Despite his hard work in getting the bug fixed, Facebook says Khalil will not be paid a reward for discovering the security vulnerability.
Facebook erupted in controversy on Saturday, when a Palestinian computer specialist going by the Facebook moniker of Khalil posted a warning about a major website bug on the wall of company CEO, Mark Zuckerberg. According to reports from RT.com, the security oversight would have allowed a Facebook user to post on the wall of any other searchable Facebook user, whether or not the two were connected as friends. Khalil demonstrated the flaw by posting directly on Zuckerberg’s wall.
According to the wall post, Khalil had tried multiple times to report the bug to Facebook’s security team, an entity that supposedly offers minimum rewards of $500 for such reports if they help to improve site security. However, when Khalil tried to report the bug via Facebook’s feedback page, he was greeted with error messages and rebuffs from the security team, who claimed the wall-posting loophole was, in fact, not a bug.
“First sorry for breaking your privacy and post on your wall, I has no other choice after all the reports I sent to Facebook team,” Khalil wrote in his Facebook post to Zuckerberg, going on to describe the security vulnerability, as well as his failed attempts to get Facebook’s security team to recognize it. He concluded the message by asking Mark to have someone from Facebook contact him.
From there, it only took minutes for the Facebook security team to spring into action. Khalil received a near-instantaneous message from a Facebook engineer inquiring for a full and detailed report of the vulnerability–even though Khalil had already submitted such reports twice. Facebook then went to work in fixing the size’s wall-posting flaw.
Despite his hard work in getting the bug fixed, Facebook says Khalil will not be paid a reward for discovering the security vulnerability. In fact, the Palestinian computer specialist got little thank you from the social media site, who blocked his account and accused him of violating the security terms of service that go along with reporting bugs.
Facebook’s White Hat security feedback program does come with a range of rules for security analysts looking to discover and report security vulnerabilities. However, Facebook did not provide a specific list of grievances for which Khalil was guilty, nor did they consider bending the rules as a result of their own role in forcing Khalil to take extreme measures.
It’s unclear exactly how much Khalil would have been paid: White Hat specifies $500 as the minimum pay-out for bug discovery, but offers no guideline for how much can be paid at max. Considering the serious and visible nature of Khalil’s wall-posting bug, however, it is entirely possible that the Palestinian analyst would have been due a large sum of money.
Leave a Reply