Engineer nets Facebook's biggest bug bounty, but not the jackpot he hoped for

Reginaldo Silva was awarded $33,500, but had quietly hoped for more

Reginaldo Silva, a computer engineer in Brazil, found a serious problem in Facebook's website, but the company isn't revealing how much it paid him.

Reginaldo Silva, a computer engineer in Brazil, found a serious problem in Facebook's website, but the company isn't revealing how much it paid him.

Last November Reginaldo Silva, a computer engineer in Brazil, found one of the worst kinds of vulnerabilities in Facebook's software. It has netted him the biggest bug bounty the social network has ever paid out, but while he's not complaining, it wasn't quite the windfall he hoped for.

The bug related to code used for OpenID, an authentication system that lets people use the same login credentials for multiple online services.

Silva found that the vulnerability could be executed from a remote computer, one of the most dangerous types of software flaws. It could have allowed a hacker to read almost any file and open arbitrary network connections on a Facebook server.

"I knew I had found the keys to the kingdom," Silva wrote on his blog.

Facebook didn't reveal in its own blog post Wednesday how much it paid him for finding the bug, saying only that it was the company's "biggest bug bounty payout ever." But with Silva's permission, a Facebook spokesman later revealed that the amount was $33,500.

Silva gently noted in his blog something that Facebook's director for Security Incident Response reportedly said in July 2012. Bloomberg quoted the director, Ryan McGeehan, as saying, "If there's a million-dollar bug, we will pay it out."

That got Silva's hopes up, especially after Facebook told him his payout would be raised since the bug he found was a remotely executable one.

"I won't disclose the amount, but if you have any comments about how much you think this should be worth, please share them," Silva wrote in his blog post. "Unfortunately, I didn't get even close to the $1 million dollar payout cited above."

Facebook has concluded that no one exploited the flaw. A thriving underground market exists for such information, though it's difficult to put a price on it. If millions of Facebook users' data had been compromised, the backlash could have been costly and hurt the social network's reputation.

Silva notified Facebook of the flaw on Nov. 19. The social networking site said Wednesday it had alerted on-call employees and pushed out a short-term fix in just three and a half hours.

Facebook pays a minimum of $500 for a vulnerability that qualifies under its terms and conditions. There is no maximum reward, it says in its information about bug bounties: "each bug is awarded a bounty based on its severity and creativity."

The bug, which Silva found in September 2012, wasn't unique to Facebook; he found it had affected other web services, including two Google services: App Engine and Blogger. After alerting Google to the issues, he decided to see if Facebook was affected too.

Silva wrote there are many servers on the Internet that are still vulnerable, which is why he didn't publish proof-of-concept code that would show how the flaw could be abused.

Google awarded him $500 for pointing out the issue, Silva wrote. He posted the technical details in his write-up.

Send news tips and comments to Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags securitydata breachdata protectionExploits / vulnerabilitiesFacebook

More about BloombergFacebookGoogle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts