Meta announced that it is expanding its bug bounty program to start rewarding valid reports of scraping vulnerabilities across its platforms and also include reports of scraping data sets that are available online.
Dan Gurfinkel, security engineering manager at Meta said that automated activity designed to scrape people’s public and private data targets every website or service. It is a highly adversarial space where scrapers — be it malicious apps, websites or scripts — constantly adapt their tactics to evade detection in response to the defenses they build and improve.
The social media giant aims to monetarily compensate for valid reports of scraping bugs in its service and identify unprotected or openly public databases containing no less than 100,000 unique Facebook user records with personally identifiable information (PII) such as email, phone number, physical address, religious, or political affiliation. The only condition is that reported data set must be unique and not previously known.
If the requisite criteria is met, the company would take appropriate measures, including legal actions, to remove the data from the non-Meta website. This could also involve reaching out to hosting providers like Amazon, Box, and Dropbox to pull the data set offline, or working with third-party app developers to address server misconfigurations. Reports concerning scraped databases will be rewarded through matched charity donations of the researchers’ choosing.
Gurfinkel stated that their goal is to identify and counter scenarios that might make scraping less costly for malicious actors to execute. He added that they wish to encourage research into logic bypass issues that can allow access to information via unintended mechanisms, even if proper rate limits exist.
Comments