8

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to participate?

How shall the challenge be designed (except for a webpage that explains the why and how)?

There is a very limited budget (~1000 $) and we could do T-shirts & some swag, but there is no room to pay for bounties.

Edit1: What we want/need is the feedback from everyone who found a flaw, not just people hammering their tools onto the webapps.

11
  • 8
    Build it and they will come.
    – user10211
    Aug 23, 2013 at 5:35
  • 3
    Make a CTF out of it. A lot of hackers will do it for the 'glory'. Hell, we (Sec.SE CTF Team) would give it a crack i reckon :P
    – NULLZ
    Aug 23, 2013 at 6:09
  • 5
    Just go to some hacking forum (better, reddit) and brag about how you hired the top security guys in the world to make your system the highest security system ever built. Make sure to write a blog post somewhere about it and use it as a reference.
    – Adi
    Aug 23, 2013 at 8:28
  • 1
    @Adnan: looks like a nice suggestion for honeypots Aug 23, 2013 at 8:30
  • 1
    @olivier: first whitehats and later on blackhats as well. some people can be very creative when trying to break stuff. Aug 29, 2013 at 0:04

2 Answers 2

8

There's several ways to go about this:

First, monetary rewards are a great incentive, but if you can't afford them you'll need to provide them with other types of rewards. I think creating a special page on your site/application and creating a 'hall of fame' list of people that have found vulnerabilities.

I'd also recommend that you consider running a CTF competition and include sections of your application's functionality in the CTF (or just make the CTF about who can find the most holes in your actual application). When you have a list of winners, post them publicly and keep them up so that people can reference it later.

If you decide to do either of the above, make sure you publicize it and detail your intentions/desired outcome, as Evan suggests, posting it to a security mailing list might help attract attention.

But as Terry says, if you build it, eventually someone will come and try to break it anyway regardless!

1
2

Bruce Schneier once said about having citizens report suspicious activities: "if you rely on amateur investigators, don't be surprised when you get amateur security." So either security is important on your project, or it's not.

There are a few things you can do to at least seek professional help. Use professional static code analysis tools to go over your codebase. Coverity offers free scanning of open source projects, so use them. Find a local chapter of OWASP and see if they have any members willing to donate time. Check with a college or school that your project team might have an affiliation with, as they may have a security class interested in the challenge.

A public challenge without incentives isn't going to yield a realistic level of confidence in the security of your project. If your project is valuable, you owe it to your future customers to take it seriously now.

4
  • yeah, i know about "your get what you pay for" :) interesting suggestions, and we already had our OWASP-experience, but thats another story. coverity is a interesting suggestions, will check it out. Aug 26, 2013 at 7:20
  • 1
    But at the same time, tempting crackers to hack into his/her website/app is a quick way to find out if there are some easy (or not so easy) break-ins... It could hide other (more sophisticated or not) bugs, but still give valuable information. Pros won't try everything but just things and techniques they personnally know about, whereas on the net, in the same way as "given enough eyeballs, all bugs are shallow", we could say that "given enough attraction, all websites/apps are vulnerable" Aug 26, 2013 at 13:11
  • @OlivierDulac, that hasn't been proven to be a reliable enough security strategy for new projects. It works for big old projects, but not new projects. If he finds them, a thousand script kiddies might all try the same SQL injection attack, or URL buffer overflow attack, but nobody might work hard enough to build a CRSF attack, for example. If he wants to crowd source it, he needs to track the attempts to see if they're hitting the top 10 or top 25 security weaknesses. It would still be best to have a professional assessment. Aug 26, 2013 at 14:32
  • @JohnDeters: I am not recommending one over the other, but to use and try both (ie, not to ignore potential discoveries and other valuable information that could be gained by making his public attempt). Can't really replace one with the other (pros can't know what some crackers may attempt to do, and like you said, most attemtps will be poor compared to pro coverage. Plus pros will provide assesments and other valuable infos.) Aug 26, 2013 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .