According to Bloomberg, the self-proclaimed bug bounty hunter is a minor celebrity in Taiwan who’s appeared on talk shows and was reportedly sued by a local bus operator after breaching their systems to nab a ticket for just NT$1 (3 cents). Earlier this month, Chi-yuan shared a screenshot showing an Apple Pay loophole he’d found that allowed him to pay NT$1 for 500 iPhones. His other claims include cyber-attacks on Apple and Tesla, and he’s also listed on Japanese messaging giant Line’s 2016 bug-hunters’ hall of fame.
“I don’t want to be a proper hacker, and I don’t even want to be a hacker at all,” Chang said in a recent post. “I’m just bored and try to dabble so that I can earn some money.” Facebook, like other tech giants, dishes out cash to cyber-security experts who point out flaws in its system as part of a bug bounty program. But considering all the setbacks it’s currently facing — including the departure of Instagram’s founders and its ongoing fake news crisis — it probably doesn’t want to deal with a high-profile hack right now.
Later Friday, Chang Chi-yuang confirmed to Bloomberg that the planned attack and livestream had been cancelled and the bug reported to Facebook. “I am canceling my live feed, I have reported the bug to Facebook and I will show proof when I get bounty from Facebook,” he told Bloomberg.
In a post on his Facebook page, Chang admitted “I shouldn’t try to prove myself by toying with Zuck’s account.”
The company isn’t keen on paying out bounties to people who test vulnerabilities against real users. Back in 2013, it refused to reward Khalil Shreateh — a systems information expert from Palestine — for hacking into Zuck’s account and posting an Enrique Iglesias video on the wall of one of his college friends. The Facebook founder has also previously had his Twitter and Pinterest accounts breached by notorious hacker group OurMine.
Update 9/28/2018 5:17PM ET: Bloomberg now reports that the planned attack/stream won’t happen. Chang Chi-yuang says he cancelled the stream and reported the bug to Facebook. He said he’ll show proof once he collects a bounty from the social network. This post has been updated to reflect this change.
