SecurityWeek reports that Facebook parent firm Meta has expanded its bug bounty program to include rewards for flaws that could be abuse to evade Facebook integrity checks, including two-factor authentication for some business manager accounts, as well as the platform's feature restrictions and application verification processes.
Meta will be awarding up to $2,000 to researchers determining endpoints that could be bypassed by Business Manager 2FA prompts, while rewards of up to $20,000 and up to $15,000 could be given to researchers identifying issues enabling the creation of "an arbitrary amount of prepaid balance without using a valid payment method," and the omission of "an arbitrary outstanding balance without a valid payment," respectively, according to Meta.
Researchers could also be given up to $20,000 for discovering techniques for ad revenue generation through fake impressions. Meanwhile, up to $10,000 could be awarded to those who could identify novel highly scalable and exploitable attack vectors.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.