Hacker Demonstrates Facebook Exploit On Mark Zuckerberg's Wall

[chiefohara]

Bad form on facebooks part really. $500 dollars is nothing to them, and its not like the guy didn't warn them that that was what he was going to do.

Im kinda surprised they aren't seriously looking at hiring the guy really.

 

[Jadak]

I haven't read the terms of service. But I know they don't say that because that's the law. No agreement can state that failure to adhere to one particular agreement cancels the company's obligations in any other separate agreements. That's simply contract law.

And the whitehat policy, found here: https://www.facebook.com/whitehat , is clearly a separate agreement as it makes absolutely no reference to its Terms of Service or to requiring that the whitehat hold an account. In fact, it explictly encourages the whitehat to *avoid* using real accounts for the activity -- a judge would see that as an explicit denial of a link to this activity and their account system, ergo, their terms of service.

That clears that up then, although interestingly enough, on the very page you linked there is a section that contains this text (right near the top):

Responsible Disclosure Policy
If you give us a reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.

I'd say the "good faith effort to avoid privacy violations" goes out the window instantly, considering violating privacy is what he intentionally did to prove his point (albeit, still in good faith I guess).

Granted, it doesn't explicitly say 'will not pay you' on top of that, but come on.. It's right there on the main page telling people to make an effort to avoid this kind of stuff to prove their points.

 

[Patrick Hayes]

I'm amused at the people acting like Facebook is being dickish by not paying him, when in reality their point about 'violating the Terms of Service' is a perfectly legitimate one.

Now, all things considers the fair thing to do would be find some way to pay the guy something, but it certainly shouldn't be publicized. Facebook is not small, nor private. Their terms of service are not intended as a suggestion nor a joke, and publically rewarding someone in violation of those terms is a big no no, something they like have entire PR and legal departments dedicated to pointing out.

I mean, come on, do you think a company like Facebook gives a shit about $500 to one guy in the context of anything that could theoretically cause any problem at all for it's hundreds of millions of users? I doubt it.

Now, if they got enough bad press over this I wouldn't be surprised to see some sort of compensation tossed out to save face, but at the moment they've decided that rewarding someone who publically breaks your rules looks worse, and that's prefectly reasonable.

So you think blackhats won't violate terms of service when they get into systems? Because that's exactly what they do. TOS aren't a deterrent for malicious intent.

 

[Jadak]

So you think blackhats won't violate terms of service when they get into systems? Because that's exactly what they do. TOS aren't a deterrent for malicious intent.

Why would I think that? No, I'm saying don't pay them for doing it. Sure, this guy isn't a 'blackhat', and it's too bad his report was ignored / met with dismissal, but he could have kept at it, a better formulated report to argue the matter would have been an appropriate step but he chose to 'make a point', and you don't typically pay people for fucking with you.

 

[Kargathia]

You're right, if you ignore all the details, anyways.

You're arguing that, essentially, this sets a trend that discourage this reward system and you're ignoring the details of this event or at least the point of my post to do so. My entire point was that they're not simply refusing to reward someone, they're refusing to reward a violation of their terms of service.

This does nothing to discourage 'glitch finders', this discourages them from actually taking what they find and abusing the system to make their point. There's nothing wrong with that and it in know way supports the idea that if you find a glitch, Facebook won't pay you.

The one and only problem on that front is with whoever recived the bug reports and decided to dismiss what was reported (although as was mentioned in the article, the Facebook engineer could be correct in that not enough explanation was provided to be useful), and problems like that could indeed caused issues for the perception of this reward system, but that's a different issue. What matters here is the simple decision to not pay someone who publically violated your service.

Maybe a good choice, maybe not, but not one that does anything to discourage those using the system as intended. Only problem there is with cases such as this, where real issues slip through the cracks

They're fully within their rights refusing him payment, but the moment he went public by pasting it across Zuckerberg's page it went potentially viral.
At that point concerns about not rewarding people for violating your ToS are vastly superceded by the PR implications of how your reaction comes across to millions of onlookers - especially as Facebook is such a consumer-oriented company.

