Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

2/15/2019
10:30 AM
Michelle Moore
Michelle Moore
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

White-Hat Bug Bounty Programs Draw Inspiration from the Old West

These programs are now an essential strategy in keeping the digital desperados at bay.

Back in the Old West, sheriffs tacked up parchment "Wanted" posters offering cash bounties to help them catch lawless gunslingers like Billy the Kid and Butch Cassidy. Today, corporations and governments are paying high-dollar bounties to combat a new generation of Billy the Bots and Breach Cassidys on a far more expansive frontier — cyberspace.

These anonymous, modern-day outlaws hide behind the nicknames of the viruses they unleash on a wide range of targets, destructive malware with monikers like WannaCry and NotPetya. With so much at stake — the fast-growing cybercrime epidemic is projected to cost the world $6 trillion a year by 2021, according to Cybersecurity Ventures; these so-called "bug bounty" programs are now an essential strategy in keeping the digital desperados at bay.

Crucial to Cybersecurity Defense
Each day seems to bring new reports of unscrupulous hackers breaking into public and private sector computer systems, stealing sensitive data, compromising people's privacy, and using ransomware to extort billions from victims across the globe. High-profile victims include Target, Uber, Anthem, Equifax, the FBI, and the National Security Administration.

Also toiling behind the scenes at keyboards far and wide, a legion of super-skilled white-hat hackers is sneaking into computer systems with an entirely different motive — keeping the world safer from their black-hat counterparts. This tendency to depict villains in black hats and heroes in white may be inspired by the old cowboy movies, but today it is integral to how we talk about the ongoing war on cybercrime.

Of course, the modern bug bounty is not a pouch of gold but substantial, sometimes six-figure cash rewards paid out to hackers who discover flaws and vulnerabilities in cybersecurity defenses. Though their work is largely out of the public eye, the white-hat specialists who participate in bug bounty programs are at the forefront of our cybersecurity defense system.

GM Calls Bug Bounties an "Essential Part of Our Security Ecosystem"
Like most major companies and organizations today, General Motors uses hackers and bug bounties to enhance its security. In 2016, GM began working with HackerOne, one of the leading bug bounty platforms, and since then more than 500 hackers have helped solve over 700 vulnerabilities. "Hackers have become an essential part of our security ecosystem," says Jeffrey Massimilla, vice president of global cybersecurity at General Motors.

According to HackerOne, "We partner with the global hacker community to surface the most relevant security issues of our customers before they can be exploited by criminals." Its exhaustive list of bug bounty programs includes such diverse participants as Facebook, Google and Microsoft; PayPal, LinkedIn and Match.com; eBay, AT&T and MIT; Starbucks, Tesla and Twitter. According to the company, HackerOne customers have resolved over 65,000 vulnerabilities and awarded over $26 million in bug bounties.

Bugcrowd, another leading player on the bug bounty frontier, counts many of the same companies on its Bug Bounty List, as well as Apple, Oracle and IBM; HubSpot, Reddit and United Airlines; Netflix, Craigslist and Salesforce. And Zerodium, a cybersecurity company that deploys "a global community of talented and independent security researchers," is now offering bounties as high as $2 million for discovering vulnerabilities in Apple's iOS mobile operating system.

Bug Bounty Success Stories
"Most hackers remember their first bug." So begins a HackerOne article about computer security whiz kid Jack Cable, who discovered he could "send negative amounts of money to other bank account holders at a financial institution, effectively stealing money from their accounts." The Chicago teen then proceeded to beef up his own bank account … by alerting the company and collecting a bounty.

Several years later, at age 17, he responded to a Pentagon bug bounty called Hack the Air Force, discovered 20+ vulnerabilities in one day, and earned a good-sized check as the program's top contributor. "It's been great to see hackers help improve the Air Force's security and be recognized for their efforts," said Cable, who had already been acknowledged for his ethical hacking efforts by Google, Yahoo, and Uber.

Here are several additional bug bounty success stories: 

  • The Pentagon: Hack the Air Force and Hack the Army, part of a larger Hack the Pentagon initiative, have led to the discovery of hundreds of vulnerabilities and resulted in hundreds of thousands of bounty dollars paid out to participating hackers. The Department of Defense has reportedly invested $34 million to build on its Hack the Pentagon successes.
  • Microsoft: The technology giant paid $260,000 to hackers as part of its Blue Hat security contest, with $200,000 going to a Columbia University doctoral student, Vasilis Pappas.
  • Facebook: The now-controversial social media giant's bug bounty program has paid out more than $7.5 million since its inception, including $1.1 million in 2018, according to a recent report in Wired.

Finally, for an inside look at the life of an ethical hacker, here is a quick story and video in which successful bug bounty hunter Anand Prakash talks about his work getting paid for finding vulnerabilities at companies like Twitter, Uber, Facebook, and more.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Michelle Moore, Ph.D., is academic director and adjunct professor for the University of San Diego's innovative, online Master of Science in Cyber Security Operations and Leadership program. She is also a researcher, author and cybersecurity policy analyst with over two ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.