Security Community Raises $12k For Researcher Snubbed By Facebook

Trailrunner7 writes "Like most major Web and software companies, Facebook receives a lot of bug reports. And since the company started its bug bounty program, security researchers have become even more interested in looking for vulnerabilities in the Facebook ecosystem. But, as one researcher learned recently, not all bugs are created equal, and Facebook doesn't like people messing with its users – or its executives. That researcher, Khalil Shreateh, discovered a bug in the Facebook platform that enabled him – or any other user – to post comments on the walls of other users who aren't their friends. That shouldn't be possible under normal circumstances, so Shreateh reported the problem to Facebook through its bug bounty program, hoping to earn a reward from the company. Instead, the company told him he didn't provide enough information. So Shreateh went a step further and demonstrated the technique by posting a message to the wall of Facebook founder Mark Zuckerberg. On Aug. 19, after details of the incident became public, Marc Maiffret, a well-known security researcher and CTO of BeyondTrust, started a crowdfunding campaign to get Shreateh a reward for his work. As of Aug. 23, that campaign has raised more than $12,000 and Maiffret is in the process of transferring the funds to the researcher."

Re:Deserved?

[ShanghaiBill]

I'd be interested in seeing his report, to see if he really did provide enough info or not on the bug. For $12K you ought to take the time to be pretty thorough in providing a reproducible bug report.

I would also like to see this. The reports on this are inconsistent. At first I heard that Facebook "ignored him". Now I am hearing that they "asked for additional information" (which he either did or didn't provide - nobody knows?).

A better way for Facebook to handle this in the future, would be to set up some sandbox "hack me" accounts. Then someone with an exploit can demonstrate it, and ensure they will be taken seriously.