Category: Bug Hunters

YesWeHack se dote officiellement d’un bureau à Lausanne, Suisse

Fort d’une reconnaissance déjà acquise dans de nombreux pays, YesWeHack aspire à convaincre les organisations suisses préoccupées par le renforcement constant de leur sécurité et la recherche de services innovants.

Dans ce contexte, YesWeHack est fier d’annoncer l’ouverture d’un bureau à Lausanne.

A travers cette présence locale, YesWeHack servira au mieux les organisations publiques et privées helvétiques, en mettant à leur disposition sa plateforme de Bug Bounty (la première en Europe), Bounty Factory.

A la lumière des derniers incidents ayant affecté les services de santé de Singapour et le site internet de British Airways, il en résulte que des millions de données personnelles ont été divulguées, les entreprises et organisations suisses doivent être plus mobilisées que jamais pour sécuriser leurs systèmes. YesWeHack, à travers sa plateforme de Bug Bounty,  apporte une solution innovante, simple et efficace, destinée à devenir incontournable dans l’arsenal défensif des entreprises et des administrations helvétiques.

Guillaume Vassault-houlière, CEO de YesWEHACK

Le Bug Bounty façon YesWeHack

Bounty Factory, la première plateforme européenne de Bug Bounty de YesWeHack met au service des organisations désireuses d’améliorer leur sécurité, une communauté de plus de 5400 chercheurs en cybersécurité.

Un programme de Bug Bounty maximise votre retour sur investissement en rémunérant les chercheurs au résultat. Il complète idéalement les audits de sécurité traditionnels, ces derniers étant, par essence, limités dans le temps, et sans garantie ni obligations de résultats.

Read More

#NDH16 : Knowledge is power

In 2018, for the first time, La Nuit du Hack takes place at La Cité des Sciences et de l’Industrie  in Paris.

YesWeHack is proud to be one of the numerous Platinum Sponsors of #NDH16 ! We are longing for having Fun and meeting you Folks in this temple of science.

Photo by HackerzVoice

Photo by HZV

Science

In this age of panic where the powers in place are trying to mitigate “fake news” (well… let’s say more precisely propaganda or misinformation), La Cité des Sciences et de l’Industrie symbolizes knowledge in many ways, Science is one the best allies to counterattack lies and conspiracy theories.

As a famous place in Paris, La Cité des Sciences et de l’Industrie provides through three levels : a 900 seat amphitheater, 2000m2 of exhibition area and one space called the « Loft » with its 1000m2 fully dedicated to hacktivities and games orchestrated by the HZV’s Team <3

Gravity, Density & Fun

So for this edition, La Nuit du Hack is going to deliver its thoroughness and richness with : 14 talks, 10 workshops, 6 Challenges, 1 Private CTF, On Site Bug Bounties and a Confessional .

Read More

OVH Bug Bounty RetEx by Vincent Malguy

As OVH bug bounty manager from March 2016 to March 2018, Vincent Malguy, through this interview, delivers his return of experience to share some tips with people who wonder how to set up and manage a program.

***

The genesis

In the early 2010’s, many companies in the IT sector like Facebook or Google started to launch bug bounty programs and within OVH this appeared as an obvious need. However, it took time to frame the project and to meet all the operational conditions to take the leap.

In 2015, when I was recruited by OVH, it was time to put in place all the bricks to calmly launch a bug bounty.

Back in the day, we identified two issues: the issue of vulnerability export and the legal complexity when paying rewards.

Of course, we evaluated the possibility of launching it without external help but we quickly gave up the idea because it is not our core business.

In any case since the beginning, it has been clear in our minds that a real bug bounty program is, in the long run, a program open to a wide audience.

In January 2016, we met with Korben and Freeman. They presented YesWeWack’s roadmap to launch the first European bug bounty platform.

The timing was perfect and we decided together to launch OVH’s public program on the occasion of “la Nuit du Hack” in June 2016.

Private phase

In this exercise we have the support of the management and technical teams.

Based on that internal mobilization, we started to carry out an additional audit on the initial scope in order to ensure its maturity. We then worked with the communications, legal and accounting teams. Once these prerequisites were gathered and validated, with YesWeHack, we started with a 1 month private window.

Read More

Bug Bounty: Take the leap – [ITW] Alain Tiemblo @BlaBlaCar

Alain Tiemblo – BlaBlaCar Web Security Lead Engineer

Since September 2017, BlaBlaCar has been managing with a select number of security experts a private Bug Bounty program to enhance the operational security of its platform.

Previously accessible only by invitation via BountyFactory.io, YesWeHack’s bug bounty platform, this program has enabled BlaBlaCar to remain proactive on the cyber security of its services.

Thursday April 19, BlaBlaCar’s program is public

What is your role at BlaBlaCar?

I am a backend developer profile, today overseeing application security. When I joined BlaBlaCar, I was in charge of the platform’s performance and security. In mid-2015 and early 2016, our operational security needed to level up significantly, especially following our major fund-raising campaigns, which put BlaBlaCar under the light and pressure. So at that period of time, i took the lead of a small team to mitigate these attacks, and audit/consolidate the platform.

What is your approach to security, including coordinated vulnerability disclosure?

We have kept application security in-house for a long time. Previously, we used classical audits conducted by various companies, by several basic pentest applications, by using static analysis tools, etc. I think it helped to rough out a lot of little things that would have been detected by bug hunters.

In addition, we received a few troll messages on Twitter reporting vulnerabilities without notice and without any details… We also have some emails via customer support about potential security holes, but nothing was disclosed by these contacts, they first wanted to be paid and this, without proof of the existence of a security flaw, so it was impossible for us to enter the game.

Read More

Bug Bounty : Franchir le pas – ITW d’Alain Tiemblo @ BlaBlaCar

Alain Tiemblo - Bug Bounty - Vulnerability Coordination

Depuis septembre 2017, BlaBlaCar propose à un nombre d’experts en sécurité triés sur le volet, un
programme de Bug Bounty privé afin de renforcer la sécurité opérationnelle de sa plateforme. Accessible
jusqu’alors uniquement sur invitation via BountyFactory.io, la plateforme de bug bounty de YesWeHack, ce programme a permis à BlaBlaCar de rester proactif sur la cybersécurité de ses services.

Entretien avec Alain Tiemblo Web Security Lead Engineer – @BlaBlaCar – manager du programme de Bug Bounty.

Jeudi 19 avril le programme de BlaBlaCar est public

Quel est votre rôle au sein de BlaBlaCar ?

Je suis un profil développeur backend, aujourd’hui chapeautant la sécurité applicative. Lorsque je suis arrivé à BlaBlaCar, je m’occupais de la performance et la sécurité de la plateforme. Mi 2015 début 2016, nos besoins en sécurité opérationnelle ont augmenté de manière significative notamment à la suite de nos grosses levées de fonds qui ont suscité quelques convoitises. J’ai alors pris le lead d’une petite équipe afin de mitiger ces attaques, et auditer / consolider la plateforme.

Quelle est votre démarche en termes de sécurité et notamment de divulgation coordonnée de vulnérabilités?

Nous avons pendant longtemps gardé la sécurité applicative en interne. Auparavant, nous faisions appel à des audits classiques menés par diverses entreprises, par plusieurs applications de pentest, en utilisant des outils d’analyses statiques, etc. Je pense que ça a permis de dégrossir beaucoup de petites choses qui auraient été détectées par des chasseurs de failles.

Par ailleurs, on a reçu quelques messages de trolls sur Twitter signalant des failles sans préavis et sans aucun détails…

Read More

SaXX, number one of Bounty Factory’s all time ranking.

This month, we publish an interview with one of the best researchers of our  Bounty Factory called SaXX who is only 27 years old.

In the all time ranking, SaXX culminates in the first place and he intends to defend his ranking well. Like Rafael Nadal, SaXX never gives up and works hard to exercise his passion with his true mischievous side!

1. Where did you get your nickname?

Well, that’s a question a lot of people ask.
I only tell the genesis of this nickname in certain circles.

2. What’s your background?

I have a career path that some would describe as classic. I had a BAC S (maths specialization) then a BTS IG at that period of time. After the BTS, I didn’t really know what to do so I let myself be tempted by an Information Systems Management school in Lorient – France.

Read More

Portrait of a bug hunter : Ylujion

ylujionYesWeHack is glad to introduce you to its best hunters performing on BountyFactory.io

This week, it’s @Ylujion‘s turn, Check his portrait below !

Read More

Goals and means of a bug bounty hunter.

These days, Bug bounty Hunters are trending within the IT security ecosystem, but very few articles deal with the DNA of a Bug Bounty Hunter.

At Bountyfactory.io, we consider Bug Hunters have to respect and fit legal frameworks and norms.

AS a bug hunter please find below the goals you should be driven by :

Read More

Page 2 of 2

Powered by WordPress & Theme by Anders Norén