Bug Bounties, Bug Hunting and Vulnerability Disclosure
Channel: Z. Cliffe Schreuders
Date: 2018-06-08

This video is part of the computer/information/cyber security and ethical hacking lecture series; by Z. Cliffe Schreuders at Leeds Beckett University. Laboratory work sheets, slides, and other open educational resources are available at http://z.cliffe.schreuders.org. 

The slides themselves are creative commons licensed CC-BY-SA, and images used are licensed as individually attributed.

Topics covered in this lecture include:
Zero days
Vulnerability disclosure
Responsible/coordinated disclosure involves first contacting the affected vendors and giving them time to fix the issue, usually with a time limit before going public
Full disclosure involves going public with all the technical details of a vulnerability without first giving the vendor an opportunity to fix
Our vulnerability disclosure policy
Reporting a vulnerability in software you have installed on your own systems
Reporting a vulnerability in a live website
If you would like to follow a different vulnerability disclosure method, then please discuss this with me beforehand
Reporting a vulnerability in software you have installed on your own systems
Reporting a vulnerability in a live website
Testing a live website for security issues is a legally complex matter, and unless you have permission from the owner, you are likely acting illegally
The legality of your actions depends much on the good will of the company you are testing
I recommend you focus your efforts on software that you can install on your own servers, including webapps, rather than risk acting illegally
You take responsibility for your own actions
Bug bounties

Sites such as Bugcrowd and HackerOne list companies that have official policies for external security testers, typically with rewards for co-ordinated disclosure
Which is typically a requirement in order to have permission to test their systems
They do some mediation, and provide guidance on reporting
Bug bounties

“The average bounty paid to hackers for a critical vulnerability was $1,923 in 2017, compared to $1,624 in 2015 — an increase of 16 percent. The top performing bug bounty programs award hackers an average of $50,000 a month, with some paying nearly $900,000 a year.” HackerOne, HACKER-POWERED SECURITY REPORT 2017.
“Google Chrome steadily increased their top bounty from $3,000 to $100,000 over the course of more than five years”
Bug Bounty hackers are young

Over 90% of all successful bug bounty hackers on HackerOne are under 34 years old
26% are students
2016 “Bug Bounty Hacker Report: Who are these bug bounty hackers?”
Bug bounties are still the exception

94 percent of the top publicly-traded companies do not publish vulnerability disclosure policies
Mostly technology companies
Stats from HackerOne, HACKER-POWERED SECURITY REPORT 2017
Bug bounties by industry

Finding Bugs
When you have access to the source code:
Manual code review
Static analysis: software to automatically analyse code
If you do or do not have access to the source code:
Reverse engineering: as above
Binary static analysis
Fuzzing to do “random testing”
Static analysis
Static analysis can aid code review, to automatically analyse code to detect common programming mistakes
Great for detecting errors that can be automatically detected, such as:
Buffer overflows, memory errors, unsafe functions
For web static analysis: ESLint
Some tools have a high false positive rate
They will not detect everything!
Fuzzers
Fuzz testing, AKA fuzzing: feeding in variations of unexpected input into a program in an attempt to uncover unexpected behaviour
Fuzzers are often used by security researchers to find new vulnerabilities in software
Can be used for black-box testing
Or white or grey-box testing
Approaches to fuzzing
Simple fuzzing: Feed in input of increasing sizes into a program
The input may include sequences designed to trigger problems, such as special characters
Mutation: takes a standard input/protocol and makes incremental changes
Change sections of input at random
The more aware of the protocol expectations the better (for example, maintaining “Content Length” headers)
Web fuzzing
OWASP ZAP can fuzz based on previous requests:
Right click a request and select “Attack / Fuzz…”; or,
Highlight a string in the Request tab, right click, “Fuzz…”; or,
Select the “Tools / Fuzz…” menu item and then select the request you want to fuzz