devopsy.kinsta.cloud

Tag: white hats

  • Benefits and Challenges of Bug Bounty Programs

    Benefits and Challenges of Bug Bounty Programs

    Trying to get ahead of the bugs and vulnerabilities that cause security breaches and hacks has become an increasingly high priority in recent years across a variety of industries. With a growing cybersecurity skills gap and short-staffed security teams, many organizations are turning to bug bounty programs to expand their breach prevention capabilities beyond their internal teams. 

    How Do Bug Bounty Programs Work? 

    These programs represent reward-driven crowdsourced security testing where ethical hackers that are able to successfully discover (and report) vulnerabilities to companies are rewarded by the organization that was hacked.

    Further classification of bug bounty programs can be split into private and public programs. Public programs allow entire communities of ethical hackers to participate in the program. Usually, these wide-ranging programs can be either time-limited and open-ended. On the other hand, private programs are generally limited to a smaller, hand-selected sub-group of hackers that are scoped to specific targets. These private programs often take place through commercial bounty platforms, where hackers are selected based on their reputation, experience and skills.

    One company that exemplifies the growing bug bounty trend is Microsoft. It has consistently been involved in these types of efforts over the years, and the latest example is its new Xbox Bounty Program. It followed RockstarGames’ decision to make its bug bounty program public, inviting hackers to test its platform for a wider range of vulnerabilities. So what does a successful program look like?

    The Xbox Bounty Program

    The Xbox Bounty Program, for instance, invites gamers, security researchers and others from around the world to help identify vulnerabilities in the Xbox Live network and services, and share them with the Xbox team. Qualified submissions are eligible for bounty rewards of $500 to $20,000. If you find a major bug in an Xbox Live service and report it to them, you could get paid for it.

    The following are examples of vulnerabilities that may lead to one or more of the security impacts Xbox is looking to address: 

    • Cross site scripting (XSS).
    • Cross site request forgery (CSRF).
    • Insecure direct object references.
    • Insecure deserialization.
    • Injection vulnerabilities.
    • Server-side code execution.
    • Significant security misconfiguration (when not caused by user).
    • Demonstrable exploits in third party components.

    Bug Bounty Benefits

    Traditional penetration testing services sometimes generate a culture of fear due to meeting compliance requirements, but bug bounties are different. Bug bounties are about creating a culture of openness, transparency and responsibility.

    People are consistently looking to hack every game console on the market and many applications/websites as well, whether it’s for good or for bad. For organizations like Microsoft, it’s important to bring the dark side over to the light by making hackers ethical with their participation in the bounty programs.

    Ethical hackers help businesses detect vulnerabilities before the bad guys beat them to it. In other words, running a bug bounty program is getting ahead of the game by being proactive and predictive. A bug bounty is an alternative way to detect software and configuration errors that can slip past developers and security teams, and later lead to big problems.

    Bug bounty programs and responsible disclosure programs are extremely beneficial for Microsoft, and organizations in general, because they give curious people a legal and positive way to express their curiosity.

    In a previous life, I was a white hat hacker like this. I never reported anything I found, but if there had been a system in place like a bug bounty, I would’ve taken full advantage. Having these programs in general is great for organizations to find bugs, but it’s also important for them to ensure they are reported. 

    Bug Bounty Challenges

    While bug bounties have numerous benefits as outlined above, it’s also important not to over rely on bug bounty programs. Since these programs are incremental, they don’t eliminate the necessity of securing software development system scans or testing.

    Before diving into the program, it’s also important to define the scope of the bounty program. You must have unquestionable clarity about the authorized conduct framework, and you must decide what proof you’ll require to confirm a hack and how and when people should share that information.

    Bounty program legal rules can sometimes be written poorly as well, allowing hackers to stray outside of the boundaries–despite the potential legal risk. A lot of bug bounty reporters are just shoving their world’s view onto the organization holding the bounty programs. It’s nowhere near the majority, but you see it a lot with younger people.

    It will take advanced planning and agreement with security teams, operations and developers to ensure the procedures are in place to tackle such incidents when they arise. But all in all, the benefits of bug bounty programs significantly outweigh the challenges they pose. Every day around the world there are new breaches grabbing news headlines. Bug bounties are one of the ways to help keep organizations out of those headlines, and continue on the path to a safer digital life.

    — Bryan Becker

  • DEF CON: Where Have All the Black Hats Gone?

    DEF CON: Where Have All the Black Hats Gone?

    DEF CON is one of the most controversial conferences in the world. Only at that annual event have arrests been made, legal threats shut down presentations and zero-day attacks been anted in Texas Hold ’em games.

