How I got my First $$$$ bounty from finding a bug in Facebook:

3 min readApr 17, 2021

Hi, I am Aashish Jung Kunwar from Dhangadhi ,Nepal. I am student studying at Grade 11. I am totally a new and a beginner in this field. Today, I will be showing you what exactly I did to get the bug that I discovered qualify for the Facebook Bug Bounty Program which made me earn $1000 as a reward from the Facebook Security Team and became one of the youngest Nepali to get Bounty reward from Facebook.

How I got my 1st bounty:

I have a quite different story. I didn’t know how to turn on the computer till when I was in grade 9. After the first wave of the Corona pandemic, I got access to use mobile phones. Then I started using Facebook and met Saurav Subedi there. He approached me to be an admin of Nepal Educational Hub in Chaitra 11, 2076(24 March,2020). The situation was full of the corona pandemic. All the schools , colleges and educational institutions were closed. Nepal Educational Hub was one of the platforms to assist the environment of learning. We started sharing notes, solutions , and problems in NEH with the common motto of “Help and Be Helped “. Being an admin I found errors while managing the group and page. But , I didn’t know about this bug bounty platform first off . Later on , I came to know about it from Saugat Pokharel.

I reported my first bug on November 24 , 2020 and went duplicate . I was disappointed to know that my first report gone duplicate .But ,I kept on reporting . Again , most of them went duplicates . Finally I grabbed one and rewarded with bounty reward of $1000 from Facebook .

About the bug:

Personal and Page Profile Interaction error in Facebook group . (The voice selector failed to work correctly ). I found a technical security issue while I was doing comment via personal profile it was done from the Facebook page.

What I Submitted :

Title : COMMENT GOES FROM PAGE PROFILE INSTEAD OF PERSONAL PROFILE .

Vuln Type: Identification / Deanonymization

Product Area :Facebook — Android

Complete Details :

UserOne who is the member of GroupOne with his profile and his page PageOne.
When UserOne comments on group post in GroupOne the comment goes as PageOne instead of UserOne.

Impact:

Interaction happens as page profile instead of personal profile.

Repro steps:

Setup:

Users: UserOne is Personal profile , PageOne is Page , GroupOne is Group. UserOne is owner of PageOne.

Environment: UserOne who is the member of GroupOne and also his PageOne is also the member of the group is interacting with GroupOne’s Post.

App version: Facebook for Andriod

Steps:

1.Logged in Facebook as UserOne.
2.Then posted in GroupOne interacting as UserOne.
3.Random Users comment on that post . UserOne commented or replied in that post by clicking on notification viz. Someone commented on your post in GroupOne but comment went through PageOne profile. And , While commenting randomly on Post , comment also went through PageOne.