Bug Bounty

Last time we told you about the format the large global corporations conduct the Bug Bounty vulnerability search program. But how is the sphere of using the services of "white" hackers developed in our country? We invite you to read about the experience of Ukrainian business in this article.

The PrivatBank Experience

In 2012, PrivatBank became the first banking institution in the world, as well as the first Ukrainian company to launch a public Bug Bounty program to search for vulnerabilities in its Internet systems.

Today, every interested IT specialist can take part in the program by registering on a special banks website launched in 2017. It contains the conditions for participation and the rating of "white" hackers.

Some statistics of PrivatBank Bug Bounty:

- 1800 errors were detected in the first 5 years of the program's operation;
- more than UAH 2.7 million of remuneration were paid for these errors;
- UAH 512,000 were paid by PrivatBank only in 2017 (127 participants received awards);
- 120 vulnerabilities were found in 2018;
- 419 vulnerabilities were found in 2019.

Today, for each of the confirmed deficiencies, the bank offers a payment from 50 to 1000 dollars in the hryvnia equivalent.

The Mobile Operator Kyivstar Experience

Kyivstar launched Bug Bounty in 2017 to test its mobile applications and web services. At first, the program was private, and in 3 months of its operation, IT specialists discovered only 20 vulnerabilities.

In March 2018, the operator made the program public by launching a two-week marathon on a special site, thanks to which another 160 bug hunters joined the participation.

Some statistics:

- more than $ 31,000 were paid in the first 2 years of Bug Bounty;
- $ 1,500 was the maximum remuneration for one specialist.

Now Kyivstar invites "white" hackers to participate on its website and offers a reward of $ 3,000 for found errors.

The Grammarly IT company Experience

Grammarly is an online service created in Ukraine that works based on artificial intelligence and helps to edit texts written in English. More than 20 million users around the world turn to this service every day.

For some time, the company used a private version of the Bug Bounty (a limited circle of hackers – up to 2,000, had access to the system), but in 2018 decided to switch to the public version to increase the number of potential participants (in the first year their number reached 150,000).

For a year and a half of the program's operation, the service received the following results:

- 138 found vulnerabilities were closed;
- $ 90,000 were paid in total;
- 118 "white" hackers were rewarded;
- $ 5,000 was the largest remuneration for one specialist.

Now Grammarly specialists continue to improve the rules for participation in the Bug Bounty program, actively involve hackers in the research of new services, and offer payments of up to $ 10,000 for the found vulnerabilities.

How Is the Bug Bounty Developed in Ukraine?

Unfortunately, Ukrainian legislation has not adjusted to the modern realities of cyberspace yet, so it does not allow "white" hackers to work at full capacity. Even acting out of good intentions, an IT specialist risks falling under the anti-hacking norms of the Criminal Code. This contributes to the spread of the practice the Ukrainian companies and government agencies use the services of in-house hackers or a limited number of trusted "white" hackers on private sites.

Certain state Ukrainian services are being tested based on the BRDO effective regulation office software. For maximum user safety, research is carried out on mirror copies of services with fictitious data, which are placed on third-party servers.

Why Is the Launch of Prozorro Bug Bounty Unique for Ukraine?

The positive experience of the two-day Prozorro marathon in September 2019 showed that this project allows not only to identify potential vectors of cyberattacks but also to make the service more convenient and understandable for users.

In June 2020, Prozorro launched an ongoing vulnerability scan program and invited everyone to participate. The system allows specialists to conduct tests within their test (preproductive) environment, which maximally repeats the working (productive) environment. This solution has two important advantages:

- protects the personal data of registered users and makes it possible not to interfere with their work with purchases;
- “white” hackers find bugs that can make the system vulnerable.

Against the background of the situation with ethical hacking in Ukraine, the launch of the open Bug Bounty program by the public procurement system Prozorro is a unique event. In the future, this may contribute to a change in the strategies for protecting Ukrainian (in particular the state) cyberspace.

Detailed conditions for participation in the Prozorro Bug Bounty program can be found on the official website.

Find out about the most interesting, participate in purchases, and win with SmartTender!