Facebook breach

zzm9980 · Post by **zzm9980** » Sat, 22 Jun 2013 9:10 am

This is what I mentioned to some of you last night. I was the "security researcher" (hah) that found it and reported to them.

https://www.facebook.com/notes/facebook ... 7074840766

http://allthingsd.com/20130621/facebook ... e-numbers/

http://www.nytimes.com/2013/06/22/busin ... users.html

http://www.theregister.co.uk/2013/06/21 ... tact_leak/

http://www.theverge.com/2013/6/21/44532 ... lion-users

zzm9980 · Post by **zzm9980** » Sat, 22 Jun 2013 9:11 am

Facebook obviously is downplaying what this meant. And fair enough to them.

Here is how it actually worked:

1) Create a contact named ââ‚¬Å“Mark Zuckerbergââ‚¬Â

Post by **nakatago** » Sat, 22 Jun 2013 9:13 am

zzm9980 wrote:This is what I mentioned to some of you last night. I was the "security researcher" (hah) that found it and reported to them.

https://www.facebook.com/notes/facebook ... 7074840766

http://allthingsd.com/20130621/facebook ... e-numbers/

http://www.nytimes.com/2013/06/22/busin ... users.html

http://www.theregister.co.uk/2013/06/21 ... tact_leak/

http://www.theverge.com/2013/6/21/44532 ... lion-users

I've heard about it but I didn't read the articles any more. Because it's Facebook--s#!+ like this always happens with them because it's almost always of their carelessness.

Anyway, do you personally get press time because of this? I should've taken my picture with you.

zzm9980 · Post by **zzm9980** » Sat, 22 Jun 2013 9:17 am

No, they asked if I wanted to be in the press release and/or their 'Thanks' page. I said no to the press release (since my employer may not look kindly on it), but yes to the 'Thanks' page since that is a bit more discrete. It should be updated next month when I get my money. But none of you know my last name anyway, so it doesn't really matter

Post by **nakatago** » Sat, 22 Jun 2013 9:20 am

zzm9980 wrote:No, they asked if I wanted to be in the press release and/or their 'Thanks' page. I said no to the press release (since my employer may not look kindly on it), but yes to the 'Thanks' page since that is a bit more discrete. It should be updated next month when I get my money. But none of you know my last name anyway, so it doesn't really matter

That's nothing prism can't help...

Brah · Post by **Brah** » Sat, 22 Jun 2013 10:44 am

Is it completely fixed now?

Sorry if that's a dumb question...

zzm9980 · Post by **zzm9980** » Sat, 22 Jun 2013 11:39 am

Brah wrote:Is it completely fixed now?

Sorry if that's a dumb question...

Ya they blocked the ability to download this data last week while they purge it.

zzm9980 · Post by **zzm9980** » Mon, 24 Jun 2013 5:36 pm

The ZDNet story is much more accurate and in-depth than most. It is also capturing a lot of the reaction to it.

The only error is that it implies you could only do it to friends; you could do it to anyone you chose who you obtained at least one email or phone number for.

http://www.zdnet.com/anger-mounts-after ... 000017167/

Brah · Post by **Brah** » Tue, 25 Jun 2013 8:03 pm

So did you get props somewhere?

zzm9980 · Post by **zzm9980** » Tue, 25 Jun 2013 8:37 pm

Brah wrote:So did you get props somewhere?

Yeah, $12,000 usd worth. I asked not to be listed in the articles. Sometime in the next month they'll update their list of people at facebook.com/whitehat/thanks with my name.

Post by **sundaymorningstaple** » Tue, 25 Jun 2013 8:40 pm

Brah wrote:So did you get props somewhere?

See his third post.

Post by **nakatago** » Tue, 25 Jun 2013 9:09 pm

zzm9980 wrote:
Brah wrote:So did you get props somewhere?
Yeah, $12,000 usd worth.

Hurrah for bounties.

zzm9980 · Post by **zzm9980** » Sun, 21 Jul 2013 1:26 pm

nakatago wrote:
zzm9980 wrote:
Brah wrote:So did you get props somewhere?
Yeah, $12,000 usd worth.
Hurrah for bounties.

I can't imagine the blur looks I'll get if I try to use this anywhere in Singapore, with cashiers asking to see my I/C to verify my name is "Mr Bug Bounty".

Luckily, I can just use it as an ATM card. There is *1* ATM at Parkway it works in, which coincidentally is labelled as accepting international ATM cards. Why Citibank has 5 (almost) identical ATMs, and only one will take it is beyond me.

Post by **nakatago** » Sun, 21 Jul 2013 1:30 pm

zzm9980 wrote:
nakatago wrote:
zzm9980 wrote: Yeah, $12,000 usd worth.
Hurrah for bounties.

I can't imagine the blur looks I'll get if I try to use this anywhere in Singapore, with cashiers asking to see my I/C to verify my name is "Mr Bug Bounty".

Luckily, I can just use it as an ATM card. There is *1* ATM at Parkway it works in, which coincidentally is labelled as accepting international ATM cards. Why Citibank has 5 (almost) identical ATMs, and only one will take it is beyond me.

Fascinating. So they give the 'cash' in the form of a debit card. I thought they'd wire it or something.

Mi Amigo · Post by **Mi Amigo** » Sun, 21 Jul 2013 3:44 pm

That's the COOLEST payment card I've seen in a long time. Do we have to call you 'Mr. Bounty' from now on, or will 'Bug' be allowed?

SINGAPORE EXPATS FORUM
Singapore Expat Forum and Message Board for Expats in Singapore & Expatriates Relocating to Singapore

Facebook breach

Facebook breach

Re: Facebook breach

Who is online