Personally I'd probably pay him for pointing out the glitch, and then ban him. You avoid looking like an ass in the latest viral storm in a teacup, while retaining the validity of your ToS.

 

[Jadak]

They're fully within their rights refusing him payment, but the moment he went public by pasting it across Zuckerberg's page it went potentially viral.
At that point concerns about not rewarding people for violating your ToS are vastly superceded by the PR implications of how your reaction comes across to millions of onlookers - especially as Facebook is such a consumer-oriented company.

Personally I'd probably pay him for pointing out the glitch, and then ban him. You avoid looking like an ass in the latest viral storm in a teacup, while retaining the validity of your ToS.

Doesn't quite cover the situation. Virtually any bad PR is more costly than $500 to a large public company, but that's ignoring a possible reason behind why they would bother to refuse payment based on ToS in the first place.

On the one hand, they get bad PR if they do what they're doing now. On the other hand, if they do pay the guy, they set a bad precedent and undermine the guidelines set forth for their whitehat program. If they do that, they're basically saying that strictly following the proper procedure is not required, that it is okay to publically embarass Facebook to prove your point, and still get paid for your trouble. That is a very bad message to send. Whether it's worse than the bad PR for not doing so is not a decision I would envy making.

 

[Jesse Billingsley]

Hey, didn't Zuckerberg do something similar to this too in college?

 

[1337mokro]

THANKS FOR THE FISH BRO!!! LULZ!!!

Is the message I think he received. I hope facebook is ready for the shitstorm of crap that is coming their way if this guy finds a vital exploit.

 

[Callate]

His account has since been re-enabled but sadly, despite clearly finding a bug, Shreateh won't be getting any reward. "We are unfortunately not able to pay you for this vulnerability because your actions violated our Terms of Service," Facebook told him. "We do hope, however, that you continue to work with us to find vulnerabilities in the site."
Read more at http://www.escapistmagazine.com/news/view/126996-Hacker-Demonstrates-Facebook-Exploit-On-Mark-Zuckerbergs-Wall#ZHbuxlLbLiyy8vab.99

Oh, for fuck's sake.

Grow a spine, admit that the fault was yours, and reward the man for doing your job for you, you petty sons of weasels!

 

[cricket chirps]

Aaaaaand why do people still use/trust facebook?

 

[Madgamer13]

Whoah, this thread is full of Facebook hate.

If someone reported an exploit inside a system of mine without any details to reproduce the exploit, then proceeded to use the exploit to abuse the system, in order to get their very valid point across, I'd be quite angry.

But then, this is Facebook we are talking about! Facebook, one of the most successful social networking websites ever! Surely they should be thankful that a person with person with technical knowhow found a way to compromise their system! Bah! Facebook deserves to be hacked anyway! Now recognise this saviour's superior position and give him money you have promised with your 'white hat' system!

How naïve, just because Facebook is big and successful does not make it ok to support those who would compromise it's service. Of course, I'd be very curious if anyone here who supports this hacker would still choose to do so if they log into their Facebook account to find their private wall spammed with enlargement pill adverts, posted by the very same damn way this exploit has been explained.

But then, you'll just blame Facebook at that point, won't you? No wonder sites such as these require terms of use.

 

[Dr. Cakey]

Whoah, this thread is full of Facebook hate.

If someone reported an exploit inside a system of mine without any details to reproduce the exploit, then proceeded to use the exploit to abuse the system, in order to get their very valid point across, I'd be quite angry.

But then, this is Facebook we are talking about! Facebook, one of the most successful social networking websites ever! Surely they should be thankful that a person with person with technical knowhow found a way to compromise their system! Bah! Facebook deserves to be hacked anyway! Now recognise this saviour's superior position and give him money you have promised with your 'white hat' system!

How naïve, just because Facebook is big and successful does not make it ok to support those who would compromise it's service. Of course, I'd be very curious if anyone here who supports this hacker would still choose to do so if they log into their Facebook account to find their private wall spammed with enlargement pill adverts, posted by the very same damn way this exploit has been explained.

But then, you'll just blame Facebook at that point, won't you? No wonder sites such as these require terms of use.

