How Meta and the security industry collaborate to secure the internet

Why Meta is publishing regular security bulletins

Bug hunting is difficult work, and much of it happens out of sight. The goal is to identify and patch flaws before attackers can weaponize them, which means the best security outcomes often generate little public noise. Meta believes that sharing findings more consistently will help advance the industry, so it is introducing a regular Bug Bulletin series. The first edition covers vulnerabilities found in Meta's own code and in third-party software, along with notable bug bounty results.

Meta's security approach is built on defense-in-depth. Since even the best-written software can contain flaws, the company layers protections across its platform while also investing in code quality. Its security work combines automated tooling, security reviews, red team exercises, and an active bug bounty program. Findings from one part of the codebase frequently inform security work elsewhere.

Scaling bug detection with static analysis

Automated static analysis tools allow Meta to scrutinize large codebases while freeing engineers to focus on more complex scenarios. The company's homegrown tooling, developed and refined over the past five years, now surfaces about 70 percent of the security vulnerabilities Meta discovers. One such tool, Zoncolan, which reviews Hack code, has identified more than 1,300 bugs this year alone.

Zoncolan recently caught a back-end bug in Messenger that could have let an attacker inject a fake "You celebrated a friendversary with a friend" message into a chat thread between any two users. The fabricated message would appear in a recipient's Chat List if they were already connected, or in their Message Request folder if they weren't. A malicious actor could have used this to feign a long-term relationship for scam purposes. Zoncolan flagged the issue by noticing that certain endpoints accepted user input and used it to construct a viewer context. The vulnerable endpoints had no front-end integration and weren't visible in any production app. Meta's team reviewed the report, found no signs of exploitation, and mitigated the affected endpoints.

Collaborating with vendors on third-party vulnerabilities

Meta's Red Team X unit hunts bugs in external hardware and software as part of its responsible disclosure efforts. The team regularly reports findings to companies and works with them to verify fixes. Recent work includes several notable industry collaborations.

With Schneider Electric, Red Team X investigated a set of vulnerabilities in two Ethernet modules used in the M580 line of programmable logic controllers (PLCs). These modules bring networking capabilities to industrial control systems, which rely on PLCs and programmable automation controllers (PACs) to execute complex machinery instructions. Chained together, the bugs could let an authenticated attacker bypass multiple firmware verification stages and the module's secure boot process, allowing remote firmware overwriting. An attacker who exploited the chain could permanently brick a device or backdoor it, but would need network access and valid credentials for the privileged "installer" account. The vulnerabilities are tracked as CVE-2022-34759 through CVE-2022-34765. Schneider Electric is analyzing all affected products to provide remediation.

Red Team X also partnered with Airspan, which supplies 4G and 5G hardware and software, to harden a line of eNodeBs — wireless access points that connect LTE devices to cellular networks. The reported vulnerabilities could allow local or networked adversaries to achieve root command execution. Controlling the "last hop" of LTE infrastructure would let an attacker disable cell service or pivot deeper into cellular infrastructure, potentially affecting the networks of companies where the eNodeBs are deployed, or even major operators that route LTE data. While an attacker could access encrypted user traffic, they wouldn't be able to decrypt it. The issues are catalogued under CVE-2022-36306 through CVE-2022-36312.

In a separate disclosure, Red Team X reported a kernel code execution bug in Apple's Darwin kernels, found through a manual audit of the Darwin Kernel. The vulnerability could be exploited by forking processes and abusing the host_request_notification API. Apple fixed the issue across a range of products, including macOS Big Sur 11.6, iOS 15, iPadOS 15, tvOS 15, and watchOS 8, among others. The finding is assigned CVE-2021-30857.

Another manual code review uncovered multiple bugs in EternalTerminal, an open source remote terminal service that can automatically reconnect after network interruptions. The most serious finding allowed an attacker to alter ownership permissions on arbitrary files and gain root access to the host machine. Patches are available, and the issues are tracked under CVE-2022-24949 through CVE-2022-24952.

Paying for deep expertise in bug bounty research

Meta's long-running bug bounty program has cultivated researchers who know the platform intimately. One such researcher, Youssef Sammouda, spent seven months auditing the client-side code of Facebook's legacy Canvas App, a service for embedding games and apps on the web gaming platform. His work uncovered several high-severity bugs in Meta's OAuth implementation that could enable an account takeover, though exploitation would require tricking a victim into clicking a crafted link. Sammouda submitted six reports totaling $187,250 in bounty payouts — the largest series of awards Meta has issued to a single researcher for one implementation. Meta fixed the issues and found no evidence of abuse.

Another longtime researcher, Philippe Harewood, found an endpoint vulnerability that could let an attacker retrieve an Instagram app access token. Even when mitigating controls limit the impact of such a bug, Meta says it uses these reports to harden its codebase against similar issues in the future and rewards researchers based on the maximum potential impact identified through internal follow-up. The endpoint was fixed with no signs of exploitation, and Harewood received a $30,000 bounty.

To expand its pool of researchers beyond experienced hunters, Meta recently hosted its first BountyConEDU conference in Madrid, inviting European university students and recent graduates to learn how the company investigates reports and to participate in live hacking sessions. The three-day pilot produced 26 valid reports and more than $35,000 in payouts. Meta hopes to apply lessons from this event to similar programs worldwide.