Bug Bounty Programs Are Being Used to Buy Silence

guest · Apr 3, 2020

Bug Bounty Programs Are Being Used to Buy Silence
April 3, 2020
https://www.schneier.com/blog/archives/2020/04/bug_bounty_prog.html

Investigative report on how commercial bug-bounty programs like HackerOne, Bugcrowd, and SynAck are being used to silence researchers:

Used properly, bug bounty platforms connect security researchers with organizations wanting extra scrutiny. In exchange for reporting a security flaw, the researcher receives payment (a bounty) as a thank you for doing the right thing.

However, CSO's investigation shows that the bug bounty platforms have turned bug reporting and disclosure on its head, what multiple expert sources, including HackerOne's former chief policy officer, Katie Moussouris, call a "perversion."
Silence is the commodity the market appears to be demanding, and the bug bounty platforms have pivoted to sell what willing buyers want to pay for.

"Bug bounties are best when transparent and open. The more you try to close them down and place NDAs on them, the less effective they are, the more they become about marketing rather than security," Robert Graham of Errata Security tells CSO.
Click to expand...

The bug bounty platforms' NDAs prohibit even mentioning the existence of a private bug bounty. Tweeting something like "Company X has a private bounty program over at Bugcrowd" would be enough to get a hacker kicked off their platform.

The carrot for researcher silence is the money [...]
Click to expand...

Bug bounty platforms buy researcher silence, violate labor laws, critics say

Key takeaways from CSO’s bug bounty investigation

Bug bounty platforms use NDAs to trade bounty hunter silence for the possibility of a payout.

All organizations need a vulnerability disclosure program (VDP); few need a bug bounty program.

Bug bounty platforms may violate California and federal labor law, and the EU’s General Data Protection Regulation (GDPR).

You can't outsource a VDP entirely, only very tiny pieces, per ISO standards.

Bug bounty platforms and their use of NDAs contribute to a public safety issue due to unpatched security flaws.

Click to expand...

Log in or Sign up

Bug Bounty Programs Are Being Used to Buy Silence

guest Guest

Log in or Sign up

Bug Bounty Programs Are Being Used to Buy Silence

guest Guest

Useful Searches