In a weblog publish on November 30, Coinbase sought to make clear its bug bounty program insurance policies in response to the current Uber information breach verdict.
The corporate acknowledged that it nonetheless welcomes “accountable” disclosure of safety points, however customers who abuse this course of is not going to be awarded bug bounties:
“The important thing phrase in all of that is ‘accountable’. Within the wake of the current Uber verdict, there may be loads of concern within the business about bug bounty submissions changing into extortion makes an attempt. At Coinbase, […] we’ve put loads of thought into how we function our bug bounty program to remain on the precise facet of the legislation.”
The decision Coinbase was referring to was issued on October 5. Joe Sullivan, former Uber safety chief, was discovered responsible of colluding with attackers to cowl up proof of a knowledge breach, based on a report by the Washington Submit. Sullivan had initially claimed that the attackers had submitted the breach as a bug bounty and that the corporate had paid them as a bug bounty reward.
Tech firms typically use bug bounties to encourage white hat hackers to search out safety vulnerabilities and report them. However the Sullivan verdict has raised the query of how far a bug bounty program can go in awarding prizes to hackers with out operating afoul of the legislation itself.
In its publish, Coinbase acknowledged that it has encountered some bug bounty contributors who declare to have dedicated legal actions that might forestall the corporate from with the ability to legally make a payout.
For instance, a participant submitted a number of emails to the workforce saying that that they had “306 million customers information totally dehashed” and a “bypass” to skip the 48 hour ready interval on new gadgets. In line with Coinbase, if this individual had such data, it might imply that they accessed buyer information past what may very well be thought-about “good religion” or “unintended.” In such a case, Coinbase wouldn’t be capable to pay the bounty.
On this specific case, Coinbase stated they believed that the participant was making a false declare. The participant didn’t present any data that might enable the declare to be verified, so the workforce ignored the request for a bounty. However even when the individual making the declare had been telling the reality, it might have been unlawful to pay out the reward to them.
Coinbase additionally emphasised that threats or different extortion makes an attempt is not going to lead to a bug bounty payout:
“Most necessary of all — a bug bounty submission can by no means comprise threats or any makes an attempt at extortion. We’re all the time open to paying bounties for respectable findings. Ransom calls for are a completely totally different matter.”
The observe of paying bug bounties is typically controversial. Critics say that it could possibly encourage malicious habits, whereas supporters say it typically permits vulnerabilities to be found safely. On Oct. 19, an attacker drained the Moola Market DeFi app of $9 million value of cryptocurrency. However when the developer provided to let the attacker hold $500K as a bug bounty, the attacker returned the opposite $8.5 million.
An identical assault occurred on the decentralized alternate, KyberSwap, in September. On this case, the attackers stole $265K, and the builders provided to allow them to hold 15% of the funds if they’d return the remaining. Suspects within the case had been later recognized, however the funds haven’t been returned, and the hackers seem to nonetheless be at giant.
