"Bug bounty" uncovers breach of Facebook server
A Taiwanese security researcher, Orange Tsai, discovered a breach of Facebook’s server, which involved a hacker installing a backdoor designed to steal its employees’ login credentials. The attack occurred on the corporate rather than the main server, and as such, Facebook users have not been affected. Tsai, who works for security company, DEVCORE, came across the backdoor while looking for bugs to earn a reward from Facebook. He received $10k from the company, which then carried out its own forensics investigation. Separately, Facebook has announced that more than 1m people now access its services via Tor. In 2014, the provider launched a version that runs only with the support of Tor’s anonymity software, allowing users to better protect their online security and privacy. 

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session

3 Cross-site scripting (XSS) flaws,

2 Remote code execution flaws,

2 Local privilege escalation issues.

That's the most commonly asked question during this decade.It's a hacker dream to hack Facebook website for earning bug bounty or for any malicious purpose.Facebook security team recently found that someone, probably a blackhat hacker with malicious intent, has breached into its server and installed a backdoor that was configured to steal Facebook employees' login credentials.Since the backdoor discovered in the Facebook's corporate server, not on its main server, Facebook user accounts are not affected by this incident.Though the company would have never known about the backdoor if a whitehat hacker had never spotted the backdoor script while hunting for vulnerabilities.Security researcherof Taiwanese security vendor DEVCORE accidentally came across a backdoor script on one of Facebook's corporate servers while finding bugs to earn cash reward from Facebook.Tsai scanned Facebook's IP address space that led him to thethat was hosting a vulnerable version of themade by Accellion and was used by Facebook employees for file sharing and collaboration.Tsai analyzed the vulnerable FTA and discovered seven security flaws as he explained in his blog post The researcher then used the vulnerabilities he found in the Accellion Secure FTA and gained access to Facebook's server.After successfully achieving his goal, Tsai started analyzing logs information available on the Facebook's server for preparing his bug report, and that is exactly when he spotted a PHP-based backdoor, popularly known as a, that had possibly been installed on the server by a malicious hacker.Tsai then reported all of his findings to the Facebook security team, whichfor his efforts and started its own forensics investigation that was completed this month, allowing the researcher to disclose the vulnerabilities responsibly.