
Khalil Shreateh (pictured above) first contacted the Facebook
security team after proving a glitch was real bywriting on the wall of
a friend of the Facebook founder.
But instead of thanking him and fixing the issue, Facebook said
it wasn't a bug. And because of the methods Shreateh used to finally convince
them of the threat, Facebook later denied him the reward usually
given to programmers who report holes in the site’s security.
See his letter
below:
‘My
name is Khalil Shreateh. I finished school with B.A degree in Information
Systems . I would like to report a bug in your main site (www.facebook.com)
which i discovered it...The bug allow Facebook users to share links
to other facebook users ,
I tested it on Sarah.Goodin wall and I got success post.’
I tested it on Sarah.Goodin wall and I got success post.’
However, instead of repairing the obvious security breach, Facebook replied
to Shreateh by saying the issue‘was not a bug.’
Undeterred, Shreateh used the glitch to hack his way
onto Mark Zuckerberg’s Facebook page and wrote:
‘Sorry
for breaking your privacy,’ he wrote in a since removed post to Zuckerberg, ‘I
had no other choice…after all the reports I sent to Facebook team.’
Minutes later, his pleas were answered. Facebook contacted
him demanding to know how he’d hacked their bosses personal page.
‘We
fixed this bug on Thursday,’ wrote Matt Jones from Facebook’s security team in a Saturday
post on Hacker News.
Facebook has a bounty program designed to bribe hackers
into reporting glitches they find rather than exploiting them. Such validated
reports are worth $500.
But in his post, Jones explains that Shreateh will not be
getting his money.
‘In
order to qualify for a payout you must "make a good faith effort
to avoid privacy violations" and "use a test account instead
of a real account when investigating bugs,”’Jones writes.
Shreateh now claims that Facebook has disabled his account.
See Khalil Shreateh's Blog HERE
See Khalil Shreateh's Blog HERE
No comments:
Post a Comment