Facebook's Reward for Bug Hunters

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--742952673-1495509421-1327898449=:11196
Content-Type: TEXT/PLAIN; CHARSET=UTF-8; FORMAT=flowed
Content-ID: <alpine.DEB.2.02.1201300023272.11748-+lq4ijtN3NWD1tnzEPnUTA@public.gmane.org>
Content-Transfer-Encoding: quoted-printable

Forwarded from: Simon Taplin <simon (at) simontaplin.net>

http://www.businessweek.com/magazine/facebooks-reward-for-bug-hunters-012=
62012.html

By Jordan Robertson
Security
BusinessWeek
January 26, 2012

Tal Be=E2=80=99ery was happy helping Facebook fight hackers for free. In =
2010,=20
when the computer security professional was looking into how identity=20
thieves, spammers, and other con artists used fake Facebook profiles to=20
mount scams, he discovered a flaw that put new users=E2=80=99 passwords a=
t risk=20
of interception.

So Be=E2=80=99ery did what ethical hackers are supposed to do: He ignored=
 the=20
payday he undoubtedly could get from selling the information to=20
criminals and alerted Facebook, which quickly fixed the problem. In=20
recognition, the world=E2=80=99s biggest social media company added Be=E2=
=80=99ery=E2=80=99s=20
name to a public list of researchers who have responsibly disclosed=20
Facebook bugs.

At the time, that was reward enough for the Tel Aviv resident. Today the=20
32-year-old wishes he had something more tangible to show for his=20
diligence=E2=80=94namely one of the debit cards Facebook began handing ou=
t to=20
bug catchers in July. The Visa-branded (V) cards are loaded with as=20
little as $500 or as much as $5,000=E2=80=94amounts vary depending on the=
=20
severity of the bug. More important, the shiny black cards are brimming=20
with geek cachet. There=E2=80=99s a whiff of exclusivity about them: Thin=
k=20
American Express=E2=80=99s (AXP) by-invitation-only Centurion cards, whic=
h are=20
also ebony. =E2=80=9CThat would be so great to get that,=E2=80=9D says Be=
=E2=80=99ery. =E2=80=9CTo tell=20
your grandchildren, =E2=80=98Papa was a hacker once.=E2=80=99 Just for th=
e symbolic=20
value.=E2=80=9D

The cheeky conceit behind Facebook=E2=80=99s debit cards underlines a ser=
ious=20
issue. Technology companies are torn about how to engage with=20
application developers or security researchers who spot bugs in the=20
course of their professional work or hobbies. Many businesses ignore=20
unsolicited tips from so-called white-hat hackers. Some even threaten=20
them with legal action. Criminals, governments, and sketchy middlemen=20
are willing to pay top dollar for the nastiest bugs=E2=80=94experts say b=
lack=20
market prices can go as high as $1 million.

[...]

--742952673-1495509421-1327898449=:11196
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_____________________________________________________
Did a friend send you this article? Make it your
New Year's Resolution to subscribe to InfoSec News!
http://www.infosecnews.org/mailman/listinfo/isn
--742952673-1495509421-1327898449=:11196--