What is a “bug bounty program”?
A bug bounty program is a public invitation from a company to security researchers: actively search for vulnerabilities in our systems, report them to us responsibly - instead of exploiting or publishing them - and we’ll pay you a reward for it. The amount usually depends on the severity of the finding. Beforehand, the company defines what may be tested (scope) and what is off-limits (out-of-scope), often mediated through platforms like HackerOne or Bugcrowd.
A real-world analogy
Isn’t it strange? In the digital world, you can get paid to put yourself in an attacker’s shoes and simulate an attack on a company’s digital infrastructure.
And in the analog world? Here’s how I imagine it (using a hotel as an example).
Scenario
- A hotel owner puts up a public notice inviting people to search for, find, and report security issues, with the prospect of a reward. He specifies that the garden is “out of scope.” The focus should be on the building.
- I see this notice and make a plan.
- I book a room and travel there. I go straight to the reception desk. “Cash or card?”, I’m asked… cash, of course! I pull the counterfeit 50€ bills out of my wallet and hand them over. Just as I’m about to be given change, I point out to the person that it’s counterfeit money and pull out my bank card. From the visibly confused person, I get the bills back, pay by card, and receive the key card for room 16.
Notes:
Severity: High
Attack complexity: low, since counterfeit money is easy to obtain and no verification tool (UV lamp, detection pen, watermark check) was used at the reception desk;
Impact: Violation of the integrity of the payment process, immediate financial damage that can be scaled arbitrarily with repeated use.- 30 minutes later… I’ve arrived in my room and keep wondering how an attacker would act. A little later, I’m standing in front of the curtains with a lighter and a fire extinguisher. I don’t want to cause any damage and am only checking whether they are theoretically flammable. Yes, they are. I note down in detail how I did it and that this needs to be fixed. An attacker could potentially have set the entire building ablaze with the highly flammable curtains… A classic: the last hotel hadn’t thought of this either.
Notes:
Severity: Critical
Attack complexity: low, since lighters are freely available;
Impact: Violation of availability and integrity.- It’s evening now and I haven’t tried room service yet. I use the phone and order the daily menu for room 19. What will happen? Unfortunately, the reception desk seems to see the number of the calling room (16) displayed. The food gets delivered to my room and presumably also charged to my bill. Too bad.
Notes:
Impersonating other guests towards room service unfortunately not that easy. TODO: How to spoof a different room number?- The next morning… I check out. But who says an attacker has to follow the prescribed checkout process? The person at reception is currently distracted by other checkouts. Does this already count as a denial of service? It doesn’t really stand out that I just left the hotel with my suitcase. A reception desk that distracted surely also won’t notice if I come back next week to try out whether my un-returned key card has been revoked, or whether I can still use it to enter my room… The bill for yesterday’s meal will presumably arrive by mail. But who says I gave a correct address when booking the room?
Notes:
Missing session invalidation?- I drive home and write up my report, curious how big the payout will be. Don’t be too optimistic! The last hotel closed 2 of my reported issues as duplicates…
Plans for the future:
Notes:
- After reporting & sufficient time to fix, run regression tests
- (Social engineering) Can I get a key to someone else's room through tricks?
- (Race condition) Simultaneous cancellation and check-in?
- (Business logic flaw) Minibar: Is consumption only checked on a spot-check basis? Does it stand out if I swap bottles instead of removing them? Does it stand out if I only take a sip of the contents?
- (Broken access control / IDOR) Breakfast buffet: Is stating someone else's room number enough, or is it actually verified who lives where?
- (Privilege escalation) Staff doors and emergency exits: Can areas be entered that are actually reserved for staff only?Conclusion
Ok, I admit it: in my scenario I would have broken several laws multiple times, and the scope and restrictions would probably have prohibited most of it…
But interestingly, in the digital world a system has to be secured against every conceivable attack vector, while in the real world things are seen much more loosely. On a hotel’s website, I can only perform a limited, deliberately chosen set of actions, and any unplanned extension of these actions to the company’s detriment would usually be fixed quickly. Under normal circumstances, I’m physically not even able to do this, unless I find a flaw in the system. In the real world, on the other hand, I can just walk into the hotel and make sure it burns down. In both cases, laws would be broken. The latter, however, would probably be harder to pull off undetected/anonymously and harder to prevent completely. Perhaps these are the decisive differences…