2

A bounty hunter reached out to us to give us information about a security vulnerability in our company's information systems. In our estimation, the risk of exploitation for this vulnerability is rather small, but nevertheless, we appreciate the information and want to handle this situation in the best way. The tester wants to stay anonymous but asked (multiple times) for a bounty. I asked him for a call but he ignored that.

We are a pretty young team, we don't have a bug bounty programme, and none of us have experienced such a situation up to now.

Have any of you had similar experiences and if yes, how did you handle it? Is it best practice for bounty hunters to stay anonymous? Is there any good information online on how to estimate a good bounty?

I tried to ask him for a call to discuss the vulnerability and talk about the bounty but he ignored that


I just found a blog article on the concept of so-called “Beg Bounty” Extortion Attempts. Seems like this is exactly what happened here, since the issues the anonymous bug hunter mentioned are listed in this article: https://www.infosecurity-magazine.com/news/experts-warn-of-beg-bounty/

2
  • 1
    Since it might be a "Beg Bounty" situation, this related question is relevant: security.stackexchange.com/questions/229469/…
    – schroeder
    Mar 23 at 15:40
  • Note that the article you linked to doesn't call begging extortion, though it mentions "borderline extortion" and points out that it can lead to extortion. Extortion generally requires some kind of threat (violence, damage, etc.) and this message just says "I know something you don't, and will share it for a price." Whatever you decide do, I'd be careful about accusing someone else of a crime! One of the comments in @schroeder 's linked question suggests replying with "send me the info and I won't call the cops" - demanding something under threat of retaliation may make YOU the extortionist!
    – A C
    Mar 23 at 23:24

2 Answers 2

5

The hunter ended up testing your system without your permission. In some places, this is illegal, and some hunters have been arrested. So, if you don't have a bug bounty programme that protects hunters, then, yes, they would want to remain anonymous.

You are not bound to provide a bounty. And there is no standard for what a bounty should be. So, offer out of kindness, but if they start acting entitled and aggressive, then consider protecting your company in case they decide to retaliate.

Bounty requests can very quickly turn into Extortion demands.

3
  • Thank you very much for your answer! We don't have a bounty hunter program yet but are thinking about setting one up later in the year if things go well. But since the bounty hunter (most certainly) is working out of another continent it may be hard for us with our restricted resources to really estimate the legal dimension of this.
    – SirDeg
    Mar 23 at 14:38
  • We thought about offering him a small bounty to honor his efforts but at the same time make it clear that this is a one-time action as long as we don't have a bounty program set up. We even have thought about putting a statement on our website that at the moment we don't offer any bounties for the moment, so if such a situation happens again we can just refer to the statement.
    – SirDeg
    Mar 23 at 14:38
  • 2
    Post an email address to send bugs to, have a small statement that you don't have a bug bounty programme but appreciate any "responsible disclosure", and have an auto-reply on that inbox explaining the policy and what you might do next.
    – schroeder
    Mar 23 at 15:03
-1

I'm also dealing with my first one right now. Mine isn't anonymous and is following responsible disclosure - telling us first and giving us a chance to fix it before shouting it to the world / selling the specific info on bad-place forums.

We also don't have an official bounty program but I'm more than happy to make a one-off payment. The report contained some things that are trivial and we aren't going to fix, and some that are more interesting that we will. The way I see it I'd rather know about this stuff than not, because the bad actors are certainly running the same sort of scans on my systems and aren't going to be inclined to tell me about it.

I see the word 'extortion' being thrown about here and to me, the difference is whether they disclose the actual vulnerability found to you or not. There's a lot of difference between;

Hi there, I found XX and YY on your systems. Here's a report about what I found. It would be great if you could pay a bounty on what I found.

and

I found a vulnerability in your system, but will only tell you what it is if you pay me.

One of those I will engage with, one I will ignore or call the police. From the sounds of your question you are dealing with the first and they have told you what they have found. The anonymous bit is probably just covering their arse in case they did do something ... less than legal in order to find the vuln.

My advice would be to engage, fix the bug then have a conversation with your management about how much to pay.

About paying - I would recommend you require the finder to submit an invoice and you pay it in the normal way your company does - probably by bank transfer. That way you have the correct records for your finance department and it does not look like there's anything shady going on. I would strongly recommend you don't pay by untraceable money - crypto currency or cash services like Western Union. Those systems are used a lot by money launderers.

This does mean that the finder will need to de-anonymise themselves at this point, but it is better for your financial records to be correct. You should probably offer assurances that whatever it was they did to find the vuln will be ignored, but you need to pay them above the table.

Is there any good information online on how to estimate a good bounty?

A cursory Google search for estimating bug bounty payout brought up several different sites and calculators for me, all pretty much leading to the same conclusions. You should probably read them before the chat with management about the amount.

There is also this question; while being closed as off-topic, the accepted answer seems to summarise all the other sites I found fairly well and I consider it a good introduction to the subject.

3
  • Why pay by bank transfer? Why is paying by legitimate methods that others have used tangentially in the furtherance of a crime a problem? Why is it better for one's "financial records"? That whole section seems strange, based on your personal preferences, and without explanation.
    – schroeder
    Mar 24 at 8:03
  • 1
    Because a line item of '€1,000, some guy, no paperwork, by anonymous payment method' looks highly dodgy in your corporate accounts. My personal preference? Go ask your corporate account for their opinion too.
    – Skrrp
    Mar 24 at 9:51
  • Then, yes, you are trying to give financial accounting advice without understanding accounting. I'd just remove that section.
    – schroeder
    Mar 24 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .