![Version: [--VX.X--]
Date: [--YYYY-MM-DD--]
Author: [--Author--]
Responsible: [--Responsible--]
Confidentiality Class: [--Confidentiality Class--]
Version: 1.0
Date: 2017-09-30
Author: P. Morimoto
Responsible: P. Morimoto
Confidentiality Class: Public
Bug Bounty แบบแมว ๆ](https://image.slidesharecdn.com/pichayaredpill2017-v3-171001035216/85/bug-bounty-1-320.jpg)
![© 2013 SEC Consult Unternehmensberatung GmbH
All rights reserved
Title: [--Title--] | Responsible: [--Responsible--]
Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--]
© 2013 SEC Consult Unternehmensberatung GmbH
All rights reserved
Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto
Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public
© 2014 SEC Consult Unternehmensberatung GmbH
All rights reserved
Vienna (HQ) | AT
Wiener Neustadt | AT
Vilnius | LT
Berlin| DE
Montreal | CA
Singapore | SG
Moscow | RU
Zurich | CH
SEC Consult Offices
SEC Consult Clients
Bangkok | TH
SEC Consult – Who we are
Found in 2002
70+ Security Experts
400+ Security Audits per year
Globally operating SEC Consult
Vulnerability Lab
Malaysia | MY
Luxembourg | LU
Linz | AT](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recomendados
Recomendados
Más contenido relacionado
Similar a Bug Bounty แบบแมว ๆ
Similar a Bug Bounty แบบแมว ๆ (20)
Más de Pichaya Morimoto
Más de Pichaya Morimoto (12)
Último
Último (20)
Bug Bounty แบบแมว ๆ
- 1. Version: [--VX.X--] Date: [--YYYY-MM-DD--] Author: [--Author--] Responsible: [--Responsible--] Confidentiality Class: [--Confidentiality Class--] Version: 1.0 Date: 2017-09-30 Author: P. Morimoto Responsible: P. Morimoto Confidentiality Class: Public Bug Bounty แบบแมว ๆ
- 2. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Vienna (HQ) | AT Wiener Neustadt | AT Vilnius | LT Berlin| DE Montreal | CA Singapore | SG Moscow | RU Zurich | CH SEC Consult Offices SEC Consult Clients Bangkok | TH SEC Consult – Who we are Found in 2002 70+ Security Experts 400+ Security Audits per year Globally operating SEC Consult Vulnerability Lab Malaysia | MY Luxembourg | LU Linz | AT
- 3. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Advisor for information security Expert for the implementation of security processes and policies (ISO 27001, BS 25999, GSHB) Leading company for technical security audits Specialist for web application security according to ONR 17700 Independent of product manufacturers Our customers are public authorities, financial institutions and insurance companies in Central Europe Sectoral orientation (defence, public, finance, industry) SEC Consult – Who we are 3
- 4. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 4 ISO/IEC 27001 Certificate entire company within certification scope certified since 16.01.2008
- 5. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 5 SEC Consult Vulnerability Lab European leading research lab for the identification of vulnerabilities and the analysis of new technologies, products and applications (security advisories) Integral part of the education and the further training of the security experts at SEC Consult Early information of our customers due to SEC Consult security alerts Support of well-known manufacturers to enhance the security of their products Companies and organisations SEC Consult has released security advisories for (excerpt). For details see: http://www.sec-consult.com/72.html
- 6. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 6 Who am I ? (Professional) Pichaya Morimoto IT Security Consultant Certifications: • Offensive Security Certified Professional (OSCP) • GIAC Web Application Penetration Tester (GWAPT) • Certified Ethical Hacker (CEH) • CompTIA Security+ Published Security Advisories: • 2014 - Privilege Escalation in Snort pfSense Package - Wordpress TimThumb 2.8.13 WebShot RCE - HybridAuth install.php PHP RCE • 2015 - PHP MoAdmin 1.1.2 RCE - Schedule Facebook Posts 1.5.6 SQL Injection - Lime Survey Multiple Critical Vulnerabilities • 2016 - Yeager CMS Multiple Critical Vulnerabilities - ASUS DSL-N55U router Multiple Vulnerabilities - LINE platform Multiple Vulnerabilities • 2017 - Aruba AirWave 8.2.3 External Entity Injection
- 7. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 7 Who am I ? (Personal) Co-administrator of สอนแฮกเว็บแบบแมว ๆ *Former* CTF Player of Pwnladin Team Co-administrator of 2600 Thailand Security Addict http://thehackernews.com/2014/06/zero-day-timthumb-webshot-vulnerability.html
- 8. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 8 Who am I ? (Personal) OWASP Thailand Meeting 3/2014 Topic: SQL Injection 101 : It is not just about ' or '1'='1 OWASP Thailand Meeting 5/2015 Topic: SQLi + Secure Coding with Hands-on OWASP Thailand Meeting 7/2016 Topic: Security Misconfiguration OWASP Thailand Meeting 2/2017 Topic: OWASP Top Ten Proactive Controls 2016 ….
