241

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the community thinks. This program will be run through HackerOne where we are currently testing features internally.

Why offer money?

We’re dedicated to ensuring our users' security and have long relied on our community to report security vulnerabilities to us. We’re very grateful for all the help we’ve received from those listed in our Hall of Fame and others who have helped us out with other minor things in the past. However, it’s become clear to us that this process isn’t enough — it's become commonplace for companies to offer rewards to security researchers, and many of those top security researchers naturally spend their time on sites which offer to pay them. That is why we feel it's necessary to start offering a reward to those who dedicate their time to aiding our development efforts through reporting these vulnerabilities in a responsible way. We feel that not offering a monetary reward for these reports makes us appear to care less about the security of our users to both our users and the hacking community.

How much are you offering?

If you’re not familiar with HackerOne, you earn a varied amount based on the severity of the vulnerability, as determined by our security team. We are still deciding on the exact amounts, but we'll likely start at the lower end of the spectrum (think: hundreds, not thousands of dollars). This is one of the things we'll need to evaluate as we put the program together and test it out.

Are you finally implementing the Hacker badge?

Maybe. The idea of awarding badges for those who report vulnerabilities has come up, but we have not decided quite yet. We plan to start a separate meta post about potential badges later on. Please do not focus on the potential for badges in this discussion, as we would like to gather input on the program itself first.

Can I still get swag?

Probably not. We previously offered site swag to those users who reported serious vulnerabilities. For now, we're considering the cash bounty to be a replacement for the swag. It's possible that in the future we'll offer both, but for now offering swag and cash would just double the complexity of awarding bounties.

Do you have a timeline for implementation?

After feedback, we'll likely start with a Private Beta on HackerOne with invited users who have previously reported vulnerabilities to us that resulted in something getting fixed, particularly those on our Hall of Fame list. We'll expand that list in waves as we fix issues, respond to feedback, adjust the rules of the program, etc. The Private Beta will initially be very limited in scope (starting with only our Enterprise demo site) and expand to our full scope as we get a feel for the system.

Can I sign up for the private beta?

You absolutely can! You can fill out this form to get on the list to be considered. As stated above, those who have reported vulnerabilities to us before will receive precedence in joining the private beta. We’ll then be selecting users who have identified that they have security research background, followed by any other users. Given the short period of time the private beta may be running, not everyone who fills out the form is guaranteed to get into the private beta before the program ends up going public.

So what feedback do you want?

Anything. We realize our communities have strongly been based on the efforts of our users contributing for free and that beginning to reward users monetarily in this way can seem like it undermines the spirit of Meta and the processes we’ve had in place in the past. However, we hope that our reasoning for pursuing this option is clear and warranted and, most of all, we want our users to be on board.

If you have any further questions on something we missed or something you’d like to point out, please feel free to share your thoughts.

