Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

2/15/2019
10:30 AM
Michelle Moore
Michelle Moore
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

White-Hat Bug Bounty Programs Draw Inspiration from the Old West

These programs are now an essential strategy in keeping the digital desperados at bay.

Back in the Old West, sheriffs tacked up parchment "Wanted" posters offering cash bounties to help them catch lawless gunslingers like Billy the Kid and Butch Cassidy. Today, corporations and governments are paying high-dollar bounties to combat a new generation of Billy the Bots and Breach Cassidys on a far more expansive frontier — cyberspace.

These anonymous, modern-day outlaws hide behind the nicknames of the viruses they unleash on a wide range of targets, destructive malware with monikers like WannaCry and NotPetya. With so much at stake — the fast-growing cybercrime epidemic is projected to cost the world $6 trillion a year by 2021, according to Cybersecurity Ventures; these so-called "bug bounty" programs are now an essential strategy in keeping the digital desperados at bay.

Crucial to Cybersecurity Defense
Each day seems to bring new reports of unscrupulous hackers breaking into public and private sector computer systems, stealing sensitive data, compromising people's privacy, and using ransomware to extort billions from victims across the globe. High-profile victims include Target, Uber, Anthem, Equifax, the FBI, and the National Security Administration.

Also toiling behind the scenes at keyboards far and wide, a legion of super-skilled white-hat hackers is sneaking into computer systems with an entirely different motive — keeping the world safer from their black-hat counterparts. This tendency to depict villains in black hats and heroes in white may be inspired by the old cowboy movies, but today it is integral to how we talk about the ongoing war on cybercrime.

Of course, the modern bug bounty is not a pouch of gold but substantial, sometimes six-figure cash rewards paid out to hackers who discover flaws and vulnerabilities in cybersecurity defenses. Though their work is largely out of the public eye, the white-hat specialists who participate in bug bounty programs are at the forefront of our cybersecurity defense system.

GM Calls Bug Bounties an "Essential Part of Our Security Ecosystem"
Like most major companies and organizations today, General Motors uses hackers and bug bounties to enhance its security. In 2016, GM began working with HackerOne, one of the leading bug bounty platforms, and since then more than 500 hackers have helped solve over 700 vulnerabilities. "Hackers have become an essential part of our security ecosystem," says Jeffrey Massimilla, vice president of global cybersecurity at General Motors.

According to HackerOne, "We partner with the global hacker community to surface the most relevant security issues of our customers before they can be exploited by criminals." Its exhaustive list of bug bounty programs includes such diverse participants as Facebook, Google and Microsoft; PayPal, LinkedIn and Match.com; eBay, AT&T and MIT; Starbucks, Tesla and Twitter. According to the company, HackerOne customers have resolved over 65,000 vulnerabilities and awarded over $26 million in bug bounties.

Bugcrowd, another leading player on the bug bounty frontier, counts many of the same companies on its Bug Bounty List, as well as Apple, Oracle and IBM; HubSpot, Reddit and United Airlines; Netflix, Craigslist and Salesforce. And Zerodium, a cybersecurity company that deploys "a global community of talented and independent security researchers," is now offering bounties as high as $2 million for discovering vulnerabilities in Apple's iOS mobile operating system.

Bug Bounty Success Stories
"Most hackers remember their first bug." So begins a HackerOne article about computer security whiz kid Jack Cable, who discovered he could "send negative amounts of money to other bank account holders at a financial institution, effectively stealing money from their accounts." The Chicago teen then proceeded to beef up his own bank account … by alerting the company and collecting a bounty.

Several years later, at age 17, he responded to a Pentagon bug bounty called Hack the Air Force, discovered 20+ vulnerabilities in one day, and earned a good-sized check as the program's top contributor. "It's been great to see hackers help improve the Air Force's security and be recognized for their efforts," said Cable, who had already been acknowledged for his ethical hacking efforts by Google, Yahoo, and Uber.

Here are several additional bug bounty success stories: 

  • The Pentagon: Hack the Air Force and Hack the Army, part of a larger Hack the Pentagon initiative, have led to the discovery of hundreds of vulnerabilities and resulted in hundreds of thousands of bounty dollars paid out to participating hackers. The Department of Defense has reportedly invested $34 million to build on its Hack the Pentagon successes.
  • Microsoft: The technology giant paid $260,000 to hackers as part of its Blue Hat security contest, with $200,000 going to a Columbia University doctoral student, Vasilis Pappas.
  • Facebook: The now-controversial social media giant's bug bounty program has paid out more than $7.5 million since its inception, including $1.1 million in 2018, according to a recent report in Wired.

Finally, for an inside look at the life of an ethical hacker, here is a quick story and video in which successful bug bounty hunter Anand Prakash talks about his work getting paid for finding vulnerabilities at companies like Twitter, Uber, Facebook, and more.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Michelle Moore, Ph.D., is academic director and adjunct professor for the University of San Diego's innovative, online Master of Science in Cyber Security Operations and Leadership program. She is also a researcher, author and cybersecurity policy analyst with over two ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16703
PUBLISHED: 2019-09-23
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
CVE-2019-16704
PUBLISHED: 2019-09-23
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
CVE-2019-16702
PUBLISHED: 2019-09-23
Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.
CVE-2019-16695
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
CVE-2019-16696
PUBLISHED: 2019-09-22
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.