- 9. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 9 Who am I ? (Personal) • Bug Bounty hunter • Occasionally, kill bugs for free Metasploit modules: • exploit/multi/http/phpmoadmin_exec • exploit/unix/webapp/hybridauth_install _php_exec • auxiliary/admin/http/limesurvey_file_ download and a lot more private exploit research and developments : )
- 10. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 10 Hackers, Script Kiddies, Cyber Criminals https://twitter.com/GhostSquadHack/status/820951470984036353 Notoriety, fun and curiosity
- 11. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 11 Professional Cyber Criminal http://www.reuters.com/article/us-usa-cyber-swift-exclusive/exclusive-swift-confirms-new-cyber-thefts-hacking-tactics-idUSKBN1412NT
- 12. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 12 A Hacker + Critical Vulnerability = ? • Keep Secret • Hack For $$$$ • Full Disclosure • Vulnerability Disclosure Program • Bug Bounty Program
- 13. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 13 Bug Bounty Program “A deal offered by many websites and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.” https://en.wikipedia.org/wiki/Bug_bounty_program https://www.slideshare.net/bugcrowd/webinar-48444938
- 14. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 14 Europol: What’s it gonna be ? https://www.europol.europa.eu/publications-documents/cyber-crime-vs-cyber-security-what-will-you-choose-poster Cybersecurity Expert Skills in coding, gaming, computer programming and anything IT-related are in high demand by the public and private sectors. There are many careers and professional opportunities available. Cyber Criminal Young people getting involved with cybercrime could face: - A visit and a warning from police - Being arrested, a penalty or fine - Prison, for serious offences - Criminal records which can affect your education, future career prospects and traveling overseas options
- 15. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 15 Bug Bounty for Hackers ( YOU ! ) • Make $$$$ legally from home or anywhere J • In high demand for IT security career • Add results to your resume ! https://www.linkedin.com/in/icheernoom/
- 16. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 16 Bug Bounty for Hackers ( YOU ! ) • Hall of Fame https://bugbounty.linecorp.com/en/halloffame/2016/
- 17. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Bug Bounty for Hackers ( Me ) 17 Special Contributor in LINE Security Bug Bounty Program • https://bugbounty.linecorp.com/en/halloffame/ (2017) • https://bugbounty.linecorp.com/en/halloffame/2016/ (2016)
- 18. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 18 Bug Bounty for Hackers ( YOU ! ) https://www.blognone.com/node/79729 2016: Student + Part-time Bug Bounty Hunter NOW: IT Security Professional @ Central Online
- 19. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 19 Bug Bounty for Hackers ( YOU ! ) https://www.facebook.com/whitehat/thanks https://en.wikipedia.org/wiki/Bug_bounty_program#/media/File:Facebook_t-shirt_with_whitehat_debit_card_for_Hackers.jpg Facebook Hall of Fame for White Hat hackers 2016 • Suvicha Buakhom (สุวิชา บัวคอม) 2015 • Kittinan Srithaworn (ตั#น) 2014 • Suphannee Sivakorn
- 20. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 20 Bug Bounty for Organizations • Reduce security risk for your products and services • Cost effective approach for security testing • Lower costs compared to Pentest services *Oops!* • Pay high reward only for high quality bugs J • Good security reputation http://www.360logica.com/blog/wp-content/uploads/2014/05/Bug-Bounty-Programs-A-Big-Security-Measure.jpg
- 21. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 21 Success Stories - GitHub on HackerOne platform Neil Matatall, Security Engineer, Github https://www.hackerone.com/sites/default/files/2017-05/Case%20Study%20-%20GitHub%20-%20FINAL.pdf “When we use third parties, we ask them to focus on a specific area. With bounties, researchers look at anything and everything.” "This ensures that the amount of time a bug exists will be shorter than it would’ve been without a bounty program." "It doesn't fully replace manual assessment work, but it certainly complements it nicely"
- 22. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 22 Success Stories - GitHub on HackerOne platform Neil Matatall, Security Engineer, Github https://www.hackerone.com/sites/default/files/2017-05/Case%20Study%20-%20GitHub%20-%20FINAL.pdf https://www.hackerone.com/assets/images/landing/resources/downloads/Bug-Bounty-Field-Manual-complete-ebook.pdf • As of March 2017, paid $80,000 (2.6 Million Baht) • 73 submissions • 6% valid bug (48 out of 795 reports) "Financially, a bounty program is cheaper than a full-time employee or a third- party consulting firm, so we’d be spending more money without it."
- 23. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 23 Success Stories - HackerOne platform https://www.hackerone.com/sites/default/files/2017-05/Case%20Study%20-%20GitHub%20-%20FINAL.pdf
- 24. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved I like it, sounds good to me 24 Question: Shall my company start Bug Bounty Program now? Answer: Stop there! Please learn things from HackerOne 1. Bug Bounty Readiness Assessment Questionnaire https://drive.google.com/file/d/0Bw2srC8rsYIRUDZJU1R0UmJLTG8/view 2. Bug Bounty Field Manual https://www.hackerone.com/resources/bug-bounty-field-manual (https://www.hackerone.com/assets/images/landing/resources/ downloads/Bug-Bounty-Field-Manual-complete-ebook.pdf)
- 25. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved What if … 25 • We do vulnerability scan frequently • We do pentest for newly developed system and/or quarterly • We have dedicated IT security team (blue team and/or red team) • We have a variety of internal and external webapps and mobile APIs • We often receive vulnerability reports from security researchers = Please consider Bug Bounty Program J
- 26. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved What if … 26 • My company has never done VA and/or Pentest • We have no IT security team • We have only a small webapp • We have never received any vulnerability report = Bug Bounty Program is not yet for you !
- 27. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 27 A Hacker + Critical Vulnerability = ? • Keep Secret • Hack For $$$$ • Full Disclosure • Vulnerability Disclosure Program • Bug Bounty Program
- 28. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Must Have: Vulnerability Disclosure Program 28 responsible.disclosure@citi.com https://online.citi.com/US/JRS/pands/detail.do?ID=ReportingVulnerability security.disclosures@rbs.co.uk http://personal.rbs.co.uk/personal/security-centre/responsible-disclosure.html
- 29. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved Must Have: Vulnerability Disclosure Program 29 1. Create security contacts • security@<company-domain> • alert@<company-domain> 2. Vulnerability Disclosure Program Policy • Guidelines • Scope / Out of scope • How to report a vulnerability ? • Optional: HOF, Swags, Bounties Hint: Open Source Responsible Disclosure Framework https://github.com/bugcrowd/disclosure-policy Forward emails to your IT guys
- 30. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 30 BugCrowd's Open Source Responsible Disclosure Framework https://github.com/bugcrowd/disclosure-policy
- 31. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 31 Bug Bounty Program - Do’s and Don’ts • Understand the program policy • Avoid out of scope issues • Be patient for reported issues • Use your test accounts for PoC • Do not cross the lines • Avoid business impact at all costs • Do not harm the system availability (No DoS) • No physical attacks and social engineering • Do not disclosure other users’ data https://en-gb.facebook.com/whitehat
- 32. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 32 Eligible Bugs
- 33. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 33 Eligible Bugs
- 34. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 34 Eligible Bugs
- 35. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 35 Eligible Bugs https://www.facebook.com/notes/facebook-security/ link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/
- 36. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 36 Eligible Bugs https://www.openbugbounty.org/reports/171730/
- 37. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 37 Eligible Bugs - Vulnerability or Usability ? User does exist But incorrect password User does not exist !
- 38. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 38 Bug Bounty Program Policy - Uber https://hackerone.com/uber
- 39. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 39 Bug Bounty Report Writing https://en-gb.facebook.com/whitehat/resources/
- 40. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 40 Bug Bounty Report Writing https://en-gb.facebook.com/whitehat/resources/
- 41. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 41 My Stories & Tips
- 42. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 42 My Stories & Tips
- 43. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 43 My Stories & Tips
- 44. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 44 My Stories & Tips
- 45. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved For any further questions contact your SEC Consult Expert. Pichaya Morimoto p.morimoto@sec-consult.com SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building, 16B Soi Langsuan, Lumpini, Pathumwan Bangkok 10330, Thailand www.sec-consult.com
- 46. © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: [--Title--] | Responsible: [--Responsible--] Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--] © 2013 SEC Consult Unternehmensberatung GmbH All rights reserved Title: Bug Bounty แบบแมว ๆ| Responsible: P. Morimoto Version / Date: 1.0 / 2017-09-30 | Confidentiality Class: Public © 2014 SEC Consult Unternehmensberatung GmbH All rights reserved 46 Contact GERMANY SEC Consult Unternehmensberatung Deutschland GmbH Bockenheimer Landstraße 17-19 60325 Frankfurt / Main Tel +49 69 175 373 43 | Fax +49 69 175 373 44 Email office-frankfurt@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Mooslackengasse 17 1190 Vienna Tel +43 1 890 30 43 0 | Fax +43 1 890 30 43 15 Email office@sec-consult.com LITHUANIA UAB Critical Security, a SEC Consult company Sauletekio al. 15-311 10224 Vilnius Tel +370 5 2195535 Email office-vilnius@sec-consult.com RUSSIA CJCS Security Monitor 5th Donskoy proyezd, 15, Bldg. 6 119334, Moscow Tel +7 495 662 1414 Email info@securitymonitor.ru SINGAPORE SEC Consult Singapore PTE. LTD 4 Battery Road #25-01 Bank of China Building Singapore (049908) Email office-singapore@sec-consult.com CANADA i-SEC Consult Inc. 100 René-Lévesque West, Suite 2500 Montréal (Quebec) H3B 5C9 Email office-montreal@sec-consult.com AUSTRIA SEC Consult Unternehmensberatung GmbH Komarigasse 14/1 2700 Wiener Neustadt Tel +43 1 890 30 43 0 Email office@sec-consult.com THAILAND SEC Consult (Thailand) Co., Ltd. 29/1 Piyaplace Langsuan Building 16th Floor, 16B Soi Langsuan, Ploen Chit Road Lumpini, Patumwan | Bangkok 10330 Tel +66 02 041 1146 Email office-bangkok@sec-consult.com www.sec-consult.com