New web targets for the discerning hacker
Belgium became a haven for ethical hackers following the adoption of a nationwide safe harbor agreement last month.
The framework means that well-intentioned security researchers are free from legal jeopardy when they come to report computer security vulnerabilities in any system located in the European country – providing they follow a strict set of conditions and rules of conduct.
The guidelines, announced by the Centre for Cyber Security Belgium, apply to both private and public sector organizations. Belgium is further ahead on the curve, but it’s hoped that the scheme will inspire other countries to follow suit and companies to roll out vulnerability disclosure programs of their own.
In less congenial bug bounty-related news, independent researcher Peter Geissler publicly released the details of a set of vulnerabilities affecting Lexmark printers rather than accepting what he considered a derisory reward. The security bugs – which could be chained together to create a remote code execution attack – have since been fixed.
Another example of researchers baulking at bug bounty conditions came in the disclosure of a web security flaw in a marketing widget from analysts Gartner.
Security researcher Justin Steven wanted to write-up the technical details of a DOM-based cross-site scripting vulnerability in the Gartner Peer Insights widget, but the analyst firm warned the researcher that that it violated the rules of the private bug bounty program.
Steven publicly disclosed technical details of the vulnerability anyway, even though this meant he went without payment for the find.
There was drama aplenty when a new host of popular hacking tool XSS Hunter disclosed telemetry (anonymized statistics about the vulnerabilities unearthed) from security researchers using its version of the utility. Truffle Security faced a privacy backlash from security researchers upset that it was seemingly “peering over their shoulder” and going through their findings.
In response to the criticism, Truffle security began offering end-to-end encryption as an option to security researchers using its version of XSS Hunter.
The latest bug bounty programs for March 2023
The past month saw the arrival of several new bug bounty programs. Here’s a list of the latest entries:
ATG (Enhanced)
Program provider:
YesWeHack
Program type:
Public
Max reward:
$4,000
Outline:
ATG has raised rewards for medium, high, and critical bugs, and broadened its scope to encompass .atg.se and its subdomains. ATG is a Swedish gaming company that specializes in horse racing.
Check out the ATG bug bounty page for more details
Bybit
Program provider:
Bugcrowd
Program type:
Public
Max reward:
$20,000
Outline:
The cryptocurrency exchange is paying out between $5,000 and $20,000 for the highest tier of criticality. The sole target in scope is bybit.com.
Check out the Bybit bug bounty page for more details
Grindr
Program provider:
Bugcrowd
Program type:
Public
Max reward:
$4,000
Outline:
The location-based social networking and dating application for the LGBTQ community cites RCE, arbitrary SQL queries on production databases, and significant authentication bypass flaws as potentially critical bugs.
Check out the Grindr bug bounty page for more details
Linktree
Program provider:
Bugcrowd
Program type:
Public
Max reward:
$7,500
Outline:
Australian social media tool Linktree, which has 30 million users globally, has put “most” of its assets within the scope of the bug bounty program.
Check out the Linktree bug bounty page for more details
Malwarebytes
Program provider:
HackerOne
Program type:
Public
Max reward:
$2,000
Outline:
The anti-malware firm is offering payouts of between $50 and $2,000 for confirmed vulnerabilities. Those posing an RCE risk to Malwarebytes’ web properties or customers running its endpoint protection software, or leading to the takeover of AWS cloud infrastructure, will attract the greatest rewards.
Check out the Malwarebytes bug bounty page for more details
Miro
Program provider:
HackerOne
Program type:
Public
Max reward:
$3,000
Outline:
The collaborative whiteboarding platform is offering rewards of up to $3,000. Out of scope assets include Jira Cards by Miro, Miro for Confluence, and Miro for Jira Cloud.
Check out the Miro bug bounty page for more details
Ninja Kiwi Games
Program provider:
Intigriti
Program type:
Public
Max reward:
$3,750
Outline:
The New Zealand-based video game developer has launched a second bug bounty program after a successful 2021 forerunner. Ninja Kiwi Games has created the Bloons, Bloons TD, and SAS: Zombie Assault franchises.
Check out the Ninja Kiwi Games bug bounty page for more details
QNAP
Program provider:
Independent
Program type:
Public
Max reward:
Undisclosed
Outline:
QNAP, the Taiwanese manufacturer of network-attached storage appliances, has invited hackers to probe its operating systems, applications, and cloud services for vulnerabilities.
Check out the QNAP bug bounty page for more details
Skinport
Program provider:
HackerOne
Program type:
Public
Max reward:
$6,000
Outline:
Skinport, a marketplace for digital in-game items, has launched a program with rewards for critical flaws that open the door to trading or purchase manipulations. Vulnerabilities that result in unauthorized access to project servers or the disclosure of confidential data are also within scope.
Check out the Skinport bug bounty page for more details
Spin by OXXO
Program provider:
YesWeHack
Program type:
Public
Max reward:
$3,000
Outline:
In scope are an API plus iOS and Android mobile applications of Spin, a fintech app and payment card from Mexican convenience store chain Oxxo.
Check out the Spin by OXXO bug bounty page for more details
Xdefi Technologies
Program provider:
HackerOne
Program type:
Public
Max reward:
$5,000
Outline:
Xdefi, a cross-chain wallet extension for cryptocurrencies and NFTs, has included in the in-scope assets Xdefi Extension (Chromium web extension) and app, with rewards based on severity as per the CVSS (the Common Vulnerability Scoring Standard).
Check out the Xdefi bug bounty page for more details
Zabbix
Program provider:
HackerOne
Program type:
Public
Max reward:
$3,000
Outline:
Zabbix, a vendor which provides open source infrastructure monitoring technologies, is offering up to $1,000 for high severity bugs and $3,000 for critical flaws.
Check out the Zabbix bug bounty page for more information
Other bug bounty and VDP news this month
- Google has expanded its OSS Fuzz code testing service by upgrading its reward program and increasing the number of computing languages covered by the project
The search engine giant has also paid out its largest-ever bug bounty – worth a potentially life-changing £500,000 ($605,000) for an Android-related vulnerability. Google is staying tight lipped about the details of the flaw but ITPro has narrowed down the list of possibilities.
- Intel reports that it paid out $935,000 in bug bounties last year. The chip giant’s Intel Product Security Report (pdf) said that it triaged243 vulnerabilities in 2022, 90 of which were discovered by security researchers and reported through its bug bounty programs. The vendor “engaged 151 researchers last year, more than double compared to the previous three years”, Security Week reports.
- An in-depth article on the YesWeHack blog by security researchers BitK and SakiiR offers a technical perspective on detecting and exploiting prototype pollution vulnerabilities in JavaScript. The research builds on earlier work by Portswigger’s Gareth Heyes on detecting server-side prototype pollution-type security flaws.
- Security researcher Mike Takahashi has put together a Twitter thread on the so-hot topic of how AI-powered chatbots such as ChatGPT might be able to assist bug bounty hunters. The social media “brainstorm” by Takahashi is the second part in what might become an ongoing series.
Additional reporting by Adam Bannister
PREVIOUS EDITION Bug Bounty Radar // The latest bug bounty programs for February 2023