Showing posts with label Hacking News. Show all posts
Showing posts with label Hacking News. Show all posts
Friday, June 24, 2016
What is Cobalt all about and how does it work
2:35 AM
Application security tailored for you
Cobalt hardens your application security by tailoring a security program to your needs. Here’s how it works.
Cobalt hardens your application security by tailoring a security program to your needs. Here’s how it works.
Set the Scope
Talk to our experienced security team about your concerns. We'll review your security needs, discuss budget and requirements, show you through a demo, and tailor a security testing program specifically for you and your software development lifecycle.
Talk to our experienced security team about your concerns. We'll review your security needs, discuss budget and requirements, show you through a demo, and tailor a security testing program specifically for you and your software development lifecycle.
Start a Program
Typically we would begin with a Private Pen Test setup with a small team of hand-picked security researchers (one of whom will be a certified CISSP or equivalent) doing timeboxed, focused penetration testing and vulnerability assessments.
Following this, we usually recommend a Private Curated Bug Bounty open to our vetted Core Security researchers to apply a wider and shallower filter.
Typically we would begin with a Private Pen Test setup with a small team of hand-picked security researchers (one of whom will be a certified CISSP or equivalent) doing timeboxed, focused penetration testing and vulnerability assessments.
Following this, we usually recommend a Private Curated Bug Bounty open to our vetted Core Security researchers to apply a wider and shallower filter.
Patch Vulnerabilities
When a program is launched you will receive vulnerability reports on Cobalt Central, your own application security inbox. Assign reports to your team members via your preferred workflow, such as Jira or Github. Clear up questions quickly by asking researchers directly on Cobalt Central, and ensure that your security is hardened as efficiently as possible.
When a program is launched you will receive vulnerability reports on Cobalt Central, your own application security inbox. Assign reports to your team members via your preferred workflow, such as Jira or Github. Clear up questions quickly by asking researchers directly on Cobalt Central, and ensure that your security is hardened as efficiently as possible.
What is BugCrowd all about and how does it work
2:31 AM
From the outback to the valley, Bugcrowd is paving the way for crowdsourced security. Founded in 2012 in Australia by Casey Ellis, Bugcrowd is now based in San Francisco and is backed by Costanoa Venture Capital, Rally Ventures, Paladin Capital Group and Blackbird Ventures.
Set Your Scope
Tell the crowd what applications you need tested, how long you want to test, and what targets are in scope. Fill your bounty brief out with all the details.
Engage the Crowd
Bugcrowd attracts all the right talent from around the world to your program. Run an ongoing bounty program for continuous testing or a time-boxed flex program as a pen test replacement. We recommend both!
Find & Fix Bugs
Vulnerabilities start coming in! As the leaders in the next big wave of crowdsourcing, Bugcrowd manages your programs for you and makes them successful.
Reward Results
Pay for results, not effort! Bugcrowd provides market rate suggestions on how much to reward researchers so they stay motivated to find more bugs. Best of all, Bugcrowd manages all reward payouts for you!
What is HackerOne all about and how does it work
2:27 AM
Suppose a Hacker discovers a security vulnerability in [Company] (or any Developer). Would they call customer support? Would they hope to walk into [Company] offices? Why should [Company] trust that it's worth their time to investigate? On the other hand, how would our hacker trust [Company] in this situation? What could [Company] do here to intimidate the researcher? What if [Company] doesn't respond at all?
HackerOne focuses on solving the problems with vulnerability disclosure in its various forms. This practice describes the problems involved with the passage of vulnerabilities from their finders (Researchers / Hackers) to their owners (Developers / Response Teams).
Here's an example of how broken disclosure opportunities can make things complicated:
Whistle-Blower Faces FBI Probe
http://archive.wired.com/
MIT Students Get Top Marks for Hacking Boston Subway
http://www.wired.com/2008
The interesting thing is that both the Hacker and Developer value a peaceful and productive interaction here. The Hacker and Developer can both benefit greatly provided the conversation has a bit of structure, pre-set expectations, and precedence with other research interactions to set norms across the board. Bounties help a lot too.
