FACEBOOK’S BUG BOUNTY :

Image source [1]

A bug bounty program is a deal offered Facebook by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities. Since 2011, Facebook has been paying monetary rewards to researchers who report flaws that could compromise the integrity or privacy of user data or could enable access to systems within its infrastructure. Find below one of the recent legitimate case which received a reward.

FACEBOOK’S BUG BOUNTY NOTICE

“If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly fix the problem. Before reporting though, please review this page including our responsible disclosure policy, reward guidelines, and those things that should not be reported.”

FACEBOOK PHOTOS HACKED & VULNERABILITY EXPOSED BY YOUNG GEEKS.

Image resource [1]

22 year old student from India, Laxman Muthiyah was able to delete photo album of any Facebook user, using just 4 lines of codes. Laxman was playing around with Facebook’s Graph API and Facebook Access Tokens, when suddenly he discovered this vulnerability. All needed was the unique access token which is assigned to every Facebook profile, which appears in the URL of all photos, albums and posts of that user. Or, in layman’s language, album deleted. Considering that he had no evil intentions, he immediately contacted Facebook’s security team, which responded within 2 hours, and rectified this security flaw.

The Facebook Bug Bounty Program, which rewards such reporting of security flaws recognized the awesome work done by Laxman, and rewarded him with $12,500

There are more than 350 million images uploaded everyday on Facebook, and there are 1.2 billion users of this website. Imagine the mayhem and destruction which Laxman could have done from this exploit. $12,500 reward, is actually only a fraction of what could have been the consequences.

In 2014, Facebook paid bug bounties totaling $1.3 million to 321 researchers from 65 countries. The average reward was $1,788 and the top three countries where valid bug reports originated were India, with 196 submissions; Egypt, with 81 and the U.S. with 61.

Bug bounty program allow the developers to discover and resolve bugs before the general public is aware of them, preventing incidents of widespread abuse.

RESOURCE (EXTERNAL LINKS)

[1] Facebook Hacked By Young Geeks - Referred on 2015-02-12
[2] WikiPedia  - Referred on 2015-02-15

---