Facebook has reportedly paid a $40,000 bounty to Andrew Leonov, a security researcher who managed to breach the social networking site using a remote code execution bug he discovered and privately reported to the company.
Leonov explained in a post he published that he managed to “break” the social network using an ImageMagick flaw that was actually discovered and patched last year. The vulnerability, however, still affects Facebook, and the security expert found a way to use it as part of a remote code execution.
In a timeline posted on blog , Leonov says he reported the flaw on October 16, and after further investigation, the company fixed it only a few days later.
The hacker says he discovered the vulnerability by accident after being directed to Facebook from another service, but decided to look into it to see if the ImageMagick flaw had been patched or not.
"Sometime on a Saturday in October I was reviewing another major service (not on Facebook) when some redirect followed me to Facebook. It was a 'Share on Facebook' that led him there," he says. "I'm happy to be one of the people who broke Facebook.".
Since the vulnerability was reported privately, there is no user data at risk, so rest assured that everyone's accounts are not at risk.
The hacker claims to have received a $40,000 bounty from the social network, and this appears to be the largest financial reward ever paid to a researcher by a company. As The Reg reports, the previous highest reward was $33,500 to Reginaldo Silva who also discovered a remote code execution bug.
Facebook has not yet made any statement regarding this bug, but since the patch has already been released, there's not much to say, except that everyone is not at risk.
