Vasyl Zadvornyi about Prozorro Bug Bounty

On June 1, the Prozorro system for the second time launched the Bug Bounty information security vulnerability search program. About the first experience of cooperation with “white” hackers and how the testing of the service will take place, told Vasyl Zadvornyi, CEO of Prozorro.

Why did Prozorro decide to conduct the Bug Bounty project?

The modern world is becoming more digitalized, and every month the number of situations in which data leakage leads to serious consequences is increasing. This project is the most popular and reliable way to test the cybersecurity of a system in real-time. For many years it has been used by such global companies as Google, Facebook, Microsoft, and government agencies like the Pentagon. This helps them to protect their databases and software products.

What is the overall protection of the Prozorro system? Is it vulnerable to hacker attacks?

Unfortunately, a single information system that is not vulnerable to attacks is a system that is not connected to the network. Any systems in the world, however secure they may be, are vulnerable. The only question is how much their hacking will cost. Therefore, the task of defense is not to protect the system, but to increase the cost of attack.

The Prozorro service is protected according to this strategy: we minimize the number of potential attack vectors, minimizing possible losses, and making the system as inaccessible to external threats as possible. We constantly monitor software updates to protect ourselves from the so-called 0-day vulnerabilities – malicious programs against which defense mechanisms have not been developed yet. Also, we actively use the resources of external parties to quickly respond to emerging situations.

In the vast majority of cases, we do not encounter targeted attacks on the Prozorro system. Rather, with intelligence. We fix it and make sure that there are no serious interventions in the service.

What results did you manage to achieve from working with “white” hackers last year?

In autumn 2019, the Prozorro system first launched the Bug Bounty program in the format of a two-day marathon. Even for such a short period, we got a very useful result for us. IT specialists did not find critical vulnerabilities on a productive system but found two attack vectors that could become critical in the future and a large number of potentially interesting attack vectors.

Also, it was Bug Bounty that made us pay attention to the need to ensure the security of the system as a whole, not just its central component. In autumn, we tested the central database, and since this component has almost no user interfaces, this significantly reduced the number of potential attack vectors. That is why since this year we are expanding the testing area to the sites that work with us.

What are the differences between the current Bug Bounty and last year's marathon?

It is important for us to protect ALL user data, regardless of where it is stored: in Prozorro databases, on sites, or elsewhere. Therefore, the main difference of the current project is that now we will test not only the central database but also the sites, which are also part of the ecosystem (now three out of thirteen online trading platforms are included in the program). This makes the project more complex, but also more interesting. We must protect all participants in the ecosystem, therefore, we plan to expand the program to all sites by the end of the year.

Another difference – now the project will operate on an ongoing basis. Everyone understands that Prozorro, like any other software product, is constantly updated. Therefore, testing the service can bring new results each time.

How will hacker interferences affect the operation of the system and sites?

I want to immediately reassure all users of the service: the research will take place in a special environment and will not affect the conduct of tenders. In Ukraine, there are certain legal restrictions on the implementation of such projects, especially if we are talking about a productive system. That is why testing in Prozorro takes place, not in a productive, but in a preproduction (stage-in) environment, which is used in the process of system deployment.

Despite this, such a condition limits the possibilities of hackers minimally, since the preproduction environment is similar to the productive one most of the time. We did not want to create an artificial platform specifically for testing so that in the end we would not find vulnerabilities and reassure ourselves. No, the project will take place in that part of the system that is constantly being updated. The testing of online sites will be held similarly.

What are your expectations from the project? In your opinion, will someone be able to hack Prozorro and the sites?

I am sure that yes, it will succeed, and we are doing this project just for this. We understand that programs like Bug Bounty are not conducted to calm down and report that everything is fine with us and we have not found any vulnerabilities. On the contrary, we want these things to be found. The main task of testing is to find them earlier than by anyone else.

Therefore, we urge everyone interested in participating in such events to join. Bug Bounty from Prozorro is the first project in Ukraine that is carried out by the state, and this is its uniqueness. This is a great opportunity for IT professionals to fully apply their skills, find vulnerabilities in the cybersecurity of public services and, as a result, receive not legal actions, but gratitude and recognition.