<story><title>Deleting any Facebook album</title><url>http://www.7xter.com/2015/02/how-i-hacked-your-facebook-photos.html</url></story><parent_chain><item><author>Someone1234</author><text>Holy heck, $12.5K? That&amp;#x27;s one heck of a nice bug bounty program Facebook has there. That is likely more than the black market would pay for this, or at least a lot less hassle (plus the black market might have little interest as this cannot be used for hijackings, just trolling&amp;#x2F;harrassment).</text></item></parent_chain><comment><author>tptacek</author><text>I doubt the &amp;quot;black market&amp;quot; would pay much of anything for this bug, because, like most severe web vulnerabilities, it has no half-life.</text></comment>
<story><title>Deleting any Facebook album</title><url>http://www.7xter.com/2015/02/how-i-hacked-your-facebook-photos.html</url></story><parent_chain><item><author>Someone1234</author><text>Holy heck, $12.5K? That&amp;#x27;s one heck of a nice bug bounty program Facebook has there. That is likely more than the black market would pay for this, or at least a lot less hassle (plus the black market might have little interest as this cannot be used for hijackings, just trolling&amp;#x2F;harrassment).</text></item></parent_chain><comment><author>dsacco</author><text>It&amp;#x27;s not very useful to compare bug bounty payouts to what the &amp;quot;black market&amp;quot; would pay for a vulnerability.&lt;p&gt;Let&amp;#x27;s look through the challenges of selling a vulnerability that allows for arbitrary account takeover (much more serious than this):&lt;p&gt;0. Find the vulnerability. Assume that no one will find it by the time you find a third party buyer.&lt;p&gt;1. Look for a buyer. If you&amp;#x27;re not well-connected, you might stumble into an FBI honeypot (a sting operation) because you don&amp;#x27;t know what you&amp;#x27;re doing. But let&amp;#x27;s assume you know what you&amp;#x27;re doing and you find a buyer.&lt;p&gt;2. You negotiate a price. You don&amp;#x27;t receive much more than Facebook would pay you (if they even give you that much) for a few reasons:&lt;p&gt;a. The vulnerability can only be used on Facebook, so it&amp;#x27;s not vendor agnostic (compare Heartbleed, Shellshock);&lt;p&gt;b. The vulnerability has an extremely small window of capitalization - it &lt;i&gt;will&lt;/i&gt; be discovered within a week of use, maybe less. The Facebook incident response team is &lt;i&gt;spectacular.&lt;/i&gt;&lt;p&gt;c. You need to figure out a sufficient monetization strategy for distributing malware or spam using profiles that are taken over using this vulnerability. You have a week of use, much less if you try to take over accounts too aggressively. Now you&amp;#x27;re going up against all of Facebook&amp;#x27;s other protections - once you have the account, spreading malware will either be algorithmically discovered by Facebook or reported by other users.&lt;p&gt;With an organized crime unit composed of professional hackers, this might pay off. Maybe. And that is for one of the most serious bugs you can find. You&amp;#x27;re better off just taking what Facebook (generously) gives you.&lt;p&gt;The classical fallacy people fall into is believing that a web application vulnerability is worth much, especially the variety most tech companies have to offer. It&amp;#x27;s certainly serious, yes, but it&amp;#x27;s only worth what a market will pay for it. It&amp;#x27;s worth a lot to Facebook for brand integrity. It&amp;#x27;s not worth a lot to hackers looking to make money.&lt;p&gt;The only web applications that might be worth real money would be banks or government institutions (or similar platforms). &lt;i&gt;Real&lt;/i&gt; money is found in vulnerabilities on desktop clients, especially memory corruption vulnerabilities, or in ubiquitous software that affects servers. You want to be able to compromise a user for use in a botnet or distribute malware to steal their money or personal information. Alternatively, you want to be able to attack, say, 30% of the websites on the internet with a wide variety of options after you get in.&lt;p&gt;Examples include:&lt;p&gt;• Vulnerabilities in Flash.&lt;p&gt;• Vulnerabilities in Python, Ruby or corresponding web frameworks.&lt;p&gt;• Code execution in iOS that allows a jailbreak (most sources indicate the going price for this is $500,000). Other vulnerabilities as well, such as compromising app store receipts or in-app purchase checks.&lt;p&gt;• Vulnerabilities in Android, up to and including code execution.&lt;p&gt;• A game over flaw in any number of ubiquitous software packages used on Linux servers with root access.&lt;p&gt;• A sandbox escape in OS X or Windows (you&amp;#x27;ll be paid more for Windows but both are lucrative).</text></comment>