The only one here attempting to compromise Facebook's service is Facebook.

 

[Brian Tams]

Its nice to see Facebook is still doing dodgy shit like finding excuses not to pay what they owe.

 

[l3o2828]

I am halfway hoping he finds a new exploit and completly wrecks the site.

 

[Callate]

Whoah, this thread is full of Facebook hate.

If someone reported an exploit inside a system of mine without any details to reproduce the exploit, then proceeded to use the exploit to abuse the system, in order to get their very valid point across, I'd be quite angry.

But then, this is Facebook we are talking about! Facebook, one of the most successful social networking websites ever! Surely they should be thankful that a person with person with technical knowhow found a way to compromise their system! Bah! Facebook deserves to be hacked anyway! Now recognise this saviour's superior position and give him money you have promised with your 'white hat' system!

How naïve, just because Facebook is big and successful does not make it ok to support those who would compromise it's service. Of course, I'd be very curious if anyone here who supports this hacker would still choose to do so if they log into their Facebook account to find their private wall spammed with enlargement pill adverts, posted by the very same damn way this exploit has been explained.

But then, you'll just blame Facebook at that point, won't you? No wonder sites such as these require terms of use.

If that's what happened, dismissing the response as "Facebook hate" might be plausible, if still broad and dismissive, but it's not what happened.

At all.

From the linked article, bold (for emphasis) mine:

Khalil explains on his blog that he submitted a full description of the bug, plus follow-up proof of its existence to the Facebook security feedback page, where researchers can win rewards of at least $500 for finding significant vulnerabilities. Then he submitted again. The second time he got an e-mail back that said, "I am sorry this is not a bug."

Having tried, repeatedly, to go through official channels, he then turned towards more attention-getting methods of getting through the bureaucracy that was ignoring a very real and significantly dangerous risk. The means he chose to do so, as near as I can understand, were arguably some of the least invasive and threatening at his disposal. By way of comparison: it is not at all unusual for hackers, having been rebuffed for their attempts to warn through official channels, to simply post their findings to the public with the hope that increasing the likelihood of exploitation will force those responsible for security to deal with the problem.

It's regrettably common for those responsible for network security to take an "ignore it and it will go away" approach to security breaches, especially if there is likely to be significant expense and/or work involved in fixing the problem. For a company that holds as many people's private information as Facebook, that attitude ought to be inexcusable- but that's no guarantee, especially from the hacker's point of view, that such an attitude wasn't what was keeping Kahlil's warning from getting through.

From the same article:

Facebook admits, though, that its team should have been more diligent in following up on Khalil's submission.

What exactly should he have done? Continued to send e-mails to an office that showed no interest in following through?

If your house is on fire, the person who throws a brick through your window when you don't respond to a knock isn't a vandal. He's your best damn friend.

 

[chozo_hybrid]

What did the bug do? That's what I'm curious of.

That said, they could afford to thank him for it, it's not like he didn't try contacting them properly first.

 

[Grabehn]

So they offer a reward, the guy shows them there's a vulnerability and they don't care, then he exploits the thing to have enough proof and they won't pay because he used the exploit...

I've never been one to like Facebook, but why offer a reward you're not willing to pay? And denying recognition to the one that discovered it? I seriously think they wanted him to use the exploit so they could fix it afterwards without paying a dime.

 

[coldfrog]

The real problem here is that it's impossible to tell for sure which side is in the right because we lack the vital information, IE, exactly what his bug report contained. And you know what, we'll probably never see it.

There's plenty of reasons to dislike Facebook, and I don't feel as if this is one of them. If they've paid out before, there's no reason to think they won't pay out again, and until a pattern of similar behavior emerges, I'm willing to write this off as a one-off and move on. If the complete details of their dialogue are revealed, maybe then we can make a more informed decision, but right now we can only speculate and piss each other off uselessly. And I have a feeling we won't be seeing those transcripts any time soon.

 

[Jamous]

Wow. Fuck's sake. That's some shitty stuff right there. They could have at least bloody acknowledged him properly.

 

[ciasteczkowyp]

corporations I personally will never have an account there so maybe this guy should go ahead and find some critical exploits.