Facebook gives UK man $20k for discovering security flaw

Facebook employee holds a mobile phone The flaw exploited a loophole in Facebook's password resetting system

Related Stories

Facebook has rewarded a British man with $20,000 (£13,000) after he found a bug which could have been exploited to hack into users' accounts.

Jack Whitton, a security researcher, discovered a flaw in the social network's text messaging system.

Facebook thanked Mr Whitton, 22, who is part of the site's "responsible disclosure" hall of fame.

The company, like many on the web, encourages experts to report bugs to them rather than cybercriminals.

To make it worth their while, rewards are offered of varying amounts depending on the severity of the flaw.

Such programmes are known as "bug bounties", with similar schemes being run at the likes of Microsoft, Paypal and Google.

"Facebook's White Hat programme is designed to catch and eradicate bugs before they cause problems," Facebook told the BBC.

"Once again, the system worked and we thank Jack for his contribution."

The bug, which has now been fixed, allowed Mr Whitton to spoof Facebook's text message verification system into sending a password reset code for an account that was not his.

Using this, he could go to Facebook, reset a target user's password, and access the account.

Start Quote

It could have been worth an awful lot more money”

End Quote Graham Cluley Security expert
'PR disaster'

Mr Whitton is what is known in security communities as a "white hat" hacker - someone who can discover security holes and faults in software, but chooses not to use them for criminal gain.

On the other side of people like Mr Whitton are black hat hackers - the bad guys - who will sell their skills and services to cybercriminal gangs and organisations.

The Facebook bug would have been of great interest to cybercriminals, noted Graham Cluley, a security expert.

"It could have been worth an awful lot more money," he told the BBC.

"Imagine if he were a black hat hacker, one of the bad guys, if he were to offer his services to criminals saying any account they wanted breaking in to, he could do it."

He said Facebook should be "extremely grateful" that Mr Whitton opted to report it to them.

"It could have been a PR disaster," he told the BBC.

"This security flaw is terrible. It should never have existed. It's a gaping hole, thank goodness it's closed now. We are really relying on the goodwill of researchers."

Follow Dave Lee on Twitter @DaveLeeBBC

More on This Story

Related Stories

More Technology stories


Features & Analysis

  • Baby in boxStrange case

    The remarkable appeal of the Finnish baby boxes

  • WW1 gas mask being demonstratedTrench terror

    Did the soldiers of WW1 have an irrational fear of poison gas?

  • Mitt Romney, speaks at the podium as he concedes the presidency during Mitt Romney's campaign election night event at the Boston Convention 7 November 2012Aura of a loser?

    Mitt Romney looked presidential but could never pull it off

  • A woman holds up a feminist sign.PC virus

    Is liberal speech policing out of control?

BBC Future

(Getty Images)

The secret to eternal life

What if we could back-up our brains?


  • A car being driven by Cruise Automation technologyClick Watch

    The tech which could allow any car with an automatic gearbox to become self-driving

Copyright © 2015 BBC. The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.