Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

2/15/2019
10:30 AM
Michelle Moore
Michelle Moore
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

White-Hat Bug Bounty Programs Draw Inspiration from the Old West

These programs are now an essential strategy in keeping the digital desperados at bay.

Back in the Old West, sheriffs tacked up parchment "Wanted" posters offering cash bounties to help them catch lawless gunslingers like Billy the Kid and Butch Cassidy. Today, corporations and governments are paying high-dollar bounties to combat a new generation of Billy the Bots and Breach Cassidys on a far more expansive frontier — cyberspace.

These anonymous, modern-day outlaws hide behind the nicknames of the viruses they unleash on a wide range of targets, destructive malware with monikers like WannaCry and NotPetya. With so much at stake — the fast-growing cybercrime epidemic is projected to cost the world $6 trillion a year by 2021, according to Cybersecurity Ventures; these so-called "bug bounty" programs are now an essential strategy in keeping the digital desperados at bay.

Crucial to Cybersecurity Defense
Each day seems to bring new reports of unscrupulous hackers breaking into public and private sector computer systems, stealing sensitive data, compromising people's privacy, and using ransomware to extort billions from victims across the globe. High-profile victims include Target, Uber, Anthem, Equifax, the FBI, and the National Security Administration.

Also toiling behind the scenes at keyboards far and wide, a legion of super-skilled white-hat hackers is sneaking into computer systems with an entirely different motive — keeping the world safer from their black-hat counterparts. This tendency to depict villains in black hats and heroes in white may be inspired by the old cowboy movies, but today it is integral to how we talk about the ongoing war on cybercrime.

Of course, the modern bug bounty is not a pouch of gold but substantial, sometimes six-figure cash rewards paid out to hackers who discover flaws and vulnerabilities in cybersecurity defenses. Though their work is largely out of the public eye, the white-hat specialists who participate in bug bounty programs are at the forefront of our cybersecurity defense system.

GM Calls Bug Bounties an "Essential Part of Our Security Ecosystem"
Like most major companies and organizations today, General Motors uses hackers and bug bounties to enhance its security. In 2016, GM began working with HackerOne, one of the leading bug bounty platforms, and since then more than 500 hackers have helped solve over 700 vulnerabilities. "Hackers have become an essential part of our security ecosystem," says Jeffrey Massimilla, vice president of global cybersecurity at General Motors.

According to HackerOne, "We partner with the global hacker community to surface the most relevant security issues of our customers before they can be exploited by criminals." Its exhaustive list of bug bounty programs includes such diverse participants as Facebook, Google and Microsoft; PayPal, LinkedIn and Match.com; eBay, AT&T and MIT; Starbucks, Tesla and Twitter. According to the company, HackerOne customers have resolved over 65,000 vulnerabilities and awarded over $26 million in bug bounties.

Bugcrowd, another leading player on the bug bounty frontier, counts many of the same companies on its Bug Bounty List, as well as Apple, Oracle and IBM; HubSpot, Reddit and United Airlines; Netflix, Craigslist and Salesforce. And Zerodium, a cybersecurity company that deploys "a global community of talented and independent security researchers," is now offering bounties as high as $2 million for discovering vulnerabilities in Apple's iOS mobile operating system.

Bug Bounty Success Stories
"Most hackers remember their first bug." So begins a HackerOne article about computer security whiz kid Jack Cable, who discovered he could "send negative amounts of money to other bank account holders at a financial institution, effectively stealing money from their accounts." The Chicago teen then proceeded to beef up his own bank account … by alerting the company and collecting a bounty.

Several years later, at age 17, he responded to a Pentagon bug bounty called Hack the Air Force, discovered 20+ vulnerabilities in one day, and earned a good-sized check as the program's top contributor. "It's been great to see hackers help improve the Air Force's security and be recognized for their efforts," said Cable, who had already been acknowledged for his ethical hacking efforts by Google, Yahoo, and Uber.

Here are several additional bug bounty success stories: 

  • The Pentagon: Hack the Air Force and Hack the Army, part of a larger Hack the Pentagon initiative, have led to the discovery of hundreds of vulnerabilities and resulted in hundreds of thousands of bounty dollars paid out to participating hackers. The Department of Defense has reportedly invested $34 million to build on its Hack the Pentagon successes.
  • Microsoft: The technology giant paid $260,000 to hackers as part of its Blue Hat security contest, with $200,000 going to a Columbia University doctoral student, Vasilis Pappas.
  • Facebook: The now-controversial social media giant's bug bounty program has paid out more than $7.5 million since its inception, including $1.1 million in 2018, according to a recent report in Wired.

Finally, for an inside look at the life of an ethical hacker, here is a quick story and video in which successful bug bounty hunter Anand Prakash talks about his work getting paid for finding vulnerabilities at companies like Twitter, Uber, Facebook, and more.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Michelle Moore, Ph.D., is academic director and adjunct professor for the University of San Diego's innovative, online Master of Science in Cyber Security Operations and Leadership program. She is also a researcher, author and cybersecurity policy analyst with over two ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5798
PUBLISHED: 2019-05-23
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2019-5799
PUBLISHED: 2019-05-23
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5800
PUBLISHED: 2019-05-23
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5801
PUBLISHED: 2019-05-23
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-5802
PUBLISHED: 2019-05-23
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.