+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: 10 Year Old Awarded 10k For Instagram Vulnerability (/Thread-10-Year-Old-Awarded-10k-For-Instagram-Vulnerability)
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - meow - 05-06-2016
(05-06-2016, 01:10 AM)Pirate Wrote: Did they ever reveal how the vuln was performed? (Since its patched now obviously)
If it has to do with an API and anyone being able to delete comments, it's safe to assume it was probably an insecure direct object reference. If it's not, my second best guess would be something to do with sessions. Neither would be hard to do or create a PoC for, it's just a matter of who gets to it first.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - Pirate - 05-06-2016
(05-06-2016, 01:27 AM)meow Wrote: If it has to do with an API and anyone being able to delete comments, it's safe to assume it was probably an insecure direct object reference. If it's not, my second best guess would be something to do with sessions. Neither would be hard to do or create a PoC for, it's just a matter of who gets to it first.
Well, that's impressive if a 10 year old would fine something like that.
wait why does a 10 year old have an instagram anyway
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - mothered - 05-06-2016
(05-06-2016, 12:30 AM)Oni Wrote: Paypal doesn't pay minors for their bug bounty:
https://nakedsecurity.sophos.com/2013/05/29/paypal-refuses-to-pay-bug-finding-teen/
Amazing.
Irrespective of age, either the XSS vulnerability Is found or It Isn't. If PayPal Is concerned of their so-called minimum age requirements (and neglect to pay minors), they should simply award the bounty when the minor reaches their age requirement.
This just demonstrates PayPal's lack of appreciation when security Issues and flaws are discovered In their overall Infrastructure.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - Jacket - 05-06-2016
Damn I want $10,000. Time to start hunting for Instagram bugs!
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - Typo - 05-10-2016
Pretty late but gratz to him. Cool kid, especially cuz I'm from finland B)
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - mothered - 05-11-2016
(05-10-2016, 07:58 PM)Typo Wrote: Pretty late but gratz to him.
Definitely so.
In my days when I was that age, household computers were no-existent. All I was doing mostly was hanging out with friends (when I wasn't grounded). Nowadays, It's all about technology. This kid certainly deserves every penny paid.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - Dean Winchester - 05-12-2016
Saw it in the news earlier. The kid's really lucky. $10k would mean a lot for someone of his age.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - Endgame - 05-14-2016
All I can think after reading this is, "Damn, a 10 year old knows way more than me. WTF."
Almost makes me wanna stop smoking pot & buckle down on teaching myself what I can.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - mothered - 05-14-2016
(05-14-2016, 10:23 AM)Endgame Wrote: All I can think after reading this is, "Damn, a 10 year old knows way more than me. WTF."
He may have just been at the right place at the right time (before anyone else discovered It), and happened to stumble across It.
It was a good find, but In my views, nothing that anyone dedicated to IT security couldn't do themselves.
RE: 10 Year Old Awarded 10k For Instagram Vulnerability - fiddlesticks - 11-26-2016
(05-06-2016, 12:57 AM)insidious Wrote: That kid is going to be swimming in Minecraft and PC parts galore when he's paid out.
If only I had 10K as a then year old....
Hopefully his parents slap 9k in a savings account and don't let anybody touch it until he's 18.