There's a lot to unpack here, but it seems that the gist of it is that things that happen in our society are because humanity is some kind of untamable animal, and that we should all just resign to letting it run wild as it does.
Do you not believe that society is only the sum of its parts? Do you not believe that the mathematics of society can be changed, the more parts of the equation object to letting their talents be used for unscrupulous goals?
I would point you towards any cultural shift in modern society, and how it began—usually, as the imbalance of classes further divides, until one class can't tolerate it any further, and uses what power they have to reset the scales. That is what is happening today, and it isn't a fluke of the short attention span of the beast of humanity. It is a conscious, concerted effort of people in this country who are tired of existing in a system devoid of morals. And to frame it as something like embracing the status quo, or becoming a puritanical society, is simply a false dichotomy.
Is this not the point of a Whitehat bounty program? To entice someone to discover and disclose a bug in a trustworthy manner?
If they react this way, and can't trust people to attempt to find exploitable security holes on their system (even those that yield private keys), then what is the point at all? The only people that find them then, are not going to be as cooperative about it.
> Doesn't the author know how long it will take them to recover from this breech? How much it will cost them?
This is not the author's fault. He did nothing but disclose bugs that Facebook themselves set in place, and seemed to be very open with them about it, at that.
Bug bounty appears to be a misnomer in this instance. Facebook is specifically asking for reports of security vulnerabilities in their policy:
> If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away.[1]
Which then begs the question to me: how do you differentiate an acceptable and unacceptable probing of security vulnerabilities when you can't capture the full impact of an issue without attempting to exploit it to its fullest? Because it is certainly not outlined in their policy.
And when you're asking for any whitehat to attempt to discover and disclose security vulnerabilities in your system with only the limpest of guidelines around how to do so, I don't feel that it is warranted to react such as Facebook has here.
I don't know. I feel bad for Alex but if we want to suggest that Facebook's vulnerability disclosure policy was poorly written, I will ruefully agree.
When you stand up a bug bounty program, you are giving strangers permission to do something that they would otherwise be prosecuted for doing. You should be extraordinarily careful when you do that, and your rules of engagement should be crystal clear. These weren't.
EDIT: Having read the CSO's explanation that the guy was using his company work email, it makes more sense why the CSO would contact the company (and explains away the pettiness my comment was referring to)
One thing I notice: if the CSO felt like this person did something grossly illegal and irresponsible, why not go straight to the police? Why instead go to the man's employer and speak passively aggressively?
Paradoxically, contacting the authorities could have helped facebook's argument. It would communicated to the community at large: "Hey Facebook believes it has clear standing to pursue this guy. Maybe, he really did do something wrong."
Instead, what I'm reading is: "Facebook doesn't actually believe what the guy did was illegal per se... but they wanted to spite the guy anyway."
Zero is the number of people on HN who would feel better about this situation if Alex Stamos had referred this person to the police to be prosecuted under CFAA.
The researcher has already updated his post regarding the use of his company email. Apparently your original point still stands:
> I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.
Also, why would he be doing this work at the behest of his employer when (IIRC) Facebook's bounty program only pays out to individuals? It would automatically make him ineligible to claim the bounty.
To me it seems like Alex Stamos tried to use some good old threaten-your-livelihood intimidation tactics and failed miserably.
I commented earlier to sort of the same effect, and was thinking a little more about this.
I don't think the goal, or desire, is to be told the full extent or impact of a problem. The goal is to be alerted to spots that may lead to a large problem, or re in and of themselves a large problem.
This seems like it has a few facets to it. You end up reducing the space of things to mostly "ways to get in the front door." Thinking about it, I would probably be frustrated, in general, if I knew someone had important keys to the kingdom I was in charge of. It doesn't change the fact that others may or may not have also gotten the same access, now it's 1-* instead of 0-* people who have it and shouldn't.
I'm still slightly skeptical on the bounty reward itself. This was a simple exploit that got pivoted into some major shit, so do you reward the exploit of the logical conclusion of the exploit? I lean towards the latter, but again, as you said... how do you figure out the impact without... actually trying to figure out the impact?
Bug bounties are an interesting concept, to be sure.
-
Holy christ that is SO wrong. The system should not be so easy to pivot in that way. That was definitely the real bug. If getting the keys to the kingdom is easy as exploiting a trivial bug than Instagram is really really screwed.
As I'm sure it's not the only trivial bug!
Instagram should be thanking Wes for the wakeup call instead of making him the enemy.
Why wouldn't it be considered a bug that accessing one low-permission S3 bucket allowed him to access all the other buckets, including user data and keys?
Both tptacek here and Facebook claim that he found one bug. He found at least two, depending on how you classify things: even if Facebook would not like to admit that their security architecture around token amanagement was/is deficient, and the fuzziness of internal security boundaries makes "bug" somewhat hard to define, it was deficient by industry standards (especially for such a large and tech-focused company), and he got way more access than that RCE should have given him. Whether or not he was supposed to go looking for such additional bug(s), it's discourteous not to at least acknowledge that he found them, and thereby provided Facebook additional value over just finding the RCE.
If he had told Facebook that at the same time as he reported the credentials he harvested from the database --- which his timeline suggests he could have --- I'd agree with you.
But he didn't. He put the credentials in his back pocket so he could pull them out when they suggested he hadn't found his "million dollar bug". And so for a month after they fixed the bug, some fucking rando is walking around with credentials to all of Instagram's AWS assets, totally unbeknownst to anyone at Facebook. They turn down his bid for his "million dollars", and he busts the credentials out on them. You think they're going to thank him?
He's lucky it was Stamos and not Mary Ann Davidson.
I think the point is that, after the first bug report those credentials SHOULD NOT WORK because their job should have included revoking ANYTHING that system have access to. How did they know Wes was the first person to find that bug and the linked credentials?
So, the fact that those credentials still worked a month later is a HUGE FUCKING DEAL! Alex, the consummate professional, didn't do his job and instead had a knee jerk reaction to someone slapping that fact in his face.
It has been incredibly interesting reading through those threads. People are arguing two completely different arguments. tptacek is saying that the dude keeping AWS keys without disclosing this was bad and guy is lucky to not get a early morning wake-up call from men with guns. slewis, comex et al are saying that Facebook not locking down and later disabling AWS keys was bad and Facebook was lucky they didn't get sold on black market. Both sides are correct but it's informative who makes which arguments.
What is the protocol for assuming that a bug might have previously been exploited and keys already compromised? Is that just not worried about unless they see evidence in logs?
Especially considering Alex Stamos apparently requested reassurance that he _hadn't_ accessed particular classes of data - instead of looking in their own presumably non-existent audit logging of people who've had access to the private keys ssl of instgram.com and *.instagram.com!!!
(Seriously??? That's some world-class enterprise-grade "moving fast and breaking things"...)
I don't know much about this which is why I asked.
It seems that severity-based payouts have created incentives that do not match the program rules? Maybe all rce bugs should be paid out on an assumption that if used they'll lead to access to a shell or to user data.
Yeah - but it's 100% clear from this that FB wanted to brush the RCE under the carpet with a "not at all severe $2500" classification - without ever admitting to losing their private ssl keys or auth token seeds.
He clearly _did_ have a "security vulnerability" that gave him the keys to the kingdom. He knew it, and Facebook know it - and they wanted to pretend it was no big deal.
Any bets on how many months till there's a large-scale breach of Facebook user data? The reality of the balance between responsible disclosure and selling an exploit is much easier to evaluate now.
You don't know that's what happened, even the researcher didn't say that. You're extrapolating.
A much more reasonable and likely explanation of the same set of things we've been told:
Alex Stamos called Synack and said that the AWS credentials, which, by the researchers own admission, he'd chosen to retain long after the vulnerability he reported was fixed, had to be deleted, and that if they weren't and the researcher continued to use them, the situation would be out of Stamos' hands and into Facebook legal's, at which point he couldn't keep him from being prosecuted.
In that interpretation, Alex isn't threatening the researcher; he's (very reasonably) saying "you cannot use these credentials you've taken from the server, and if you keep doing that, I can't take responsibility for how Facebook will handle this, so you should stop right away before you harm yourself."
it's utterly trivial to revoke and reissue aws access keys. trying to paint this as a necessary security measure is incredibly dishonest. the only plausible reasons to loop in his employer and mention legal remedies are intimidation and incompetence and as you've assured us incompetence is off the table...
blazespin > > But threatening to call the cops was really bad.
tptacek > You don't know that's what happened, even the researcher didn't say that. You're extrapolating.
From Wes' blog (presumably based on his boss' oral description of the call): "Alex then stated that he did not want to have to get Facebook's legal team involved, but that he wasn't sure if this was something he needed to go to law enforcement over."
Your bias is apparently badly incapacitating your reading comprehension, because "stated that [...] he wasn't sure if this was something he needed to go to law enforcement over" is exactly threatening to call the cops. Not even your friend mr Stamos, who has presumably read Wes' blog post, is claiming that he didn't. So whom are you saying is lying; Wes, or his boss?