    The Usual Suspects

    This is a conference of people who grew up like me—people who, at 11 years old, were using IRC (internet chat relay) to share API (application programming interface) documents or download random material such as, “The Anarchist Cookbook.” We were influenced by movies such as, “The Matrix,” and “Hackers,” all the while thinking elite hacks were the cool thing to do. We spent lots of time playing Quake and other games. As we grew up, we may have gotten into trouble building projects using proggies or sharing things we weren’t supposed to share. Most of us grew up using computers to build software and make money. Some of us graduated from college and found great jobs for our skills.

    You start with chat rooms on AOL and dive deeper into IRC. You may meet people playing peer-to-peer games such as Quake. Those people share information, and, before you know it, you’ve downloaded software over peer networks and you’re sharing cracks. This is your hidden world, and your friends are handles with no name, age or location.

    Then one day you decide you’re going to meet all these handles in person at a central location that is easy to get to. You’re going to save up some really good cracks you haven’t shared yet for when you meet them. That, to me, was the adolescent rebellious start to DEF CON.

    Now, as adults, we appreciate the novelty of slipping away into childhood by attending DEF CON to witness new hacks and meet childhood hacker friends. It’s like meeting a bunch of people at your house who haven’t seen each other in a long time or only knew each other through internet chat rooms. It’s a good time to connect; it’s great to feel that energy.

    Going Down the Rabbit Hole

    Hackers are just curious folks who are so bored with all the content they consume that they turn the internet into a playground. Like every playground, there are good guys and bad guys. Sometimes they’re forced to get along. Sometimes they fight. Sometimes they decide to attack a system just because the company that runs it laid off a loved one. Other times they are just playing a friendly game of King of the Hill. You can take it too far and get in trouble or get a wake-up call. Or, you may simply grow out of it. No matter the situation, the curiosity and love for the internet remains with you; that is why DEF CON is attractive.

    DEF CON is white hats teaching black hats and black hats teaching white hats with a lot of gray in between. Everyone gets along and smiles as they watch “The Matrix” or “Hacker Jeopardy” together.

    Distinguishing the Hackers from the Hacks

    I was waiting in line. I always communicate with the people in line and ask them about the conference, current presentations and whether they have had any experience setting up XYZ or running up a large sheet of attacks using cloud networks. At this year’s event, most of the people I ran into looked like “hackers” but had no clue what I was talking about; they just uncomfortably laughed. It’s funny: They were going to presentations to see somebody talk about something highly technical, yet, they didn’t have a clue.

    Lots of folks had badges, hung out and looked as though they were on vacation and decided to check out the conference. This group, I believe, came because the conference was located in a casino in Las Vegas. The whole Vegas thing is probably the top reason why DEF CON attracted larger crowds.

    I noticed I found more competent folk at the Villages—different sections focusing on topics such as packet hacking, car hacking and social engineering. Villages had more unique, specific details on the concept of hacking in certain arenas. I found people were more in-tune and focused here. The Villages were away from the four main presentations rooms, which meant fewer tourist types. The Villages were where you found the passionate hackers.

    White or black, it was a lot of gray. I didn’t see my friends who specialize in network protection for a living using hacker tools maliciously; rather, they were curious to know how the tools work. After Justin got his MitM (man-in-the-middle) attack working, he smiled and looked at me, “Is it this easy!?” Then, “How do we stop this? Is it really just making everything TLS? That can’t be the only way.” So we ran a few Google searches to poke around deeper. When moving around the conference, you saw guys sitting on the ground running these attacks; they were just phishing to add to the wall of sheep.

    Was the guy who got paid to snoop at the Democratic National Convention convention with MitM attacks there? He might or might not have been. He might have been pioneering these attacks and learning from presenters, or he might have been so beyond what is shared at DEF CON that it was a mere novelty to attend. Even with DEF CON making it really easy to go undetected by using cash transactions, it’s still 2016 and surveillance cameras were everywhere—especially in casinos. If you’re looking to keep a low profile, DEF CON is the last place you’d want to be.

    So, I’m going to go out on a limb and say that the white hats and some grays were present with maybe a Sith Lord lurking in disguise. The true black hats were most likely reporting in remotely to their Sith while they observed petty hacks and recruited from a safe distance. Or maybe, just maybe, they were in board shorts acting like a clueless tourist.

    About the Author / Randy Apuzzo

    Randy Apuzzo_Co-founder_CEO_Zesty.ioRandy Apuzzo is founder and CEO of Zesty.io, the SaaS CMS Company. At age 12, Randy was hacking corporate sites and crashing systems for fun. As an adult, he applies his computer science and branding background as an industry visionary, architecting scalable solutions that help companies accelerate and scale their global digital content strategies. He is revered for empowering businesses with technology that grants agility, cost savings, security and increased market share. To connect with Randy, please visit https://www.zesty.io, Facebook/GoZesty, LinkedIn/Zesty-io, @RandyApuzzo and @Zestyio.