Facebook paid a white hat hacker, also known as internet bugs hunter, $15000 for a pointing out a security flaw in Facebook accounts. This Facebook security flaw could potentially render Facebook accounts accessible to anybody who could exploit it. The ramifications of these are better imagined.
Anand Prakash is the white hat hacker that got the windfall from Facebook. Anand actually goes by the title of Internet Security expert and works for Flipkart, an Indian owned e-commerce company founded in 2007. As a security consultant, Anand’s brief includes searching for security weakness(es) in websites and getting paid for his efforts. He is what is known in the tech world as a white hat hacker. They are hackers that use their findings to plug loop holes so that criminals or black hat hackers can’t exploit them.
The Facebook security flaw was found in beta.facebook.com, a portal that is meant for developers to test new products before being released to Facebook for the public to use. Normally, Facebook sends a 6-digit PIN code through email or text message upon the receipt of a password reset from users. To prevent abuse of the system, Facebook allows only a limited number of reset attempts. But at the developer platform, Prakash discovered there is no limit to how many guesses a user can make.
The hack here is simple. Since all Facebook accounts are also accessible through the beta platform; and since there are no limits to the number of guesses for wrong reset codes, all Prakash did was to flood the Facebook page with PIN codes until a random number opens the page. After receiving the payout from Facebook, Prakash talked about the issue in a blog post titled, ‘ [Responsible disclosure] How I could have hacked all Facebook’s accounts.‘
“This post is about a simple vulnerability found on Facebook which could have been used to hack into other user’s Facebook account easily without any user interaction. This gave me full access of another users account by setting a new password. I was able to view messages, his credit/debit cards stored under payment section, personal photos etc. Facebook acknowledged the issue promptly, fixed it and rewarded $15,000 USD considering the severity and impact of the vulnerability.”
He then went on to describe how he did it with a video to show the whole process:
The payment for a white hat hacker is not unusual though. Every major company has what is called a bugs bounty program that aims to encourage hackers to seek out flaws in their websites and get paid for it. However, the high payment for a relatively easy to fix bug is because, bug bounties are valued according to how damaging the bug could be if exploited. The complexity of the problem is secondary.
In a widely circulated statement, Facebook said,
“One of the most valuable benefits of bug bounty programs is the ability to find problems even before they reach production. We’re happy to recognize and reward Anand for his excellent report.”
For a white hat hacker like Prakash, a good payday like this is the reason he enjoys spending hours on his PC looking for security flaws in major websites.
photo credits: twitter.com; leemunroe.com