Web Science Challenges in Researching Bug Bounties

Abstract

The act of searching for security aws (vulnerabilities) in a piece of software was previously considered to be the preserve of malicious actors, or at least actors who wished to cause chaos. Increasingly, however, companies are recognising the value of running a bug bounty program, where they will pay 'white hat' hackers to locate and disclose security aws in their applications in order that they can x it. This is known as a 'bug bounty' or a 'vulnerability reward program', and at present has seen comparatively little research. This paper introduces two existing research on bug bounties in two areas: as a means of regulating the sale of vulnerabilities; and as a form of crowdsourcing. We argue that the nature of bug bounties makes Web science particularly suitable to drive forward research. We identify gaps in the current literature, and propose areas which we consider to be particularly promising for future research. CCS Concepts: • Information systems → Crowdsourcing; • Security and privacy → Social aspects of security and privacy;

An Empirical Study of Bug Bounty Programs

“…An increasingly popular approach to identifying vulnerabilities in software is to offer rewards to security researchers that are external to an organisation ('hackers') to find and disclose vulnerabilities [1]. This approach is now seeing adoption in areas such as e-voting systems, government systems and selfdriving cars [2]- [4].…”

“…The formal exchange of information in this context is typically facilitated by a bug bounty platform. The number of new bug bounty programs available on platforms such as HackerOne 1 has increased year-on-year since 2013 [8], with 50 new organisations launching a program in 2018. This increase is illustrated in Table I. As of January 2019, the top 25 companies using HackerOne have used the platform to obtain reports for over 19,000 vulnerabilities, at an average of 0.71 vulnerabilities reported for each day the program is run -resulting in $11.9 million being paid out to hackers for successfully finding vulnerabilities [8].…”

Proposal of a Novel Bug Bounty Implementation Using Gamification

“…Figure 1 illustrates the most popular variants of the bug bounty process (Fryer and Simperl, 2017). While in process A the external hacker corresponds directly to the vendor, process B introduces an intermediate platform.…”

“…Potentially, this issue is encouraged with admission to private programs. Consequently, these problems can be a significant detriment to the effectiveness of a program, often impeding the verification and triaging processes (Fryer and Simperl, 2017).…”

“…Such events often coincide with scope increases. Providing solely monetary incentivisation during this event can lead to a significant signal-to-noise ratio impacting the effectiveness of this strategy (Fryer and Simperl, 2017). Nevertheless, this strategy could part or whole substitute monetary incentivisation for gamification elements.…”