Facebook Pays Out Record Reward
Facebook Pays Out Record Reward
Written by Alex Armstrong   
Wednesday, 29 January 2014

Facebook has paid out $33,500 for a security bug, its biggest ever reward. The record-breaking amount reflects how the bug was handled as well as its potential severity.

Facebook's Bug Bounty program was initiated in 2011 and in its own words: provides recognition and compensation to security researchers practicing responsible disclosure.




Facebook attracted a torrent of negative publicity last year when it refused to pay out a bounty to a security researcher who posted a message on Mark Zuckerberg's personal Facebook page in order to prove the existence of a serious security flaw. His approach was deemed to be an irresponsible method of disclosure.

The latest payout was made to Brazilian computer engineer Reginaldo Silva for reporting an  XML External Entity (XXE) flaw involving OpenID that would enable arbitrary file reads. It is noteworthy not only for being Facebook's largest to date, at $35,000 beating the previous record of $20,000, but also because it is being used to provide a model of how to interact with Facebook's security team.

According to the post on the Facebook Bug Bounty page the report submitted by Silva was well written and included proof of concept code. The team was able to implement a one-line fix:


that caused the XML parsing library to disallow the resolution of external entities.

That could have been the end of the story, in which case Silva would have earned a reward but perhaps not a record-breaking one. However, while impressed by the speed of the fix, only three and a half hours from his initial report, Silva was aware that the flaw had the potential for Remote Code Execution and in further discussion with Facebook was able to convince them of its RCE status.

If you want to know the full story read Silva's detailed account of the bug, which he originally discovered in Drupal and then inside Google servers and provides some of the code he used to demonstrate its RCE potential to Facebook.

As the Facebook post makes clear, the amount of the reward reflects not only the severity of the bug, but also in the way in which it was presented - promptly and with sufficient detail to make it easy to reproduce in the first instance, and then escalated, in a purely theoretical, white-hat, manner in co-operative discussion with the Facebook Bug Bounty team.




Formation of Partnership On AI

Amazon, DeepMind/Google, Facebook, IBM, and Microsoft have announced the founding of a non-profit organization that to advance public understanding of artificial intelligence technologies and for [ ... ]

JS Foundation Supported by IBM

The newly announced JS Foundation, formed with help from the Linux Foundation is an expansion of the jQuery foundation. Intended as an umbrella project to support the JavaScript ecosystem, the JS [ ... ]

More News

Last Updated ( Wednesday, 29 January 2014 )

RSS feed of news items only
I Programmer News
Copyright © 2016 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.