Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to participate?

How shall the challenge be designed (except for a webpage that explains the why and how)?

There is a very limited budget (~1000 $) and we could do T-shirts & some swag, but there is no room to pay for bounties.

Edit1: What we want/need is the feedback from everyone who found a flaw, not just people hammering their tools onto the webapps.

share|improve this question
7  
Build it and they will come. –  Terry Chia Aug 23 '13 at 5:35
3  
Make a CTF out of it. A lot of hackers will do it for the 'glory'. Hell, we (Sec.SE CTF Team) would give it a crack i reckon :P –  NULLZ Aug 23 '13 at 6:09
3  
Just go to some hacking forum (better, reddit) and brag about how you hired the top security guys in the world to make your system the highest security system ever built. Make sure to write a blog post somewhere about it and use it as a reference. –  Adnan Aug 23 '13 at 8:28
1  
@Adnan: looks like a nice suggestion for honeypots –  that guy from over there Aug 23 '13 at 8:30
1  
@olivier: first whitehats and later on blackhats as well. some people can be very creative when trying to break stuff. –  that guy from over there Aug 29 '13 at 0:04
show 6 more comments

2 Answers

There's several ways to go about this:

First, monetary rewards are a great incentive, but if you can't afford them you'll need to provide them with other types of rewards. I think creating a special page on your site/application and creating a 'hall of fame' list of people that have found vulnerabilities.

I'd also recommend that you consider running a CTF competition and include sections of your application's functionality in the CTF (or just make the CTF about who can find the most holes in your actual application). When you have a list of winners, post them publicly and keep them up so that people can reference it later.

If you decide to do either of the above, make sure you publicize it and detail your intentions/desired outcome, as Evan suggests, posting it to a security mailing list might help attract attention.

But as Terry says, if you build it, eventually someone will come and try to break it anyway regardless!

share|improve this answer
1  
will keep this in mind –  that guy from over there Aug 23 '13 at 8:33
add comment

Bruce Schneier once said about having citizens report suspicious activities: "if you rely on amateur investigators, don't be surprised when you get amateur security." So either security is important on your project, or it's not.

There are a few things you can do to at least seek professional help. Use professional static code analysis tools to go over your codebase. Coverity offers free scanning of open source projects, so use them. Find a local chapter of OWASP and see if they have any members willing to donate time. Check with a college or school that your project team might have an affiliation with, as they may have a security class interested in the challenge.

A public challenge without incentives isn't going to yield a realistic level of confidence in the security of your project. If your project is valuable, you owe it to your future customers to take it seriously now.

share|improve this answer
    
yeah, i know about "your get what you pay for" :) interesting suggestions, and we already had our OWASP-experience, but thats another story. coverity is a interesting suggestions, will check it out. –  that guy from over there Aug 26 '13 at 7:20
1  
But at the same time, tempting crackers to hack into his/her website/app is a quick way to find out if there are some easy (or not so easy) break-ins... It could hide other (more sophisticated or not) bugs, but still give valuable information. Pros won't try everything but just things and techniques they personnally know about, whereas on the net, in the same way as "given enough eyeballs, all bugs are shallow", we could say that "given enough attraction, all websites/apps are vulnerable" –  Olivier Dulac Aug 26 '13 at 13:11
    
@OlivierDulac, that hasn't been proven to be a reliable enough security strategy for new projects. It works for big old projects, but not new projects. If he finds them, a thousand script kiddies might all try the same SQL injection attack, or URL buffer overflow attack, but nobody might work hard enough to build a CRSF attack, for example. If he wants to crowd source it, he needs to track the attempts to see if they're hitting the top 10 or top 25 security weaknesses. It would still be best to have a professional assessment. –  John Deters Aug 26 '13 at 14:32
    
@JohnDeters: I am not recommending one over the other, but to use and try both (ie, not to ignore potential discoveries and other valuable information that could be gained by making his public attempt). Can't really replace one with the other (pros can't know what some crackers may attempt to do, and like you said, most attemtps will be poor compared to pro coverage. Plus pros will provide assesments and other valuable infos.) –  Olivier Dulac Aug 26 '13 at 15:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.