Facebook Pays Out Record Reward
Facebook Pays Out Record Reward
Written by Alex Armstrong   
Wednesday, 29 January 2014

Facebook has paid out $33,500 for a security bug, its biggest ever reward. The record-breaking amount reflects how the bug was handled as well as its potential severity.

Facebook's Bug Bounty program was initiated in 2011 and in its own words: provides recognition and compensation to security researchers practicing responsible disclosure.

 

 

 

Facebook attracted a torrent of negative publicity last year when it refused to pay out a bounty to a security researcher who posted a message on Mark Zuckerberg's personal Facebook page in order to prove the existence of a serious security flaw. His approach was deemed to be an irresponsible method of disclosure.

The latest payout was made to Brazilian computer engineer Reginaldo Silva for reporting an  XML External Entity (XXE) flaw involving OpenID that would enable arbitrary file reads. It is noteworthy not only for being Facebook's largest to date, at $35,000 beating the previous record of $20,000, but also because it is being used to provide a model of how to interact with Facebook's security team.

According to the post on the Facebook Bug Bounty page the report submitted by Silva was well written and included proof of concept code. The team was able to implement a one-line fix:

 libxml_disable_entity_loader(true)

that caused the XML parsing library to disallow the resolution of external entities.

That could have been the end of the story, in which case Silva would have earned a reward but perhaps not a record-breaking one. However, while impressed by the speed of the fix, only three and a half hours from his initial report, Silva was aware that the flaw had the potential for Remote Code Execution and in further discussion with Facebook was able to convince them of its RCE status.

If you want to know the full story read Silva's detailed account of the bug, which he originally discovered in Drupal and then inside Google servers and provides some of the code he used to demonstrate its RCE potential to Facebook.

As the Facebook post makes clear, the amount of the reward reflects not only the severity of the bug, but also in the way in which it was presented - promptly and with sufficient detail to make it easy to reproduce in the first instance, and then escalated, in a purely theoretical, white-hat, manner in co-operative discussion with the Facebook Bug Bounty team.

 

 

Banner


Minecraft Code Builder In Beta
05/05/2017

As part of a campaign to expand its share of the educational marketplace, Microsoft has created a new Code Builder tool that works in conjunction with Minecraft Education Edition and also integrates w [ ... ]



Red Light Alert! Programmer At Work!
06/05/2017

FlowLight provides a signal about a worker's status, switching from green to red when you shouldn't be disturbed by colleages. Having been tested with around 450 employees it appears to work and the m [ ... ]


More News

Last Updated ( Wednesday, 29 January 2014 )
 
 

   
Banner
Banner
RSS feed of news items only
I Programmer News
Copyright © 2017 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.