Facebook breach

[zzm9980]

This is what I mentioned to some of you last night. I was the "security researcher" (hah) that found it and reported to them.

https://www.facebook.com/notes/facebook ... 7074840766

http://allthingsd.com/20130621/facebook ... e-numbers/

http://www.nytimes.com/2013/06/22/busin ... users.html

http://www.theregister.co.uk/2013/06/21 ... tact_leak/

http://www.theverge.com/2013/6/21/44532 ... lion-users

[zzm9980]

Facebook obviously is downplaying what this meant. And fair enough to them.

Here is how it actually worked:

1) Create a contact named “Mark Zuckerbergâ€Â

[nakatago]

This is what I mentioned to some of you last night. I was the "security researcher" (hah) that found it and reported to them.

https://www.facebook.com/notes/facebook ... 7074840766

http://allthingsd.com/20130621/facebook ... e-numbers/

http://www.nytimes.com/2013/06/22/busin ... users.html

http://www.theregister.co.uk/2013/06/21 ... tact_leak/

http://www.theverge.com/2013/6/21/44532 ... lion-users

I've heard about it but I didn't read the articles any more. Because it's Facebook--s#!+ like this always happens with them because it's almost always of their carelessness.

Anyway, do you personally get press time because of this? I should've taken my picture with you.

[zzm9980]

No, they asked if I wanted to be in the press release and/or their 'Thanks' page. I said no to the press release (since my employer may not look kindly on it), but yes to the 'Thanks' page since that is a bit more discrete. It should be updated next month when I get my money. But none of you know my last name anyway, so it doesn't really matter

[nakatago]

No, they asked if I wanted to be in the press release and/or their 'Thanks' page. I said no to the press release (since my employer may not look kindly on it), but yes to the 'Thanks' page since that is a bit more discrete. It should be updated next month when I get my money. But none of you know my last name anyway, so it doesn't really matter

That's nothing prism can't help...

[Brah]

Is it completely fixed now?

Sorry if that's a dumb question...

[zzm9980]

Is it completely fixed now?

Sorry if that's a dumb question...

Ya they blocked the ability to download this data last week while they purge it.

[zzm9980]

The ZDNet story is much more accurate and in-depth than most. It is also capturing a lot of the reaction to it.

The only error is that it implies you could only do it to friends; you could do it to anyone you chose who you obtained at least one email or phone number for.

http://www.zdnet.com/anger-mounts-after ... 000017167/

[Brah]

So did you get props somewhere?

[zzm9980]

So did you get props somewhere?

Yeah, $12,000 usd worth. I asked not to be listed in the articles. Sometime in the next month they'll update their list of people at facebook.com/whitehat/thanks with my name.

[sundaymorningstaple]

So did you get props somewhere?

See his third post.

[nakatago]

So did you get props somewhere?

Yeah, $12,000 usd worth.

Hurrah for bounties.

[zzm9980]

So did you get props somewhere?

Yeah, $12,000 usd worth.

Hurrah for bounties.

I can't imagine the blur looks I'll get if I try to use this anywhere in Singapore, with cashiers asking to see my I/C to verify my name is "Mr Bug Bounty".

Luckily, I can just use it as an ATM card. There is *1* ATM at Parkway it works in, which coincidentally is labelled as accepting international ATM cards. Why Citibank has 5 (almost) identical ATMs, and only one will take it is beyond me.

[nakatago]

Yeah, $12,000 usd worth.

Hurrah for bounties.

I can't imagine the blur looks I'll get if I try to use this anywhere in Singapore, with cashiers asking to see my I/C to verify my name is "Mr Bug Bounty".

Luckily, I can just use it as an ATM card. There is *1* ATM at Parkway it works in, which coincidentally is labelled as accepting international ATM cards. Why Citibank has 5 (almost) identical ATMs, and only one will take it is beyond me.

Fascinating. So they give the 'cash' in the form of a debit card. I thought they'd wire it or something.

[Mi Amigo]

That's the COOLEST payment card I've seen in a long time. Do we have to call you 'Mr. Bounty' from now on, or will 'Bug' be allowed?