if you can't beat 'em, join 'em
TRANSCRIPT
If You Can’t Beat ‘Em Join ‘EmTips For Running a Successful Bug Bounty Program
Grant McCrackenDaniel Trauner
BSides AustinApril 1, 2016
Grant
● Technical Account Manager @Bugcrowd
○ formerly an ASE
● Before that, Whitehat
● Did some traveling
● Music
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Dan
● AppSec Engineer (ASE) @Bugcrowd
● Before that, Fortify SCA @HPSR
○ Static analysis -- lots of languages
○ Focus on iOS
● Art History/Collecting!
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Bug Bounty Programs
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
wut
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
A (Brief) History of Bug Bounty Programs
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Why?
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Do you really want to let people attack you?
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Source: http://hyperboleandahalf.blogspot.com/2010_06_01_archive.html
Yes! (They’re doing it anyways…)
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Source: http://hyperboleandahalf.blogspot.com/2010_06_01_archive.html
You vs. and Them
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Who are these people?
● All over the place!
○ All ages
○ All levels of experience
○ All over the world
○ Users and non-users
● Passionate about security
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Value
● Lots of eyes
● Only pay for valid results
● Shows a more advanced security
posture
● Better overall reputation!
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
How?
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
How?● Pre-Launch
○ Scope
○ Focus
○ Exclusions
○ Environment
○ Access
● Post-Launch
○ Managing Expectations
○ Communicating Effectively
○ Defining a Vulnerability Rating
Taxonomy (VRT)
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
“Touch the code, pay the bug.”
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Pre-Launch
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Scope, scope, scope
● Step 0...○ Basic resources/requirements to run
a program
● The researcher’s universe
○ Leave nothing open to interpretation
○ Understand your attack surface
○ The path of least resistance
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Focus
● You might care about specific:○ Targets
○ Vuln types
○ Functionalities (e.g. payment
processing)
● How?○ Incentives
○ Create a focused program
Source: https://xkcd.com/1361/
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Exclusions
● You might not care about:
○ “Low-hanging fruit”
○ Intended functionality
○ Known issues
○ Accepted Risks
○ Issues resulting from pivoting
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Environment● Different based on:
○ Prod vs. Staging
■ Make sure it can stand up to testing!
1. Scanners
2. Contact forms
3. Pentesting requests
○ Target type
■ IoT? iOS?
○ Special bounty type?
○ Researcher environments
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
What a shared environment looks like...
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Access
● Easier = better
● How will researchers get there?○ Whitelist? Proxy? Geo-restrictions?
● Public or private?
● SSN/CCs/phone numbers?
● Intuitive credentials management ○ NO SHARED CREDS
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Remember...
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Post-Launch
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Expectations, expectations, expectations...
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Expectations, expectations, expectations...
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Communication is Key
● Researchers like:○ Concise, unambiguous responses
■ ESL
○ Quick responses
○ Predictable time to reward
● Stay on top of these issues!
● Public disclosure?
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Define a Vulnerability Rating Taxonomy
● For you:○ Speed up triage process
○ Track your organization’s posture
○ Arrive at reward amount more quickly
● For them (if published):○ Focus on high-value bugs
○ Avoid reporting wontfix issues
○ Feel a sense of trust (goes with brief)
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Discuss the VRT at a Roundtable
● Priority will change as your
organization does
● Establish a discussion meeting○ Review interesting bugs
○ Discuss additions to VRT
○ Propose changes to vulnerability
classification/priorities
● This is an ongoing process!
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Meanwhile, IRL...
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
$UNPREPARED_COMPANY
Recipe for disaster:
1. Don’t provide known issues
2. Don’t consider exclusions
3. Sneaky brief changes
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Instructure
2013 (Pentest) 2014 (Bug Bounty)
Critical 0 0
High 1 25
Medium 1 8
Low 2 16
Source: https://www.canvaslms.com/security
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
tl;dr
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016
Source: https://xkcd.com/1256/
BSides Austin 2016 – If You Can’t Beat ‘Em Join ‘Em © Bugcrowd 2016