Facebook, Researcher Spar Over Instagram Flaw Disclosure (exfiltrated.com) 31
msm1267 writes: A security researcher is in a bit of a scrum with Facebook over vulnerability disclosures that not only tested the boundaries of the social network's bug bounty program, but he said, also prompted hints of legal and criminal action, which Facebook has since denied. Wesley Wineberg, a contract employee of security company Synack, said today that he had found some weaknesses in the Instagram infrastructure that allowed him to access source code for recent versions of Instagram, SSL certificates and private keys for Instagram.com, keys used to sign authentication cookies, email server credentials, and keys for more than a half-dozen critical other functions, including iOS and Android app signing keys and iOS push notification keys. Wineberg also accessed employee accounts and passwords, some of which he cracked, and had access to Amazon buckets storing user images and other data prompting claims of user privacy violations from Facebook.
Compromise (Score:3)
Post the full details, everything, on your Facebook account. That way if they don't like it they can just delete it.
When the CSO is involved it is a coverup. (Score:5, Interesting)
So when he pulled this shit and called up a company out of the blue he probably thought his reign of terror would apply there too.
So if I were his boss I would not only look into this one case but I would look to see how many other cases he suppressed. Then, I would carefully look into his behaviour in the office. I would suggest that they hire an outside company that can do anonymous surveying of his immediate underlings and others that he has dealt with to see if he is a bully. I would also look into any firings that he was involved with; especially if they were outside his direct purview. Did he have some guy escorted out of the building because he wanted his parking space?
Facebook's statement (Score:2)
Facebook’s statement:
“We are strong advocates of the security researcher community and have built positive relationships with thousands of people through our bug bounty program. These interactions must include trust, however, and that includes reporting the details of bugs that are found and not using them to access private information in an unauthorized manner"
They forgot to end that with "...because we're the only ones that are allowed to do that, while shoveling truckloads of money into our bank accounts".
Re:Facebook's statement (Score:5, Insightful)
Re: (Score:3)
Yeah, it's weird that he's pissed off with them after he's the one that broke multiple laws.
Whether they're incompetent fuckwits exploiting two billion people is totally irrelevant, he still broke the law and shouldn't be surprised if legal action follows.
If he's lucky it'll only be civil action.
Re: (Score:2)
It's our jobs to pen test and see how far we can take it, as long as no one is injured and the equipment isn't maliciously tampered with.
It's not your job to break the law. Maliciously tampering is a very subjective interpretation, and thinking you can merrily compromise someone else's system tells me your judgement is sadly lacking.
Sell them on the black market for way more $$$. That must be what they want.
Or maybe they want responsible disclosure without exploitation. Is that possible?
Re: (Score:2)
Who knows if this individual "security researcher" or his company might have decided to keep some of those private certs and credentials around for future use.
Actually, if there is a chance he has a copy of the signing keys, some of which can not be changed, Facebook should just pay the bounty, and consider itself lucky that the security researcher doesn't consider himself a criminal.
Facebook should take a page out of the US anti-nuclear proliferation playbook. If a country is trying to get the nuke. You punish it. You bomb it back to the dark ages. On the other hand, once a country already has a new working nuke (especially more than one). You put on a show for
Re: Facebook's statement (Score:5, Insightful)
> There isn't a single white-hat penetration tester out there who will say its ok to access systems you aren't given permission to access, even if its in the act of discovering vulnerabilities that you intend to disclose.
If you're not hired by FB but are probing their systems to look for vulnerabilities as their bounty system encourages, you cannot meet the criterion you outline.
The goal apparently needs to be more clear: if FB's goal is to find as many problems as possible then stopping at the first problem and closing that door does not achieve the goal.
Unless we hear that he sold the info to a third party, it looks like there's no victim here and FB looks bad for overreacting when it got caught with its pants down (wait ... Instagram, not Snapchat).
Warning, do not try at home (Score:4, Informative)
access source code for recent versions of Instagram, SSL certificates and private keys for Instagram.com, keys used to sign authentication cookies, email server credentials, and keys for more than a half-dozen critical other functions, including iOS and Android app signing keys and iOS push notification keys. Wineberg also accessed employee accounts and passwords, some of which he cracked
Warning: if you are going do security research, don't access all that stuff (without permission from the company), it can be completely illegal.
People have literally gone to jail for accessing less than this guy did. Whether you think it should be illegal or not, it is illegal and you should be more careful than he was.
Re: (Score:3)
Yeah, as much as I hate to defend Facebook here, I fail to see how Facebook is in the wrong here, it's clear the guy didn't just find an exploit, but used it to scour into the deepest depths of Facebooks network and to exfiltrate the most sensitive of data.
That's not security research uncovering a vulnerability, that's outright hacking in to Instagram and then saying "Oh I was just doing you a favour" after the fact.
When you find an exploit you report it, if instead you delve into the system and start to no
Re: (Score:3)
No they're not, if someone leaves their car door unlocked, and you tell them, and they still don't lock it, it doesn't give you the right to go for a joyride, break a few speed limits, and run a few people over. No matter what the circumstances, it's pretty clear this guy broke numerous laws regardless of how inept Facebook were.
The best you can do if someone doesn't act when you alert them is to go public, and hope that scares them into taking the issue a bit more seriously.
Signed authentication cookies (Score:2)
Re: (Score:2)
Older versions of rails deserialized cookies to a Ruby object. That is an RCE if you make a complex object. The expectation of the web application is the cookie would ddeserialize to Hash or similar object. Well if you create an object that defines some of the methods commonly used on Hashes like [], select, each etc you will be able to put whatever you want there and get it called. The security Rails had in place on that was to check the signature. If the signature was valid than the browser faithfull
Re: (Score:2)
If I were doing a test of an application for an organization I did not have a defined client relationship and I saw something like this (I actually have done this) I would generally have injected something like `nslookup somewildlonguniquestring@mydomian.com` and watched DNS server to see if it gets such a request....... The web server should log requests hopefully even things like cookies, so if you don't go shell it should be EASY for forensics to confirm you did what you said you did and no more.
That's a good idea.
scrum (Score:1)
Please don't use the word 'scrum', it conjures up images of project managers and developers furiously masturbating over epics and user stories.