Hacker who exposed Facebook bug to get reward from unexpected source

BOSTON Tue Aug 20, 2013 4:33pm EDT

The sun rises behind the entrance sign to Facebook headquarters in Menlo Park before the company's IPO launch, May 18, 2012. REUTERS/Beck Diefenbach

The sun rises behind the entrance sign to Facebook headquarters in Menlo Park before the company's IPO launch, May 18, 2012.

Credit: Reuters/Beck Diefenbach

BOSTON (Reuters) - A man who hacked into Mark Zuckerberg's Facebook page to expose a software bug is getting donations from hackers around the world after the company declined to pay him under a program that normally rewards people who report flaws.

Khalil Shreateh discovered and reported the flaw but was initially dismissed by the company's security team. He then posted a message on the billionaire's wall to prove the bug's existence.

Now, Marc Maiffret, chief technology officer of cybersecurity firm BeyondTrust, is trying to mobilize fellow hackers to raise a $10,000 reward for Shreateh after Facebook refused to compensate him.

Maiffret, a high school dropout and self-taught hacker, said on Tuesday he has raised about $9,000 so far, including the $2,000 he initially contributed.

He and other hackers say Facebook unfairly denied Shreateh, a Palestinian, a payment under its "Bug Bounty" program. It doles out at least $500 to individuals who bring software bugs to the company's attention.

"He is sitting there in Palestine doing this research on a five-year-old laptop that looks like it is half broken," Maiffret said. "It's something that might help him out in a big way."

Shreateh uncovered the flaw on the company's website that allows members to post messages on the wall of any other user, including Zuckerberg's. He tried to submit the bug for review but the website's security team did not accept his report.

He then posted a message to Zuckerberg himself on the chief executive officer's private account, saying he was having trouble getting his team's attention.

"Sorry for breaking your privacy," Shreateh said in the post.

The bug was quickly fixed and Facebook issued an apology on Monday for having been "too hasty and dismissive" with Shreateh's report. But it has not paid him a bounty.

"We will not change our practice of refusing to pay rewards to researchers who have tested vulnerabilities against real users," Chief Security Officer Joe Sullivan said in a blogpost.

He said Facebook has paid out more than $1 million under that program to researchers who followed its rules.

(Reporting by Jim Finkle; Editing by Xavier Briand)

We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
Comments (4)
ArghONaught wrote:
Arrogant. They were dismissive so he did a demo, and they are not happy about that. Would it be they will always be dismissive to open that loophole to avoid giving the small change they used to provide hackers?

Aug 20, 2013 6:37pm EDT  --  Report as abuse
Swaggimos wrote:
He should have just sold the information to an advertising company, he would have probably got 100 times the amount he got

Aug 20, 2013 9:31pm EDT  --  Report as abuse
thoma wrote:
well deserved , Zukerman should have given a few grand from his owm billions but there you go

Aug 20, 2013 12:33am EDT  --  Report as abuse
This discussion is now closed. We welcome comments on our articles for a limited period after their publication.