Instagram's Million Dollar Bug
In stories like this, try first to remember that Facebook isn&#x27;t a single entity with a single set of opinions, but rather a huge collection of people who came to the company at different times and different points in their career.<p>Alex Stamos is a good person† who has been doing vulnerability research since the 1990s. He&#x27;s built a reputation for understanding and defending vulnerability researchers. He hasn&#x27;t been at Facebook long.<p>To that, add the fact that there&#x27;s just no way that this is the first person to have reported an RCE to Facebook&#x27;s bug bounty. Ask anyone who does this work professionally: <i>every</i> network has old crufty bug-ridden stuff laying around (that&#x27;s why we freak out so much about stuff like the Rails XML&#x2F;YAML bug, Heartbleed, and Shellshock!), and <i>every</i> large codebase has horrible flaws in it. When you run a bug bounty, people spot stuff like this.<p>So I&#x27;m left wondering what the other side of this story is.<p>Some of the facts that this person wrote up are suggestive of why Facebook&#x27;s team may have been alarmed.<p>It seems like what could have happened here is:<p>1. This person finds RCE in a stale admin console (that is a legit and serious finding!). Being a professional pentester, their instinct is that having owned up a machine behind a firewall, there&#x27;s probably a bonanza of stuff they now have access to. But the machine itself sure looks like an old deployment artifact, not a valuable asset Fb wants to protect.<p>2. Anticipating that Fb will pay hundreds and not thousands of dollars for a bug they will fix by simply nuking a machine they didn&#x27;t know was exposed to begin with, the tester pivots from RCE to dumping files from the machine to see where they can go. Sure enough: it&#x27;s a bonanza.<p>3. They report the RCE. Fb confirms receipt but doesn&#x27;t respond right away.<p>4. A day later, they report a second &quot;finding&quot; that is the product of using the RCE they already reported to explore the system.<p>5. Fb nukes the server, confirms the RCE, pays out $2500 for it, declines to pay for the second finding, and asks the tester not to use RCEs to explore their systems.<p>6. <i>More than a month after Facebook has nuked the server</i>  they found the RCE in, they report another finding based on AWS keys they took from the server.<p>So Facebook has a bug bounty participant who has gained access to AWS keys by pivoting from a Rails RCE on a server, and who apparently has <i>retained</i> those keys and is using them to explore Instagram&#x27;s AWS environment.<p>So, some thoughts:<p>A. It sucks that Facebook had a machine deployed that had AWS credentials on it that led to the keys to the Instagram kingdom. Nobody is going to argue that, though again: every network sucks in similar ways. Sorry.<p>B. If I was in Alex&#x27;s shoes I would flip the fuck out about some bug bounty participant walking around with a laptop that had access to lord knows how many different AWS resources inside of Instagram. Alex is a smart guy with an absurdly smart team and I assume the AWS resources have been rekeyed by now, but still, how sure were they of that on December 1?<p>C. <i>Don&#x27;t ever do anything like what this person did</i> when you test machines you don&#x27;t own. You could get fired for doing that working at a pentest firm even when you&#x27;re being paid by a client to look for vulnerabilities! If you have to ask whether you&#x27;re allowed to pivot, don&#x27;t do it until the target says it&#x27;s OK. Pivoting like this is a bright line between security testing and hacking.<p>This seems like a genuinely shitty situation for everyone involved. It&#x27;s a reason why I would be extremely hesitant to ever stand up a bug bounty program at a company I worked for, and a reason why I&#x27;m impressed by big companies that have the guts to run bounty programs at all.<p>† <i>(and, to be clear, a friend, though a pretty distant one; I am biased here.)</i>