Oh, and "(very reasonably) saying 'you cannot use these credentials you've taken from the server, and if you keep doing that, I can't take responsibility for how Facebook will handle this, so you should stop right away before you harm yourself.'" really, really, really sounds like Vito The Baseball Bat "very reasonably" saying "You cannot use this testimony you got off Loanshark Louie, and if you keep doing that, I can't take responsibility for how the boys will handle this, so you should stop right away before you harm yourself."
Seeing that as SERIOUSLY (as opposed to sarcastically) "very reasonable"... Well, hello, friendship-bias Bizarro World.
I'll rephrase the question. Is the broader vulnerability apparent based on the first discovery OR does it only become clear the further down the rabbit hole you get?
I don't know. If we're going to speculate, I'll say: the Facebook security team didn't know this system existed (it's a 3rd party admin console on a public IP address!), and their immediate reaction to it was "nuke it from orbit, pay out the bounty for finding it, and forget about it".
My guess is that they discovered the AWS credential thing on December 1.
If they discovered the AWS credential thing on December 1 after the security researcher reported it, and wouldn't have discovered it otherwise, and it could be the case that someone else found the exact same attack path first, shouldn't they reward him for making them aware of a problem they would not have otherwise noticed? That they wouldn't have fixed? That others that discovered the same attack path might otherwise still openly exploit to MITM all the traffic, to do arbitrary things with arbitrary user accounts?
> By backing a fundraising campaign on Kickstarter, you as the Backer accept that offer and the contract between Backer and Project Creator is formed. Kickstarter is not a party to that agreement between the Backer and Project Creator. All dealings are solely between Users.
I'm not convinced. The section you referenced pertains to the backing rewards only. They are, and always seem to have been, very hands-off about the delivery of the project.
I disagree. "5$ donation, get nothing" wouldn't require a refund.
The project purpose is to make a game. That's separate from the reward tier "get a copy of the game". So if the project fails, the backers who bought a copy of said game need to get a refund.
Contracts fall under civil law. There is no statutory definition of what constitutes offers and acceptance. So in this case, were I a lawyer, I'd argue that the TOS is a legal contract, and by using the site, you have implicitly agreed to the definition of contract acceptance specified in the TOS.
Whether it holds up in court is a different question, but this lawsuit at least gave a precedent.
Sure, but the money is exchanged between kickstarter and the participants (backers and makers). The participants don't exchange directly with each other.
Yup, that is a likely counter argument to be made in court if anyone ever sues over these issues. As I said, though, this is civil law, so it would come down to how lawyers argue it and what judges think. In civil cases, answers are rarely black and white.
Is there something special he's done to get this much milage out of the car? It's only rated for about 300mi on a full charge, so I'm curious if it's just luck, or more?
The difference is, we in The West have the right to choose what to consume, or be "brainwashed" by, and China's government chooses for them. Which would you prefer?
A thousand times this. It makes me sad that you have to worry about this :(. But if there's that strong a bias against your name, you probably don't want to end up actually being present there.
My advice, working at an enterprise SaaS company: stick to your guns, and be proud of your name! Good companies (like ours :) ) are actively seeking women for technical positions to correct the bias.
It may be absurd, but it's not at all uncommon. Sending group invites via SMS is an incredibly kludgy experience, and following the path of least resistance, is so unrealistic when you have Facebook events at your fingertips. All of your friends are already there, and you merely need to change the details, and Facebook handles all the communication.
This article and title are super misleading—the title appears to be a flat-out lie, in fact. It spends five paragraphs ranting about the issue until it finally concedes:
> "...Das and Kramer claim to only send back information to Facebook that indicates whether you self-censored, not what you typed. The Facebook rep I spoke with agreed that the company isn’t collecting the text of self-censored posts."
In any case, the fact that Facebook is, or wants to be, slopping up every ounce of data about its users is no surprise.
EDIT: Viewing the actual study[1], it appears this article is even more fluffy. This "self-censorship" feature appears to only have been in place for a small segment of users for 17 days:
> "We collected data from 3.9 million
users over 17 days and associate self-censorship behavior
with features describing users, their social graph, and the
interactions between them." [1]
Do you not believe that society is only the sum of its parts? Do you not believe that the mathematics of society can be changed, the more parts of the equation object to letting their talents be used for unscrupulous goals?
I would point you towards any cultural shift in modern society, and how it began—usually, as the imbalance of classes further divides, until one class can't tolerate it any further, and uses what power they have to reset the scales. That is what is happening today, and it isn't a fluke of the short attention span of the beast of humanity. It is a conscious, concerted effort of people in this country who are tired of existing in a system devoid of morals. And to frame it as something like embracing the status quo, or becoming a puritanical society, is simply a false dichotomy.