Feeds

Pen tester scoops source code in bug hunt contest, has to argue for prize

What's a hacker got to do to get some recognition around here at Prezi.com?

Internet Security Threat Report 2014

An Australian penetration tester named Shubham Shah has become the latest to complain about bug bounty programs that offer pathetic – or no – rewards.

The bounty program in question was run by Prezi, a slideware-as-a-service outfit/ The terms of the program state that only certain “ … domains (and every service accessible on them) are in the scope of the bug bounty program.”

Shah went beyond those domains but claims to have come up with the biggest prize imaginable: Prezi's source code. All of it, using the technique explained here.

He then contacted Prezi to let them know about the problem and received hearty thanks in reply.

The company then refused to reward his efforts because the domain he investigated - http://intra.prezi.com – wasn't among those listed in the competition.

That decision is rather at odds with the following statement about rewards on offer;

“If you succeed, we will give you cash. That’s right; we’ll pay cold hard currency into your bank account. Think of it as a thank you.”

Shah was eventually offered branded tat, which he rejected as inadequate payment and just not sporting.

After a lengthy correspondence (PDF) Prezi eventually did the right thing, admitting to A Bug in the Bugbounty and promising that “ from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users’ information and that their report triggers us to improve our code base.”

Prezi's parsimony and eventual reverse is not isolated: Yahoo! recently also made its bug bounty program more rewarding after complains from developers. ®

Internet Security Threat Report 2014

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.