|
|
|
|
|
by emilenchev
2055 days ago
|
|
Facebook - emilenchev1978@yahoo.com :-) $1,000,000 now or $100,000,000 after several months - your choice. I give you choice and back in 2018, remember? You make one, the wrong. Now to understand if you become smarter for these 2 years. As I see you don't make many progress from my intellectual property yet. This time you will have opportunity to look in a future again but not from my PC, more like in arXiv.org. And ohh, believe me I will start to talk about our relationship in the past if you don't pay me these $100M. And don't worry I think about how it will, happens. You will buy my dummy high tech company for $100,000,000 without any know-how in it ;-) because I'm sure that you are dumb enough to not pay me $1M now. You will see. |
|
https://www.facebook.com/login/identify/?ctx=recover&ars=fac...
Then I asked myself a simple question "What if...?" Facebook has around 2 billion monthly active users in 2017. This was roughly about 1/4 of the human population. "What if...I make a BOT to create RANDOM phone numbers and it starts making requests to Facebook's servers to reap their user phones, profile photos and names from their database?" Their users are so many that I will always hit a number sooner or later if there is no protection system against automated requests.
Guess what? I start to reap phone number after phone number of their users and Facebook had no proper protection against automated bots requests :-)
Carefully considered synchronized bots attack on Facebook servers and soon you will have the phones, picture and names at least of 1/6 of the earth population. How much will this information cost?
But I was moral enough (and dumb) to provide them with information about this SECURITY bug on the proper channel and Facebook technical support. 'That would at least bring me a few thousand dollars' I thought naively then. After all, information about this bug was sent to them according to all their rules for "Bug Bounty", I have not retrieved information about their users except to verify this security breach... I even sent them Python program code with which they can see for themselves how it retrieve phones from their database.
Not only did they not pay me a penny for bounty reward - they didn't tell anyone about this security breach in 2017 - they quietly fixed their "login form" so that this bug can no longer be used and exploit.
This happens when you try to be moral and there are crooks in front of you.