Research worker nets $30k when exposing users’ personal content
Indian bug hunter Mayur Fartade claimed the prize from Facebook’s bug bounty program for an exploit that revealed victims’ private and archived posts, stories, video reels, and IGTVs (long-form, immersive videos).
The exploit, which did not require victims to accept the attacker as a follower, involved brute-forcing the target’s Media ID and sending a POST request to one of two vulnerable endpoints, explained Fartade in a blog post. Continue Reading