10 Year Old Awarded 10k For Instagram Vulnerability

meow · 05-06-2016, 01:27 AM

(05-06-2016, 01:10 AM)Pirate Wrote: Did they ever reveal how the vuln was performed? (Since its patched now obviously)

If it has to do with an API and anyone being able to delete comments, it's safe to assume it was probably an insecure direct object reference. If it's not, my second best guess would be something to do with sessions. Neither would be hard to do or create a PoC for, it's just a matter of who gets to it first.

Pirate · 05-06-2016, 01:39 AM

(05-06-2016, 01:27 AM)meow Wrote: If it has to do with an API and anyone being able to delete comments, it's safe to assume it was probably an insecure direct object reference. If it's not, my second best guess would be something to do with sessions. Neither would be hard to do or create a PoC for, it's just a matter of who gets to it first.

Well, that's impressive if a 10 year old would fine something like that.

wait why does a 10 year old have an instagram anyway

mothered · 05-06-2016, 04:36 AM

(05-06-2016, 12:30 AM)Oni Wrote: Paypal doesn't pay minors for their bug bounty:
https://nakedsecurity.sophos.com/2013/05...ding-teen/

Amazing.

Irrespective of age, either the XSS vulnerability Is found or It Isn't. If PayPal Is concerned of their so-called minimum age requirements (and neglect to pay minors), they should simply award the bounty when the minor reaches their age requirement.

This just demonstrates PayPal's lack of appreciation when security Issues and flaws are discovered In their overall Infrastructure.

Jacket · 05-06-2016, 12:56 PM

Damn I want $10,000. Time to start hunting for Instagram bugs!

Typo · 05-10-2016, 07:58 PM

Pretty late but gratz to him. Cool kid, especially cuz I'm from finland B)

mothered · 05-11-2016, 03:55 AM

(05-10-2016, 07:58 PM)Typo Wrote: Pretty late but gratz to him.

Definitely so.

In my days when I was that age, household computers were no-existent. All I was doing mostly was hanging out with friends (when I wasn't grounded). Nowadays, It's all about technology. This kid certainly deserves every penny paid.

Dean Winchester · 05-12-2016, 03:56 AM

Saw it in the news earlier. The kid's really lucky. $10k would mean a lot for someone of his age.

Endgame · 05-14-2016, 10:23 AM

All I can think after reading this is, "Damn, a 10 year old knows way more than me. WTF."
Almost makes me wanna stop smoking pot & buckle down on teaching myself what I can.

mothered · 05-14-2016, 02:24 PM

(05-14-2016, 10:23 AM)Endgame Wrote: All I can think after reading this is, "Damn, a 10 year old knows way more than me. WTF."

He may have just been at the right place at the right time (before anyone else discovered It), and happened to stumble across It.

It was a good find, but In my views, nothing that anyone dedicated to IT security couldn't do themselves.

fiddlesticks · 11-26-2016, 03:02 PM

(05-06-2016, 12:57 AM)insidious Wrote: That kid is going to be swimming in Minecraft and PC parts galore when he's paid out.

If only I had 10K as a then year old....

Hopefully his parents slap 9k in a savings account and don't let anybody touch it until he's 18.