Facebook has announced the expansion of its bug bounty program to include third-party apps and websites that allow people log into them using Facebook credentials.
The social network said that it will focus on access tokens that are created during logins for users and apps.
Dan Gurfinkel, Facebook security engineering manager, said that while a user can decide what information the token and app can access as well as what actions can be taken, "if exposed, a token can potentially be misused, based on the permissions set by the user".
"We want researchers to have a clear channel to report these important issues, and we want to do our part to protect people's information, even if the source of a bug is not in our direct control," he added.
To that end, Facebook has updated its terms of service for the bug bounty program to include information about what it expects from these reports.
"For example, researchers should make sure to include a clear proof-of-concept demonstrating a vulnerability that could allow access or misuse of user access tokens associated with apps on the Facebook platform," said Gurfinkel.
He added that the social network will only accept reports if the bug is discovered by passively viewing the data sent to or from a device while using the vulnerable app or website. Potential bounty hunters will not be permitted to manipulate any request sent to the app or website from their device, or otherwise interfere with the ordinary functioning of the app or website in connection with submitting their report.
Facebook will pay at least $500 for any vulnerable app or website that involve "improper exposure of Facebook user access tokens".
Once a bug has been confirmed by Facebook, it will then contact the app or website developer to fix their code. "We will also automatically revoke access tokens that could have been compromised to prevent potential misuse, and alert those we believe to be affected," said Gurfinkel.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Should your business start a bug bounty program?In-depth Big tech firms including Google, Apple and Microsoft offer bug bounty programs, but can they benefit smaller businesses too?
-
OpenAI to pay up to $20k in rewards through new bug bounty programNews The move follows a period of unrest over data security concerns
-
Windows 11 System Restore bug preventing users from accessing appsNews Microsoft has issued a series of workarounds for the issue which is affecting a range of apps including Office and Terminal
-
Windows 10 users encounter ‘blue screen of death’ after latest Patch Tuesday updateNews Microsoft said it is working on a fix for the issue and has offered users a temporary workaround
-
SpaceX bug bounty offers up to $25,000 per Starlink exploitNews The spacecraft manufacturer has offered white hats immunity to exploit a wide range of Starlink systems, with a dedicated report page
-
Microsoft announces lucrative new bug bounty awards for M365 products and servicesNews The new awards will focus on scenario-based weaknesses and offer bonuses of up to 30% for the most severe bugs
-
Adobe forced to patch its own failed security updateNews Company issues new fix for e-commerce vulnerability after researchers bypass the original update
-
Google doubles bug bounty rewards for Linux, Kubernetes exploitsNews The increased rewards are said to align better with the community's expectations of a bug bounty programme of this kind