How it works: Hackers sign up to find bugs in various technologies whose owners have expressed an interest in collaborating towards stronger security. To get a glimpse of it in action, check out an actual vulnerability coordinated between a hacker and Twitter:
Subdomain Takeover on media.vine.co
https://hackerone.com/rep
TL;DR - HackerOne offers a platform that promotes a positive disclosure experience in pursuit of its mission of securing all the things, with Hackers and Companies working together for the benefit of all.
HackerOne focuses on solving the problems with vulnerability disclosure in its various forms. This practice describes the problems involved with the passage of vulnerabilities from their finders (Researchers / Hackers) to their owners (Developers / Response Teams).
Here's an example of how broken disclosure opportunities can make things complicated:
Whistle-Blower Faces FBI Probe
http://archive.wired.com/
MIT Students Get Top Marks for Hacking Boston Subway
http://www.wired.com/2008
The interesting thing is that both the Hacker and Developer value a peaceful and productive interaction here. The Hacker and Developer can both benefit greatly provided the conversation has a bit of structure, pre-set expectations, and precedence with other research interactions to set norms across the board. Bounties help a lot too.
How it works: Hackers sign up to find bugs in various technologies whose owners have expressed an interest in collaborating towards stronger security. To get a glimpse of it in action, check out an actual vulnerability coordinated between a hacker and Twitter:
Subdomain Takeover on media.vine.co
https://hackerone.com/rep
TL;DR - HackerOne offers a platform that promotes a positive disclosure experience in pursuit of its mission of securing all the things, with Hackers and Companies working together for the benefit of all.
How to Become a Successful Bug Bounty Hunter
2:21 AM
If you ever dreamed of becoming a bounty hunter, your dreams can come true -- without changing your name to “Dog” or facing Han Solo in a Mos Eisley cantina. That’s by becoming a bug bounty hunter: A hacker who is paid to find vulnerabilities in software and websites.
Anyone with computer skills and a high degree of curiosity can become a successful finder of vulnerabilities. You can be young or old when you start. The main requirement is that you need to keep learning continuously. Also, it's more fun to learn if you have a buddy to share ideas with. Here is how I became a security hacker.
Submit valuable and easy-to-understand bugs
Quality over quantity. A remote code execution on a production system is a lot more valuable than a self-XSS, even though they're both security issues. Enjoy the thrill of the hunt for a super severe bug. Also, successful hackers spend a lot of time describing the issue as clearly as possible. Get to the point and don't introduce unnecessary (reading) overhead for the company (extra verbiage also reduces responsiveness of the company you’re submitting the report to). Finally, successful hunters read the program policy before they start looking for vulnerabilities.
Earn and show respect
Gain respect by submitting valuable bugs. Respect the company’s decision on the bounty amount. If you disagree with the amount they decided to award, have a reasonable discussion about why you believe it deserves a higher reward. Avoid situations where you ask for another reward without elaborating why you believe you deserve more. In return, a company should respect your time and value. They do this by awarding bounties, being responsive and transparent, engaging you in the discussion for the fix, and asking you to test the deployed fix. Being communicative and reasonable pays off: Successful bug bounty hunters receive tons of job offers.
Do your homework
If you’re not comfortable with the basics, get more comfortable. I found it really helpful to have a good understanding of protocols like IP, TCP, and HTTP and to take a few (web) programming courses.
Most of the bug bounty programs are focussed on web applications. To become a successful bug bounty hunter on the web, I'd suggest you check out the following resources:
Most of the bug bounty programs are focussed on web applications. To become a successful bug bounty hunter on the web, I'd suggest you check out the following resources:
- Read The Web Application Hacker's Handbook;
- Take a look at the publicly disclosed bugs on HackerOne;
- Check out the Google Bughunter University.
Paired Practice
If you’re lucky enough to have a hacker buddy, try what worked amazingly well for me. My friend and I would write small, vulnerable programs and challenge each other to find the hidden vulnerabilities. Find someone who challenges you and use what you learned from their challenges to find awesome bugs on real targets in the wild.
Bug hunting is one of the most sought-after skills in all of software. It’s not easy, but it is incredibly rewarding when done right. Like writing code, keep in mind that it takes persistence, a lot of feedback, and determination to become a successful bug bounty hunter. Think outside the box and do your utter best.
Subscribe to:
Posts (Atom)
