Facebook recently paid a 10 year old hacker $10,000 for detecting and reporting a security flaw in the popular photo sharing app Instagram.
The 10 year old hacker, known as Jani, lives in Helsinki, the capital of Finland. These are the sort of countries that never register on one’s radar until something like this happens. And you find yourself booting up Google Maps to find out where a 10 year old hacker actually lives. I don’t own an Instagram account yet, but I am sure 10 year olds, even if they are geniuses 10 white year old hackers of the white hat variety, are not allowed to own Instagram accounts. Let alone spending a lot of time on the app to unravel the app’s weaknesses.
However, for Facebook, the concern has little to do about the legality of Jani messing around on Instagram. A problem was found, and luckily enough for everybody, the flaw was discovered by a white hat hacker. According to Forbes, who got the report from the Helsinki based Iltalehti (you need to translate it, as the site is in Finnish), Jani wrote an email to Facebook reporting the flaw he discovered in February.
To verify the flaw, a test Instagram account was opened. The 10 year old hacker successfully deleted a comment posted on the test account. And that was how the flaw was authenticated: which is the ability to delete any Instagram account. The bug was fixed by the end of February by Instagram coders, who must have being red in the face that it took a 10 year old hacker to point out such a serious flaw to them.
Facebook paid the $10000 in March. Apparently, that amount is the value Facebook placed on Jani’s discovery. Most tech companies have what is called a bugs bounty program. This aims to encourage hackers to work on finding security flaws in softwares. The amount paid out to a hacker for successfully detecting a flaw is not based on the complexity of the problem. Rather it is calculated by how much damage the bug would have caused if a black hat hacker had decided to exploit it.
The last bugs bounty payment by Facebook was to Anand Prakash. The India-based security consultant got $15000 for reporting a potentially disastrous flaw on Facebook. According to Facebook, since the Facebook bugs bounty program started 2011, they have paid out over $4.3 million to over 800 hackers or security experts. That is roughly an average of just over $5000.
Come on Facebook, you can do much better than that. I guess if I were a white hat hacker, I’d put more energy into looking for flaws on Google softwares. Google seemed to take the program more seriously as they even doubled the payout to $100 000 for discovering a bug on Chromebook.
As for Jani, the 10 year old hacker, he intends to do what 10 year olds normally do when they get money. A bicycle is top on his list. He also plans to buy computers for his brothers and all the things one needs to play a game of football. For now, he has become the youngest hacker to receive money from Facebook. The previous record holder was 13 year old hacker.
photo credit: netdna-cdn.net; google.com