is to communicate with a non-native speaker, Facebook's message is appropriate for its clarity.

Bear in mind also that they probably do want incorrect bug reports to "go away" - unless Facebook apply infinite resources to this, some false negative errors are inevitable.

dylangs10308• 13 years ago

1. I agree, Facebook probably could have been more tactful in their reply. Your example reply looks good.

2. That said...if you were the security researcher, and you received a "This is not a bug." - you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.

I think both sides should have done things differently. Hacker News is skewed towards BigCo hatred as a whole, and I think it's showing a bit. The majority is siding with Khalil despite the fact that there are valid reasons for him to not receive a bug bounty.

ryandrake2• 13 years ago

Oh, and just to clarify, I'm not coming at this from the perspective of "BigCo hatred". It is in Facebook's best interests to treat white hat reported security issues seriously, even if they don't initially understand them.

What are the chances that this security researcher ever reports another bug to Facebook, given how he was treated? Selling future exploits to spammers wouldn't be the ethical thing to do, but if I know "Emrakul" in Facebook Security is just going to tell me to F-off, I start to justify it.....

iyulaev• 13 years ago

you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.

Well he tried twice, and they told him it wasn't a bug both times. After that, what's wrong with selling "not an exploit" to the highest bidder?

moocowduckquack• 13 years ago

I think there are valid legally justifiable reasons for refusing the bounty, however they are outweighed by the reason for the bounty system to exist in the first place.

Not paying someone over minor violations that they only did to get your attention to the fact that something was definitely important to you is not good practice when running a bounty for bugs.

borplk9• 13 years ago

Yes I agree that the Facebook employee could have responded better.

But you are mixing two different issues.

Facebook employee saying "go away" does not automatically result in a warrant for you to go ahead and exploit the bug you found.

If you do that, you no longer meet the definition of a whitehat researcher.

That kind of person is not the type that Facebook wants to reward because Facebook is not competing against the black market prices.

It is simply rewarding those honest reporters who would report the bug even if they were 100% sure that Facebook is not going to pay anything and would not exploit it or sell it even if the Facebook employee said "screw you" or if the black market bids were 6 digit figures.

tcbrfla• 13 years ago

There are no excuses. Facebook should expect that hackers with english as a second language (or not even that) will find bugs in the system and that they will not be able to communicate the way the Facebook team expects.

They should stop finding excuses and start to focus their efforts on making sure that people with no communication skills can report any bug.

Suggestion: Facebook could create a new "Facebook_security" system, which can be used to report bugs. The system would have the same production version, but the terms and conditions would be flexible. It would be used only for security purposes, and if someone finds a bug, they could record the exploit and send to the facebook team. By doing this, they would make sure that any type of bug could be reported.

ferdo• 13 years ago

Facebook should give him a job. The current security team appears to need some help.

Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall

Related Stories