Facebook Ignores Hacker's Bug Report, Then Refuses to Pay Him
August 19, 2013 2:03 PM
comment(s) - last by
Popular social network claims hacker's poor English language skills disqualify him from receiving an award
Social networking giant Facebook, Inc. (
) is mired in a new controversy, this time dealing with
bugs in its network and their privacy ramifications
I. "This is Not a Bug"
The story begins with a Palestinian information systems expert named
who last week discovered a bug in the social network that allowed him to post to anyone's wall -- including those he wasn't friends with. This is a pretty big deal as one of Facebook's
key curbs to spammers
is that you must be friends with people, by default, to post to their walls (and users can even further limit their walls so that only certain close friends can post, with the right settings tweaks).
He filed the bug report to the proper channel --
-- hoping to get paid. But a Facebook engineer replied to him that when they clicked the link they only got an error:
Frustrated, he sent another bug report, only to be told by Facebook Security Engineer "Emrakul", "I am sorry this is not a bug."
So the security researcher took matters into his own hands posting on a user's wall that he knew would draw attention -- Facebook CEO Mark Zuckerberg. He wrote in a friendly tone, providing a PasteBin to a detailed log of his interactions with Facebook engineers via a bug report system:
II. Okay, Maybe it
The post certainly attracted attention. Within minutes he was contacted by a security team member, Facebook engineer
. But Facebook didn't exactly greet his disclosure with open arms. The company suspended his account temporarily for posting on Zuck's wall.
While they eventually reinstated his account, Facebook ultimately refused to pay the $500 USD bounty that a bug report typically carries.
-- a Facebook engineer -- defends this decision in a Ycombinator forums post, first offering a roundabout jab at the reporter's English, commenting:
For background, as a few other commenters have pointed out, we get hundreds of reports every day. Many of our best reports come from people whose English isn't great - though this can be challenging, it's something we work with just fine and we have paid out over $1 million to hundreds of reporters. However, many of the reports we get are nonsense or misguided, and even those (if you enter a password then view-source, you can access the password! When you submit a password, it's sent in the clear over HTTPS!) provide some modicum of reproduction instructions. We should have pushed back asking for more details here.
There will be no pay day for Mr. Khalil from Facebook. [Image Source: Zagg]
Mr. Jones goes on to write:
As you can see at
, in order to qualify for a payout you must "make a good faith effort to avoid privacy violations" and "use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other accounts without the consent of their owners." Unfortunately, the OP did neither of those things. We welcome and will pay out for future reports from him (and anyone else!) if they're found and demonstrated within these guidelines.
But that argument is clearly flawed, in that Facebook's staff had told him "this is not a bug". As one commenter on Mr. Khalil's blog puts it:
They told him flat out when he reported it "this is not a bug" they didn't ask for more info or anything. He post on zuck's page then it becomes a bug but he violated TOS.. That's a no win right there.
Mr. Jones did offer this halfhearted apology:
To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial report. Unfortunately, all he submitted was a link to the post he'd already made (on a real account whose consent he did not have - violating our ToS and responsible disclosure policy), saying that "the bug allow facebook users to share links to other facebook users". Had he included the video initially, we would have caught this much more quickly.
But so far there's been no indication that Facebook is willing to dish out the $4,000 it normally gives for severe bug reports.
III. Facebook is Setting a Dangerous Precedent With Response
has been started to pay Mr. Khalil the amount that Facebook shorted him, considering he did disclose in a relatively responsible way a bug which could have brought him big cash from spammers.
The whole experience can be viewed as a cautionary tale to security experts -- particularly foreign ones. While Facebook has indeed paid out $1M+ USD for bug reports (the equivalent of 2,000 smaller bugs which offer a $500 bounty, or 250 bigger ones), it also at times has refused to acknowledge certain bugs or arbitrarily denied reporters their bounties. These scenarios will certainly drive some to full disclosure out of frustration, although few full disclosures will be as flashy or carefully documents as Mr. Khalil's.
Facebook can choose not to pay researchers, but it must beware alienating the community. [Image Source: Getty Images/modifications Jason Mick]
Yes, Mr. Khalil could be interpreted to be in violation of Facebook's ToS. But it's a black eye to the security program to not pay him, when he kept details of the vulnerability private, acted politely throughout the entire disclosure, and even first tried to go through official channels. It's Facebook's decision not to pay him, but it's the kind of decision that may cost the company in the long run, by stifling responsible disclosure.
It should be noted this is not the first time a bug has been applied at Mark Zuckerberg's Facebook account. Previously, a bug had
outed his private photos
, revealing his budding romance with Priscilla Chan and his passion for hunting -- which in turn gave rise to the "
Kill what you eat
Khalil on Blogspot
Facebook on Ycombinator
Reward Khalil on IndieGogo
This article is over a month old, voting and posting comments is disabled
RE: WTF Facebook
8/20/2013 12:40:19 PM
thats the thing...is FB setting a crappy precedent by not paying him when they have paid hundreds or even thousands of others? People love drama so I could see how the 1 outweighs the many, but wow.
it sucks because this could turn out that this 1 is gonna ruin it for all.
RE: WTF Facebook
8/22/2013 2:19:35 AM
I think the purpose is to get more attention to this matter. He will probably give the information to massive hackers which would cause major havoc in the important business lines. Then after, major security team facebook people will make ways for it to never work perhaps invest millions to make it happen. It won't get ultra bad enough to takedown facebook but just bad enough for it to happen because facebook doesn't seem to care that much about having preventive measures to protect peoples vital reputations which lead to eternal fatalism.
RE: WTF Facebook
8/23/2013 5:03:13 AM
The exploiy has already been patched according to another article.
"Well, there may be a reason why they call them 'Mac' trucks! Windows machines will not be trucks." -- Microsoft CEO Steve Ballmer
Quick Note: Facebook Unveils Year-Long Data Breach of User Phone Numbers, Email Addresses
June 24, 2013, 10:54 AM
Facebook Bug Reveals Zuckerberg's Private Photos
December 6, 2011, 9:07 PM
Facebook Wins $873M Judgment Against Spammer
November 26, 2008, 9:03 AM
Apple Posts Record Fiscal Q3 Profit of $7.7B, Sells 35.2M iPhones
July 22, 2014, 4:57 PM
Quick Note: Mobile Use Surpasses PC in China for First Time
July 22, 2014, 11:18 AM
WSJ: Up to 80 Million iPhone 6 Smartphones to be Produced by Year's End
July 22, 2014, 10:57 AM
Quick Note: NVIDIA’s SHIELD Tablet Gets Official
July 22, 2014, 10:00 AM
Motorola Moto G Successor Reportedly Uncovered, Moto X Discounted by up to $75
July 21, 2014, 1:11 PM
JJ Abrams Unveils X-Wing Starfighter for New "Star Wars" Movie
July 21, 2014, 12:24 PM
Most Popular Articles
Quick Note: Nokia Devices Now Receiving Windows Phone 8.1 Update
July 15, 2014, 10:42 AM
Microsoft Kills Entertainment Unit, May Shelve Flagship Lumia "McLaren"
July 18, 2014, 7:40 PM
Boeing 777 Malaysian Airlines Flight 17 Crashes in Ukraine
July 17, 2014, 1:00 PM
Tesla Confirms “Model III” EV with 200+ Mile Range, Blames Ford for Missed "SEX"
July 15, 2014, 9:12 PM
FBI Report Suggests That Self-Driving Cars Could Be Used as Rolling Bombs
July 16, 2014, 11:02 AM
Latest Blog Posts
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
Tesla vs. BMW: Who Has the Safer EV?
Feb 1, 2014, 2:56 PM
Justice Leaks Details of Next HTC One Two Flagship Phone
Dec 5, 2013, 4:04 PM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information