Hacking Facebook’s Legacy API, Part 1: Making Calls on Behalf of Any User

http://stephensclafani.com/2014/07/08/hacking-facebooks-legacy-api-part-1-making-calls-on-behalf-of-any-user

by ssclafani • 12 years ago

163 19 12 years ago

stephensclafani.com

brotoss• 12 years ago

Pretty slick way to earn 20 grand...nice work

stevenh2• 12 years ago

Taking the following into consideration:

- The severity of the exploit, which may be nearly the maximum theoretical possibility on a site like Facebook, aside from SQL injection or remote code execution

- The multiple months worth of unpaid sleepless nights Stephen Sclafani likely spent exploring countless dead-ends before finding this

- The fact that he beat black hats to the punch by discovering it first and thus saved Facebook and its users from millions, perhaps billions, of dollars worth of damages stemming from vague and mysterious causes over an indefinite period of time

- The billions of dollars Facebook regularly uninhibitedly spends to acquire a given startup

I feel that $20,000 is a bit low.

StevenRayOrr• 12 years ago

Insultingly low.

Oy.

Not that I am going to pretend that I know what the dollar value of Sclafani's time/effort should be, but I have a hard time believing that $20,000 is an insult. Just because he could get more money by exploiting the bug -- or showing others how to exploit it -- doesn't necessarily suggest to me that he should get paid more than he did.

lstyls• 12 years ago

"Insultingly low."

Really? 20K is about two months of salary for a Facebook engineer. So even if he did spend months on this like you speculate (he didn't) it's still an industry-leading salary.

ohitsdom• 12 years ago

I thought $20k was really low. GREAT value for Facebook. In the hands of black hats, trust in Facebook could have been destroyed before they had time to patch the vulnerability.

neilwillgettoit• 12 years ago

As a security researcher, the most impressive part of this is the response timeline from Facebook's security team. 3~ hours from first report to temporary patch! That's insane.

aristus• 12 years ago

Facebook deploys code twice a day. It used to be once a day but as the org grew they decided to double down. They can deploy even more often if there's a "pusher i haz a hotfix" situation like this.

Artemis2• 12 years ago

Yeah, I reported a simple security breach in Outlook.com to Microsoft three weeks ago, and it seems they still haven't fixed it yet. Way to go Microsoft.

ttty• 12 years ago

then you can share :D

eugenez2• 12 years ago

We also have a system for patching vulnerabilities which does not require a full code push. It has been useful on a number of occasions. (source: I patched this one)

stevenh2• 12 years ago

Does Facebook usually respond to exploit reports so quickly, or does the fact that the discoverer (Stephen Sclafani) helped Facebook find bugs in previous years mean that his emails were automatically flagged as high-priority?

_nullandnull_• 12 years ago

I'm not a huge fan of Facebook but that is one impressive bug bounty and turn around time. Nice job to both parties.

beartime• 12 years ago

whats wrong with fb?

nitrogen• 12 years ago

In the spirit of https://xkcd.com/1053/, I'll assume you haven't heard about the privacy violations, misleading or hard to find control panels, and constant changes to visibility settings leading uninformed users to unwittingly post sensitive information with public visibility.

Facebook (the web app) has its uses and reasons to like it, but there are also lots of reasons not to like it.

lnanek2• 12 years ago

Reminds me of the whole SnapChat thing. People just aren't securing the internal APIs their mobile apps use.

Hacking Facebook’s Legacy API, Part 1: Making Calls on Behalf of Any User

Related Stories