A company appears to be abusing #BugCrowd’s #bugbounty program to hide essential details of a critical vulnerability. The company itself has rated the vulnerability as low severity. This has led many to disregard the vulnerability, which may have resulted in unpatched systems that remain vulnerable.

"I would like to remind you that as a researcher using the BugCrowd platform to submit this issue you are bound by the BugCrowd standard disclosure terms and you may not blog or disclose any information on the exploitation of this vulnerability."

I were to follow these rules, it would mean that countless of client systems could remain vulnerable to this critical vulnerability.

I’ve mostly had good experiences with bug bounty programs before this incident. Sure, I’ve had some disagreements at times, but I’ve never seen a program being abused like this before.

Just a reminder: with those bug bounty platforms like Bugcrowd, HackerOne or whatever, as a security researcher you are not their customer, you are the product.

If there is a conflict they will tend to side with their customer, meaning the company running the bug bounty program. Good luck proving that you have a right to disclose that vulnerability. They will pressure you into not disclosing as long as the company is opposed. So if you still want to decide anything it’s better not to grow too attached to that account because it will be used as leverage against you.

And they will try very hard to filter reports before these reach the company. If your report is more difficult to understand than the typical report for this program – good luck reaching the company, you’ll need it. It’s very likely that your report will be closed as “out of scope” with all appeals falling on deaf ears. The bug bounty platforms are paid for filtering, not for letting reports through just because they have doubts about them. You might need to think about other ways to reach the people actually in charge.

I've had amazingly frustrating time dealing with #bugcrowd - There is minimal feedback or status updates. I do not know if this is limited to just managed bug bounty programs. Maybe the client in question is more to blame, but either way the experience is frustrating for me as a reporter.

As it stands now, I have no clue if critical issue I reported months ago will be getting a resolution or if one is even planned. Meanwhile millions of systems remain vulnerable. #venting

CISA launches platform to let hackers report security bugs to US federal agencies - The Cybersecurity and Infrastructure Security Agency has launched a vulnerability ... - http://feedproxy.google.com/~r/Techcrunch/~3/cSPU-hVSUjc/ #informationtechnology #federalgovernment #computersecurity #internetsecurity #cyberwarfare #unitedstates #cyberattack #government #cybercrime #solarwinds #computing #security #bugcrowd #cisa

Noticed that #Bugcrowd is listing sessions under https://bugcrowd.com/settings/active_sessions that are a year old already. This raises both security (not automatically expired, really?) and privacy (storing my full IP address, #GDPR compatible?) questions.

I published my thoughts on private bug bounty programs. These don't reflect well on the vendors running such programs, and neither on #Hackerone and #Bugcrowd.

Many thanks to @k8em0@twitter.com for the inspiration.

https://palant.de/2018/12/10/if-your-bug-bounty-program-is-private-why-do-you-have-it