That’s a question that sometimes comes in mind of many “hunters”.
Personally in most cases, when I participate on these programs, I use fake information – one of the first reasons is to immediately test the input fields 🙂
Programs that required you to add your credit card info, phone number, bank info, … in most cases I try to slow down my research a bit. [As alternative sometimes I use one-time only credit cards but in other cases you need to provide other information to test further – eg: upload funds using your bank account. Also it’s a positive thing to have a phone number just to test bug appreciation programs. I already smsbomb myself using a vulnerability #shameonme]
I’m not paranoid but in my opinion it would me interesting if the program itself provides the security researcher with a payment sandbox. Some of them already do this.
Programs that want you to test their payment gateways, membership upgrades, etc… could create some private layer to help researchers. This is a win-win situation, where both parties have interest in giving their best.
Just to give you a background on this topic, a couple of weeks ago I had access to bank information using a SQL Injection vulnerability present on a bounty program. The data was in plaintext. Some of the info was from security researchers that were also testing their security.
I asked a couple of other researchers and some of them told me that they used fake payment data – that works if you are not buying or testing payments.
But I wanted more feedback… So I give it a try on the voting quiz available on Twitter and shared with my followers:
Do you use your personal information when bug hunting (name, phone, address, payment information, …)?
Yes – 26%
No – 39%
Not all the info – 35%Total votes: 23 (duration: 24 hours)
Not many votes (timezone is a b****) but we can get a small idea on what bug hunters are doing.
74% of them don’t use their real information or just provide part of their personal data.
Bugcrowd told me that they provide test credentials wherever possible. They believe that providing that information to bug hunters participants is ideal, but that requires support on the backend side. Bugcrowd CEO – Casey Ellis – also told me that they advise programs [private or dojo] to create test accounts. If it’s a public program they advise them only if there’s a txn failsafe on the processing side because public may start using them for regular transactions.
Working with Cobalt I also had the opportunity to work with test accounts in their private programs.
On HackerOne I never come across test accounts, even with private programs. It would be cool if they comment this article about this.
Also I already come across of some bug appreciation programs that provided credit card details [bypassing the payment checks] to give the opportunity to researchers test live transactions.
I hope that with this article I help bug appreciation programs participants to protect themselves but at the same time providing the program a good service.
What you guys think about this?