Bug Bounty Program for the Web by Raymond Forbes

MAIN PRESENTER: Raymond Forbes, Web Security Engineer, Mozilla Corporation

ABSTRACT: This talk will look at the Mozilla bug bounty program and how it has helped with web security. We will be looking at the history of the program, how it is set up, some successes and common concerns.
BIO: Raymond has been a web security engineer with Mozilla since 2011, and is visiting OWASP Vancouver chapter from Seattle, WA.

WHEN: August 7th 2013

WHERE: Live streaming from Mozilla Vancouver

WEBCAST: http://www.youtube.com/watch?v=VZHp5Ssi67U

SPONSOR: Chapter partner OWASP Vancouver

Transcript

1. Bug Bounty Programs
   Crowdsourcing Security
   Raymond Forbes
   Mozilla Corp
   

   View Slide

2. Agenda
   • History of Bounty Programs
   • Why and How to make a program
   • Bug Bounty Process
   • Common Bounty Concerns
   • Interesting bugs found
   • Mozilla Bounty Results
   • Conclusion
   

   View Slide

3. Purpose of this Talk
   • Introduce you to the concept of bug bounty
   programs
   • Invite people to participate as much as
   possible and take advantage of these
   programs.
   – Including ours!
   • Encourage companies who are not currently
   incorporating a bug bounty into their SDLC to
   do that.
   

   View Slide

4. History of Bug Bounty Programs
   

   View Slide

5. History of Bounty Programs
   • 1995 – Netscape
   • 2002 – iDefense
   • 2004 – Mozilla Firefox
   • 2005 – ZDI
   • 2007 – Pwn2Own
   2010
   Google Chromium
   Deutsche Post-Ebrief
   Google Web
   Mozilla Web
   Barracuda
   2011
   Hex Rays
   Facebook
   2012
   Paypal
   

   View Slide

6. Types of Programs
   Central Clearing House
   •iDefense
   •ZDI Tipping Point
   Pre-approved Teams/Competition
   •Pwn2Own
   •Deutsche post E-brief
   Open to all – Reported direct to software
   maker
   •Netscape
   •Mozilla Firefox
   •Google Chromium
   •Google Web
   •Mozilla Web
   •Barracuda
   •Hex Rays
   •Facebook
   •Paypal
   

   View Slide

7. Client Programs
   • Mozilla Corp
   • $3000
   • Barracuda Labs
   – $50 to $3133.7
   • Qmail
   – $1000
   • Samsung TV
   – $1000 and more
   • Hex-Rays
   – $3000
   

   View Slide

8. Programs for the Web
   • Mozilla Web Bounty
   • $500 - $3000
   • Google Web Bounty
   • $500 - $3137
   • Facebook Security Bounty
   • Typically $500, paid up to
   $5000
   

   View Slide

9. Make our own bounty program
   

   View Slide

10. Bounty Programs – Why?
    • User & user data safety is job #1.
    • Productive relationship with community.
    • Work directly with researchers.
    • Consistent security at scale is hard
    • People are doing it now without notifying us.
    • The gray market is a big deal
    

    View Slide

11. Time to launch a bug bounty program!
    Bug bounties are an enhancement, not a substitute
    for any portion of a secure SDLC.
    

    View Slide

12. Bounty Programs - Preparation
    – Gain developer and team lead support.
    – Check your code.
    – Define clear reporting process.
    – Define scope and types of issues.
    – Build team to respond to reports.
    – Set SLAs for responses.
    – Announce program.
    – Root cause analysis.
    – Learn and adjust.
    

    View Slide

13. Bounty Preparations – Web Specific
    • Goal: Protect users
    • Define critical issues for your organization
    – XSS, CSRF, open redirects?
    • Define scope of program
    – Bugzilla.mozilla.org
    – Addons.mozilla.org
    – Download.mozilla.org
    – Lots more
    • Will your scope include 3rd party frameworks?
    – Wordpress, Rails, Django, Python, Drupal
    

    View Slide

14. Bug Bounty Process
    

    View Slide

15. Bug Bounty Process
    • Somebody reports vulnerability
    – Email to security@mozilla.org
    – Bug created in bugzilla.mozilla.org
    • If a bug was not made by the reporter, one is
    created by the security team
    – Set the sec bounty flag to ? Will start this process.
    – Secure, only readable by security group and reporter.
    – All communication from devs/security group/reporter
    etc. happens in the bug
    

    View Slide

16. Bug Bounty Process
    • Bug Bounty Committee meets and discusses all
    bugs that are nominated for the bounty
    – At least 3 people meet.
    – Each bug is evaluated for risk
    – Web bugs risk is partly based on what
    sites/application the vulnerability was found.
    – Bugs must be at least HIGH risk to be eligible for a
    bounty.
    – Can’t be a duplicate
    – All recent builds eligible. (e.g. nightly, aurora, etc)
    

    View Slide

17. Bug Bounty Process
    • Web bug specifics
    – HIGH risk or above
    – Specific sites spelled out in the FAQ
    • Possible to pay out for others if serious enough
    – No duplicates
    

    View Slide

18. Common Bounty Concerns
    

    View Slide

19. Bounty Concerns
    – Common concerns with web bounty programs
    • Encourage attackers
    • Too expensive
    • Veil of cover for attackers
    • Bounty program duplicates internal security work
    • Can’t compete with the black market.
    

    View Slide

20. Bounty Concerns – Encourage attackers
    – Bad guys already attacking you.
    – Without bounty program, good guys afraid to test or report.
    – Bounty program enables participants that will help you.
    

    View Slide

21. Bounty Concerns – Too Expensive
    – Very high value
    – Compare bounty payout with equivalent 3rd party testing.
    – Provides continual testing.
    – Use individual bugs to identify root cause flaws.
    – What percentage of profit spent on security?
    

    View Slide

22. Bounty Concerns – Veil of cover for attackers
    – Goal is to identify flaws, not identify bad guys.
    – One possible deployment:
    • Full security controls and active blocking in prod
    • Setup public stage for testing with dummy data.
    • Configure production to actively blocks attackers
    • Stage area could be next revision of code for prod.
    

    View Slide

23. Bounty Concerns – Duplicates internal security work
    – You don’t know what you don’t know.
    – Identifies process breakdowns.
    – Identifies areas for training in SDLC.
    – Another tactic to protect users and critical data.
    

    View Slide

24. Bounty Concerns – Can’t Compete with the Black Market
    – Bounty programs and black market target different audiences.
    – Some people are bad, but many people are good.
    – Many don’t want hassle or questionable ethics/legalities of black markets.
    

    View Slide

25. Firefox Bug Bounty Results
    

    View Slide

26. Firefox Bounty Results
    

    View Slide

27. Firefox Bounty Results
    

    View Slide

28. Firefox Bounty Results
    

    View Slide

29. Firefox Bounty Results
    

    View Slide

30. What are people submitting?
    • Anything found with a fuzzer
    – Heap overflows
    – Use after free vulnerabilities
    – Stack overflows
    • Cross-origin or framing failures
    • Unauthorized access to Chrome
    

    View Slide

31. Mozilla Web Bounty Results
    

    View Slide

32. Mozilla Web Bounty – Submission Timeline
    

    View Slide

33. Mozilla Web Bounty – Types of Issues
    

    View Slide

34. Mozilla Web Bounty – Bugs Reported
    

    View Slide

35. Mozilla Web Bounty – The Bounties
    

    View Slide

36. Mozilla Web Bounty – The Reporters
    • Countries of Origin
    – Europe – 50%
    • Germany – 20%
    • France – 20%
    • UK – 12%
    • Finland – 12%
    – United States – 20%
    • Bay Area – 50%
    • Rest of US – 50%
    – India – 10%
    – Russia – 5%
    

    View Slide

37. What are people submitting?
    • Typical web vulnerabilities
    – XSS
    – CSRF
    • Be prepared for the low level vulnerabilities
    – Cookies not properly secured
    – Frameworks not up to latest.
    • Once the easy ones are out of the way there is
    opportunity for more interesting bugs to be
    found.
    

    View Slide

38. Mozilla Bounty – Benefits
    –Engage community.
    –Produce many high value bugs.
    –Bounty is not purchasing silence.
    –Security at a huge scope.
    –Identifies clever attacks and edge cases.
    

    View Slide

39. I found a vulnerability! Now what?
    • Hold on to it.
    – Use it for nefarious deeds and keep it away from the public
    • Release it to the web, full disclosure
    – Increase your street reputation
    – Not something that happens as much anymore.
    • Sell to the gray market
    – Big cash payout
    – Negative impact on rep
    • Send to vendor (hopefully through bug bounty program)
    – Make some money
    – These bugs go public for the most part so helps with rep
    

    View Slide

40. Why not the gray market?
    • Negative impact on reputation
    – Companies that do not deal with the gray market
    are hesitant to deal with people who have.
    • Requirements higher
    – Weaponization needed for payout. Bounties only
    require the vulnerability
    • Negative impact on the rest of us
    – These vulns are never reported to the vendor.
    – It’s possible others have found the vuln as well.
    

    View Slide

41. What Next?
    • http://www.squarefree.com/burningedge/
    • I am a super awesome bug finder, but I want
    to contribute more.
    – That vuln you found? Maybe try your hand at
    making a patch for it.
    – Resources to help with this
    • https://wiki.mozilla.org/Security/Mentorship
    • Irc.mozilla.org #security
    

    View Slide

42. Conclusion
    

    View Slide

43. Conclusion
    Bounty Program works great for Mozilla.
    Recommend exploring how this may work for you.
    Leverage lessons learned and evaluate risk/benefit.
    

    View Slide

44. Questions?
    @gh_rooster
    http://blog.mozilla.org/security
    

    View Slide