Security Radar 4

[gratipay-bot]

← Security Radar 3

---

Docs

http://inside.gratipay.com/howto/sweep-the-radar

Scope

This radar covers Gratipay's security program, including:

• our HackerOne account
• the "Handle Security Issues" document
• Security Team issues
• the legacy Hall of Fame page on gratipay.com
• the @gratipay/security team
• the https://github.com/gratipay/security repo
• the [email protected] email address

Queue

Unclear Risk

https://hackerone.com/reports/117187
https://hackerone.com/reports/117195

Severe Risk

Moderate Risk

Mild Risk

https://hackerone.com/reports/76304
https://hackerone.com/reports/76306
https://hackerone.com/reports/80907
https://hackerone.com/reports/90805
https://hackerone.com/reports/108645

https://hackerone.com/reports/109161
https://hackerone.com/reports/111325
https://hackerone.com/reports/115284
https://hackerone.com/reports/117739
https://hackerone.com/reports/117984

https://hackerone.com/reports/118699
https://hackerone.com/reports/120026
https://hackerone.com/reports/123688
https://hackerone.com/reports/123697
https://hackerone.com/reports/118023

Theoretical Risk

https://hackerone.com/reports/78151
https://hackerone.com/reports/81701
https://hackerone.com/reports/90777
https://hackerone.com/reports/90778
https://hackerone.com/reports/116147

https://hackerone.com/reports/117142
https://hackerone.com/reports/117330
https://hackerone.com/reports/117386
https://hackerone.com/reports/117833
https://hackerone.com/reports/123742

https://hackerone.com/reports/123942
https://hackerone.com/reports/123897
https://hackerone.com/reports/124096

[chadwhitacre]

Dang.

As you can see in the video i was able to set a new password of the user by brute forcing the code which was sent to your email address/phone number.

Vulnerable request:

POST /recover/as/code/ HTTP/1.1
Host: beta.facebook.com

lsd=AVoywo13&n=XXXXX

Brute forcing the "n" successfully allowed me to set new password for any Facebook user.

http://www.anandpraka.sh/2016/03/how-i-could-have-hacked-your-facebook.html

[chadwhitacre]

New 0, Triaged 31.

@TheHmadQureshi We should go through and sort these tickets by priority. Some still need to be validated and some may be dupes.

[chadwhitacre]

Okay, here's my prioritization:

Severe Risk

Moderate Risk

Mild Risk

https://hackerone.com/reports/108645
https://hackerone.com/reports/111325
https://hackerone.com/reports/76306
https://hackerone.com/reports/90805
https://hackerone.com/reports/76304
https://hackerone.com/reports/118023
https://hackerone.com/reports/117739
https://hackerone.com/reports/120026
https://hackerone.com/reports/117325
https://hackerone.com/reports/118699
https://hackerone.com/reports/115284

Theoretical Risk

https://hackerone.com/reports/90777
https://hackerone.com/reports/78151
https://hackerone.com/reports/117386
https://hackerone.com/reports/90778
https://hackerone.com/reports/81701
https://hackerone.com/reports/117330
https://hackerone.com/reports/117833
https://hackerone.com/reports/116147
https://hackerone.com/reports/117142

Unclear Risk

https://hackerone.com/reports/109161
https://hackerone.com/reports/80907
https://hackerone.com/reports/117685
https://hackerone.com/reports/117187
https://hackerone.com/reports/117195

[chadwhitacre]

I've posted our queue in the description so that it carries forward from week to week.

[chadwhitacre]

It's kind of amazing how activity on HackerOne generates activity on HackerOne.

New 12, Triaged 27.

[chadwhitacre]

New 2, Needs More Info 1, Triaged 29.

[chadwhitacre]

Seems like the $1 bounties are coming across as insulting:

https://twitter.com/merttasci_/status/710617553400369152
https://twitter.com/BACHI_BS/status/700328313315729409

Maybe we should drop the bounties entirely for theoretical risks?

[mattbk]

It depends on whether the reports are viable threats.

How much are other organizations paying for reports of the same type of threats?

[chadwhitacre]

reports are viable threats.

Check our security policy: we differentiate four levels of risk/viability, and the suggestion is that we offer no bounty for the lowest risk level.

How much are other organizations paying for reports of the same type of threats?

Other orgs offer 10x what we're offering, but we're small and of humble means. :)

[mattbk]

This is a terminology problem, then. If people are submitting risks and then getting mad that you're calling them "theoretical," they obviously thought the risk was more substantial.

Is there some way to link to a set of example reports that fall within each category?

[chadwhitacre]

If people are submitting risks and then getting mad that you're calling them "theoretical,"

That hasn't been the case. It's outside observers that are seeing our $1 bounties on https://hackerone.com/hacktivity and commenting about it on Twitter.

[mattbk]

Well, there's always #236.

[chadwhitacre]

Yeah, fair enough. Let the peanut gallery be the peanut gallery.

[TheHmadQureshi]

How about we hide the amount of bounty ?

[chadwhitacre]

How about we hide the amount of bounty ?

Booooooooo. We're an open company! :)

[TheHmadQureshi]

oh yeah. But as we are gonna disclose the bug, the amount will be revealed but at least that wont feel awkward on Hacktivity.

[chadwhitacre]

If we feel awkward about it then we shouldn't do it. If we should do it then we don't need to feel awkward. :)

[chadwhitacre]

Also, I think we want to show up on Hacktivity, right? It looks like listing bounties there is all or nothing.

[chadwhitacre]

I.e., we can't show the $40 payouts but not the $1 ones. Right?

[chadwhitacre]

I mean, the $1 bounties are for theoretical risks. If someone is humiliated by that then they should make better reports. :-)

[TheHmadQureshi]

Yes thats what i am saying. Dont show bounties on H1. As soon as we will disclose the bug ( which is certian ) the bounty will be visible as well but till that it will only say as: Gratipay rewarded Hammad with a bounty.

[chadwhitacre]

Okay, that makes sense. I didn't realize we could be on Hacktivity without listing bounty amounts.

Done! :-)

[chadwhitacre]

On the other hand, we were getting some press from our $1 bounties, now we don't have that.

[chadwhitacre]

[chadwhitacre]

Let's own it! We're small, but we're at the table. Why hide? :-)

[chadwhitacre]

Reminds me of when I used to deliver produce for the forerunner of Clarion River Organics. I would roll up to the Giant Eagle warehouse in our small, unrefrigerated, non-dock-height box truck, and get in line right alongside all of the big ol' 18-wheelers. 🚚

[chadwhitacre]

Rewarding a security expert with a $1 bounty is like leaving a waitress a penny for a tip. Stingy and disrespectful if you ask me.

---

We're bootstrapped, our top-line revenue is ~$1k/mo, and our internal staff are unpaid. We're proud to offer the bounties we do. That said, you're right that our bounties are below market. We've added an explanation to https://hackerone.com/gratipay. :-)

https://twitter.com/Gratipay/status/711172821351706624