If you don’t work for the social media giant Facebook, but would like to cash a pricey check approved by Mark Zuckerberg himself, then try hacking them. An Indian security researcher did just that back in March when he discovered a password bug that let him access anyone’s Facebook account. The company gifted him with $15,000 for his troubles. More recently, that’s how things worked out for a 10-year-old Finnish boy named Jani, as Facebook paid him a whopping $10,000 for reporting a security flaw in Instagram by which hackers could delete comments on any posted photos.
Jani, whose full name was withheld at his parents’ request, told the Finnish tabloid Iltalehti he could manipulate the comments of any account on any photo thanks to a backdoor he found on Instagram’s servers. In a translated quote provided by Forbes, he quipped: “I would have been able to eliminate anyone, even Justin Bieber.” To prove his claims, Facebook created a test account back in February and had Jani work his magic. Sure enough, the prepubescent little sh… kid was able to sneak onto the image-sharing platform’s servers, find the target comment and wipe its existence entirely. So they paid him $10,000 as part of the company’s bug bounty program and patched the issue immediately.
According to a statement Facebook gave to Forbes:
The problem lay in a private application programming interface (the slice of code allowing certain outside access) that wasn’t properly checking the person deleting the comment was the same one who posted it.
Per Facebook, the bounty program has awarded over $4.3 million to over 800 researchers, professional and otherwise, around the world. Jani therefore joins a small but rapidly growing club of elite individuals in America, Europe and Southeast Asia that regularly helps the company with research and development, though his age makes him the youngest contributor by three years.