  • 11
    I'm on the Hall of Fame, do I need to fill out the form to be invited because that is not 100% clear to me. – rene Jun 20 '17 at 15:19
  • 4
    @rene I believe we were going to reach out to the Hall of Famers manually, but filling out the form doesn't hurt either. ;) If anything it's an email we don't have to send you to ask for your HackerOne URL. – animuson Jun 20 '17 at 15:20
  • OK, I'll take the doesn't hurt route as well, just to be sure, thanks! – rene Jun 20 '17 at 15:22
  • 39
    WRT exact pricing decisions, my gut feeling (not based on any rigorous logic or objective principles) is that hundreds of dollars might be acceptable for a report of a potential vulnerability (where the reporter doesn't actually manage to nick any data or take any unauthorised actions, but either demonstrates that this would be possible in some unlikely situation or else just finds that some security best practice isn't being followed), but that any actual successful penetration deserves a reward solidly in the thousands of dollars. – Mark Amery Jun 20 '17 at 17:17
  • 2
    This question was in the 'related' list, but should probably be "Linked" instead: Should I report a serious security issue on meta?. – hBy2Py Jun 20 '17 at 22:31
  • 5
    What if a user for some reason prefers rep over money? – John Militer Jun 21 '17 at 1:27
  • 47
    @JohnMiliter Rep carries a specific meaning within the network. Security issues, as infrastructure problems, are really outside the network. Gaining rep for helping improve site security seems like a category error to me. – hBy2Py Jun 21 '17 at 3:17
  • 11
    Yay! We on Information Security have been asking for this for a long time, such as meta.stackexchange.com/q/277737/135923, and first time was almost exactly 5 years ago :D security.meta.stackexchange.com/a/814/33 – AviD Jun 21 '17 at 8:34
  • 3
    Just a sugestion: it would be interesting to show what vulnerability problems the user encountered, like GitHub does nowadays. – Renan Jun 21 '17 at 12:24
  • Just a question..- Why has the original question asked Mar 31, '16 by Rory (Question ID: 277737) been marked as a duplicate? Why not 'transform' his question to the main question since it's been asked first. I'm only prioritizing his over this one because of the asked date. Not looking at content at all. Personally I think it's kind-of unfair towards Rory since he's asked this about a year and three months ago. Ofcourse content is way more important than the asked date, which is why I'm wondering; Why not just 'merge' or edit his question to a more appropriate format. – Paramone Jun 21 '17 at 13:12
  • 14
    @Paramone It would be kind of weird for us to make an announcement post like this by hijacking another user's post. Also, in the past there was a weird bug where featured MSE posts have to be created within the past 14 days in order to show up in the community bulletin network-wide, and I've no idea if that got fixed or not. – animuson Jun 21 '17 at 14:18
  • 3
    Offering money instead of rep kind of makes it seem like you think the relevant know-how is not to be found amongst your core users. – Benjol Jun 22 '17 at 4:52
  • 1
    To be clear - is this security vulnerabilities for the SE network of sites, or just vulnerabilities in general? – user3791372 Jun 22 '17 at 13:12
  • 25
    @Benjol Personally, the idea of offering rep never even entered my head because it seems like such a violation of the rep system, and I would expect it to really annoy a lot of users. – Guest Jun 22 '17 at 15:51
  • 6
    @Benjol Not at all. Money is definitely the right thing to offer, because it actually has value. Being “paid” with rep would be insulting. – Ry- Jun 27 '17 at 2:24
80

For context: I'm someone who (A) enjoys the heck out of the Stack Exchange network, (B) very much appreciates when others take (my) data security seriously, and (C) can program sorta well but nowhere near on the level needed to evaluate security vulnerabilities (viz., I will never earn one of these rewards myself).

I think this is a fantastic idea.

Site security is, IMO, "meta-meta". It sits on a level at least one rung above the site-network-internal policy discussions/decisions that happen on Meta.SE itself. It also touches deeper into ("penetrates through?") the Stack Exchange system in a sense, since it has the potential to touch the lives of site users, online and off, in a very direct way. Offering monetary rewards to individuals who materially contribute to the security of the site network seems entirely appropriate and prudent.

34

This is a fantastic idea. As I mentioned in a comment above, it has been requested by the security community for a long time, and will undoubtedly contribute greatly to the overall security of the platform (and possibly the security research community at large, if any findings are written up and published).

I am sure you've received this advice already, but worth reiterating and emphasizing: the public bug bounty program should only be started after rigorous internal reviews, including threat modelling, code reviews, static/dynamic analysis, etc.

While I look forward to the open bug bounty and encourage it, if the above steps have not been done yet I would urge you to reconsider and postpone till afterwards. I am sure that the Security.SE community will be happy to recommend great candidates to do the above, I am familiar with many.

And, if it's already been done - kudos!! And I look forward to the challenge!!

  • 2
    Could you explain why it should not be started before after those things? – Matsemann Jun 21 '17 at 10:04
  • 2
    @Matsemann I assume this would at least partly be to minimize the early financial weight of the program to SO, by avoiding non-SO bugfinders submitting dozens of bounty-eligible tickets. – hBy2Py Jun 21 '17 at 12:50
  • 13
    @Matsemann as hBy2Py said, but also because you don't want to throw a (even bigger) target on yourself until you do a proper security assurance process. Bug bounty programs are not a replacement for this. It comes down to reducing risk, and managing the residual via the bug bounty program. You should ensure your system is mature enough to handle the damage, before trial by fire. – AviD Jun 21 '17 at 13:42
22

Whilst I can't fault the idea of Bug Bounties, there is some evidence coming through that they many sites on such programmes retain significant bugs even after a substantive period. So I would say get an application security testing company to make recommendations first and implement them (Declaration I don't work for one, although I do security test web applications).

Also Bug Bounties typically exclude things like social engineering, and process failings in organisations. You may well have these covered elsewhere, but business processes should be a "before anything else" item.

My pet hate:

Bug bounties that exclude lots of issues that the site owner hasn't cleaned up.

The classic is HTTP related security headers (think CSP, HSTS), or cookie flags, kind of thing covered by securityheaders.io or Hardenize, or Immuniweb. Also the kind of thing Burp-Suite spits out in the first few milliseconds of a scan.

meta.stackexchange.com gets a C at Immuniweb

meta.stackechange.com gets an F at securityheaders.io

Hardenize has some suggestions (DNSSEC), but doesn't really help much.

These are important defences, the bug bounties typically exclude them as they permit of automated reporting, and typically fall under best practice rather than a specific vulnerability. So either there is no reporting, or no reward for reporting these holes, so they go unreported.

For example you do Strict-Transport-Security (with a short max-age!!!) on meta.stackexchange.com, but you don't include subdomains, so if an attacker has access to the network he can create "hackme.meta.stackexchange.com" (because DNS is usually unsecured, yours definitely is) and have access to the end-user's cookies (which incidentally all lack the secure flag so are all game for being stolen this way when Strict Transport Security is not in effect).

Typically Bug Bounties exclude a report like this. This isn't a fault of the bug bounty programme, but perhaps something to understand about them before you get started.

So quite often I see sites on Bug Bounty programmes where I can break the protection TLS is suppose to provide, but I end up reporting it via support rather than the bug bounty programme, because the bounty programmes want clever and original, when 'simple' hasn't been done. Or there are a bunch of good practices being omitted, again typically excluded from bug bounty programmes.

When in doubt copy what github.com have done. GitHub even have a really good blog about it.

Apologies for the "how to hack meta.stackexchange.com user's cookies" bit, but anyone who is capable didn't need the hint, as they already know how to do this sort of thing.

9

Many countries have some form of "computer misuse" laws that potentially make the sort of activity needed to uncover a vulnerability illegal. I don't know if this is automatically covered by Stack Overflow partnering with HackerOne (i.e. by doing so, SO effectively gives people "permission to hack"1), but is this an area you need to consider?

___

1 Presumably with conditions like that the actions are not intended to cause harm and will be reported in a timely manner.

  • 1
    The community at Security Stack Exchange has discussed this with Shog and the folks. I think SE are well aware of the implications across various jurisdictions, and they know they can contact us if any specific issues come up. – Rory Alsop Jun 23 '17 at 8:24
3

Great step ahead.

Almost all major companies like Facebook, Google Yahoo, Apple, etc. have bug bounty programs which help them to keep their site secure. Why SE is so late in this thing? Along with this, do you have any plan to conduct a hacker cup like challenges or something?

I have some questions

  1. How will you treat people who report security vulnerability after making severe actions to the community?

Will they still get the bounty?

  1. Will area51 is in scope or out of scope for this program?

  2. Did you provide test accounts(like facebook) in order to perform actions related to user accounts or do we have to use community user instead?

  3. The beta form needs our Stack Exchange user id. which means only SE users are allowed in beta. What will be in future? Only SE members are allowed? or outsiders are also allowed?

  • 2
    In order to be eligible for payment, you have to follow ethical hacking and responsible reporting guidelines - you can always create a sock-puppet to test security issues rather than testing on a real user, when necessary. Our initial scope is going to start with our demo Enterprise instance only, and expand to all Stack Exchange sites later on, but I'm not 100% on whether Area 51 will be included (I'd assume it would). The limitation of Stack Exchange users is meant for the private beta only. Once the program goes public, anyone can participate regardless of their membership with us. – animuson Jun 22 '17 at 14:13
  • so there will be a demo enterprise site for private beta users. right @animuson – Optimus Prime Jun 22 '17 at 14:18
  • The demo already exists: demo.stackenterprise.co - Users will not be provided an account there. The idea is to see if users can get into it (since this is a paid product meant for internal use only, users being able to access it is a very serious concern), begin getting other security issues that don't involve access out of the way, and just gauge how much activity we get from the limited scope so we can better plan expansion of the scope. – animuson Jun 22 '17 at 14:21
  • Huh, very interesting to see a glimpse of the enterprise version. Now I actually realize the enterprise offering is a thing I'm wondering if there are any (extremely rough) statistics anywhere on who's using it and for what. I imagine it's not hard to find demand for an internal knowledgebase system as well-written (IMO) as SO's. – i336_ Jun 29 '17 at 2:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .