Category: Vulnerability Coordination (Page 1 of 2)

YesWeHack rejoint le Pôle d’Excellence Cyber !

By

On July 3, 2018

In Bug Bounty, Disclosure, Europe, GDPR, IoT, Security by design, Vulnerability Coordination

C’est avec une fierté non dissimulée que YesWeHack annonce son intégration au Pôle d’Excellence Cyber.

Nous avons été cooptés et nous allons honorer cette confiance au sein du PEC pour contribuer au rayonnnement de savoir-faire français et Européen en termes de CyberSécurité.

YesWeHack va notamment apporter son expertise sur deux disciplines à savoir : le recrutement des talents spécialisés en cybersécurité et la divulgation coordonnée de vulnérabilités.

Déjà presents au coeur de l’écosystème breton avec une base à Rennes, YesWeHack continue de tisser des liens et de coopérer avec tous les acteurs de la région.

#NDH16 : Knowledge is power

By

On June 27, 2018

In Bug Bounty, Bug Hunters, Europe, Vulnerability Coordination

In 2018, for the first time, La Nuit du Hack takes place at La Cité des Sciences et de l’Industrie  in Paris.

YesWeHack is proud to be one of the numerous Platinum Sponsors of #NDH16 ! We are longing for having Fun and meeting you Folks in this temple of science.

Photo by HackerzVoice

Photo by HZV

Science

In this age of panic where the powers in place are trying to mitigate “fake news” (well… let’s say more precisely propaganda or misinformation), La Cité des Sciences et de l’Industrie symbolizes knowledge in many ways, Science is one the best allies to counterattack lies and conspiracy theories.

As a famous place in Paris, La Cité des Sciences et de l’Industrie provides through three levels : a 900 seat amphitheater, 2000m2 of exhibition area and one space called the « Loft » with its 1000m2 fully dedicated to hacktivities and games orchestrated by the HZV’s Team <3

Gravity, Density & Fun

So for this edition, La Nuit du Hack is going to deliver its thoroughness and richness with : 14 talks, 10 workshops, 6 Challenges, 1 Private CTF, On Site Bug Bounties and a Confessional .

Read More

OVH Bug Bounty RetEx by Vincent Malguy

By

On June 18, 2018

In Bug Bounty, Bug Hunters, Disclosure, opensource, Security by design, Vulnerability Coordination

As OVH bug bounty manager from March 2016 to March 2018, Vincent Malguy, through this interview, delivers his return of experience to share some tips with people who wonder how to set up and manage a program.

***

The genesis

In the early 2010’s, many companies in the IT sector like Facebook or Google started to launch bug bounty programs and within OVH this appeared as an obvious need. However, it took time to frame the project and to meet all the operational conditions to take the leap.

In 2015, when I was recruited by OVH, it was time to put in place all the bricks to calmly launch a bug bounty.

Back in the day, we identified two issues: the issue of vulnerability export and the legal complexity when paying rewards.

Of course, we evaluated the possibility of launching it without external help but we quickly gave up the idea because it is not our core business.

In any case since the beginning, it has been clear in our minds that a real bug bounty program is, in the long run, a program open to a wide audience.

In January 2016, we met with Korben and Freeman. They presented YesWeWack’s roadmap to launch the first European bug bounty platform.

The timing was perfect and we decided together to launch OVH’s public program on the occasion of “la Nuit du Hack” in June 2016.

Private phase

In this exercise we have the support of the management and technical teams.

Based on that internal mobilization, we started to carry out an additional audit on the initial scope in order to ensure its maturity. We then worked with the communications, legal and accounting teams. Once these prerequisites were gathered and validated, with YesWeHack, we started with a 1 month private window.

Read More

Bug Bounty: Take the leap – [ITW] Alain Tiemblo @BlaBlaCar

By

On April 23, 2018

In Bug Bounty, Disclosure, Europe, GDPR, Security by design, Vulnerability Coordination

Alain Tiemblo – BlaBlaCar Web Security Lead Engineer

Since September 2017, BlaBlaCar has been managing with a select number of security experts a private Bug Bounty program to enhance the operational security of its platform.

Previously accessible only by invitation via BountyFactory.io, YesWeHack’s bug bounty platform, this program has enabled BlaBlaCar to remain proactive on the cyber security of its services.

Thursday April 19, BlaBlaCar’s program is public

What is your role at BlaBlaCar?

I am a backend developer profile, today overseeing application security. When I joined BlaBlaCar, I was in charge of the platform’s performance and security. In mid-2015 and early 2016, our operational security needed to level up significantly, especially following our major fund-raising campaigns, which put BlaBlaCar under the light and pressure. So at that period of time, i took the lead of a small team to mitigate these attacks, and audit/consolidate the platform.

What is your approach to security, including coordinated vulnerability disclosure?

We have kept application security in-house for a long time. Previously, we used classical audits conducted by various companies, by several basic pentest applications, by using static analysis tools, etc. I think it helped to rough out a lot of little things that would have been detected by bug hunters.

In addition, we received a few troll messages on Twitter reporting vulnerabilities without notice and without any details… We also have some emails via customer support about potential security holes, but nothing was disclosed by these contacts, they first wanted to be paid and this, without proof of the existence of a security flaw, so it was impossible for us to enter the game.

Read More

Bug Bounty : Franchir le pas – ITW d’Alain Tiemblo @ BlaBlaCar

By

On April 12, 2018

In Bug Bounty, Disclosure, Privacy by Design, Security by design, Vulnerability Coordination

Alain Tiemblo - Bug Bounty - Vulnerability Coordination

Depuis septembre 2017, BlaBlaCar propose à un nombre d’experts en sécurité triés sur le volet, un
programme de Bug Bounty privé afin de renforcer la sécurité opérationnelle de sa plateforme. Accessible
jusqu’alors uniquement sur invitation via BountyFactory.io, la plateforme de bug bounty de YesWeHack, ce programme a permis à BlaBlaCar de rester proactif sur la cybersécurité de ses services.

Entretien avec Alain Tiemblo Web Security Lead Engineer – @BlaBlaCar – manager du programme de Bug Bounty.

Jeudi 19 avril le programme de BlaBlaCar est public

Quel est votre rôle au sein de BlaBlaCar ?

Je suis un profil développeur backend, aujourd’hui chapeautant la sécurité applicative. Lorsque je suis arrivé à BlaBlaCar, je m’occupais de la performance et la sécurité de la plateforme. Mi 2015 début 2016, nos besoins en sécurité opérationnelle ont augmenté de manière significative notamment à la suite de nos grosses levées de fonds qui ont suscité quelques convoitises. J’ai alors pris le lead d’une petite équipe afin de mitiger ces attaques, et auditer / consolider la plateforme.

Quelle est votre démarche en termes de sécurité et notamment de divulgation coordonnée de vulnérabilités?

Nous avons pendant longtemps gardé la sécurité applicative en interne. Auparavant, nous faisions appel à des audits classiques menés par diverses entreprises, par plusieurs applications de pentest, en utilisant des outils d’analyses statiques, etc. Je pense que ça a permis de dégrossir beaucoup de petites choses qui auraient été détectées par des chasseurs de failles.

Par ailleurs, on a reçu quelques messages de trolls sur Twitter signalant des failles sans préavis et sans aucun détails…

Read More

SaXX, number one of Bounty Factory’s all time ranking.

By

On March 31, 2018

In Bug Bounty, Bug Hunters, Disclosure, Europe, Feature, Vulnerability Coordination

This month, we publish an interview with one of the best researchers of our  Bounty Factory called SaXX who is only 27 years old.

In the all time ranking, SaXX culminates in the first place and he intends to defend his ranking well. Like Rafael Nadal, SaXX never gives up and works hard to exercise his passion with his true mischievous side!

1. Where did you get your nickname?

Well, that’s a question a lot of people ask.
I only tell the genesis of this nickname in certain circles.

2. What’s your background?

I have a career path that some would describe as classic. I had a BAC S (maths specialization) then a BTS IG at that period of time. After the BTS, I didn’t really know what to do so I let myself be tempted by an Information Systems Management school in Lorient – France.

Read More

Cybersecurity & Bug Bounty: Attack is the best form of defence

By

On October 20, 2017

In Bug Bounty, Disclosure, Europe, Privacy by Design, Security by design, Vulnerability Coordination

uillaume Vassault-Houlière President of Yes We HackBy Guillaume Vassault-Houlière | CEO of YesWeHack

Through our European platform BountyFactory.io, Bug Bounty is gaining respectability in France and Europe.

Bug Bounty is an innovative and operational practice from the United States that rewards security experts who find security flaws in IT systems.

Within a complex geopolitical context, Europe and France can compete in defending a European model of digital sovereignty.

In the light of new threats and given reports of organizations that are victims of piracy and irreversible damage, some innovative cyber security policies and approaches need to be adopted.

Cybersecurity is a powerful ally for leading digital transformation.

Read More

Interview of Gilles Cadignan – CEO & Co-Founder of Woleet

By

On March 10, 2017

In Disclosure, Europe, Privacy by Design, Security by design, Vulnerability Coordination

First of all, can you introduce us to Woleet?

Woleet.io was founded in Rennes in 2016. Woleet is a data anchoring platform using the Bitcoin blockchain. To sum up, we provide a SaaS platform that receives digital fingerprints of data and proceeds to anchor them in Bitcoin by linking these fingerprints to a transaction having a certain date. To achieve this, Woleet builds a cryptographic structure that allows multiple fingerprints to be put together in a single transaction.

The use of Woleet has many benefits:

Read More

Edouard Camoin, CISO of Outscale.com, on the bug bounty switching process from private to public status

By

On January 26, 2017

In Bug Bounty, Feature, Vulnerability Coordination

https://twitter.com/skelkey

Edouard Camoin, CISO of Outscale.

– What’s your role as CISO within Outscale?

First of all, Outscale deals with IaaS : like AWS we provide API and we have Branch offices in France, USA and China. Each Branch office is subject to a specific digital sovereignty.

I’ve been wearing two hats : Guarantor of the internal security and guarantor of the security for the customers.
Globally speaking the human resources are at the core of my job.

– What was the need assessment that led to the opening of a bug bounty program?

Read More

Xavier Leune, CCM Benchmark Group, on the benefits of bug bounty

By

On January 10, 2017

In Bug Bounty, Feature, Security by design, Vulnerability Coordination

Xavier Leune - CCM Benchmarck group -

Xavier Leune – CCM Benchmarck group –

What is your role in CCM benchmark ?
I am deputy CTO and i’m in charge of technical monitoring with Damien Mangin, CTO of CCM Benchmark Group.

What were the reflexion and the needs assesment that brought about a bug bounty program ?
Like any other actor on the Internet, we are experiencing increasing threats like hacking tries or malware targeting our platforms. As we are the first French leaders media company (according to Comscore), we are particularly exposed to cyber threats. Therefore, we are meant to have a proactive approach in terms of security in order to protect our users’ data.
The bug bounty Program we opened was a very important step complementary of others methods we set up (pentests, trainings). In terms of security by design, this exercise is really useful for our devs because thanks to the bug reporting they can improve the degree of security of their own code.

Read More

Page 1 of 2

Next →

Events

Categories

Powered by WordPress & Theme by Anders Norén