Bug Bounty Prozorro

On June 1, the Bug Bounty information security vulnerability search project was launched on the Prozorro system. Last fall, Prozorro became the first state institution in Ukraine who use the services of "white" hackers. And starting this year, the project will operate on a permanent basis. We tell in more detail about its history.

What is Bug Bounty

Bug Bounty is a program in which websites and software developers offer all willing IT professionals to receive recognition or reward for errors, malfunctions, or vulnerabilities found in the system. Today, it is considered the most effective way to find errors, which in many cases is more useful than short-term audits and tests of specialized companies. The services of "white" hackers have long been used by such giants as Google, Apple, Facebook, and even the US Pentagon.

History of the name

The program was first announced in 1983 by Hunter & Ready to test their operating system. Under the terms, anyone who found a bug in the software received a choice of Volkswagen Beetle (also called "Bug") or $ 1,000. The action was published on booklets and had the following call: "Get a Bug if you find a bug!".

The first official launch of Bug Bounty

Ten years later, in 1995, this idea was addressed by Jarrett Ridlinhafer, a tech support engineer at Netscape Communications Corporation. It was he who came up with the name of the project – "Bug Bounty". At that time, the company produced custom software and actively encouraged its employees. There were many enthusiasts in its staff, interested in creating the best product, who was constantly looking for and correcting mistakes, improving something and publishing their results and ideas on the company's websites and forums.

Jarrett saw great potential in this and invited the corporation's management to launch a program that would reward each participant who found technological errors in the Netscape Navigator 2.0 beta browser. The majority liked the idea, and the project was allocated an initial budget of 50 thousand dollars. Thus, officially the first program called "Bug Bounty" was launched on October 10, 1995. It has attracted the attention of many professionals and has been so successful that it has been mentioned in most books on Netscape's achievements.

Further history of the use of Bug Bounty

For a long time, Bug Bounty was not widely popular. Only since 2002, it has been increasingly used by various IT companies. The take-off took place in 2010 when the program was launched by Google to start the trend of working with ethical hackers. Currently, Bug Bounty is used by 6% of the world's largest companies on the Forbes Global 2000.

Bug Bounty Prozorro

What vulnerabilities do "white" hackers find?

The list of vulnerabilities in information security is so large that it is very difficult to sort them into certain categories. But most ethical hackers find the following potential vectors of attacks:

- SSRF (server-side fake requests) – allows to access the company's internal infrastructure, even if it is not available for the Internet;
- SQL injection – allows to access the database of the site, which stores personal data of users;
- RCE (remote code execution) – allows the hacker to pretend to be a server administrator and execute the necessary commands.

Some vulnerabilities are relatively easy and fast, others require a lot of experience and a lot of time. The more seriously a company treats its databases, the more complex the infrastructure of its servers is and the more difficult it is to find deficiencies in their protection. But there are still potential vulnerabilities, and it is "white" hackers who help find them and close them in time.

We expect that the Bug Bounty program will bring a lot of benefits to the Prozorro system and all connected trading platforms. This will undoubtedly contribute to the further development of the online procurement ecosystem.

Find out more and win with SmartTender!