Feeds

Pen tester scoops source code in bug hunt contest, has to argue for prize

What's a hacker got to do to get some recognition around here at Prezi.com?

Beginner's guide to SSL certificates

An Australian penetration tester named Shubham Shah has become the latest to complain about bug bounty programs that offer pathetic – or no – rewards.

The bounty program in question was run by Prezi, a slideware-as-a-service outfit/ The terms of the program state that only certain “ … domains (and every service accessible on them) are in the scope of the bug bounty program.”

Shah went beyond those domains but claims to have come up with the biggest prize imaginable: Prezi's source code. All of it, using the technique explained here.

He then contacted Prezi to let them know about the problem and received hearty thanks in reply.

The company then refused to reward his efforts because the domain he investigated - http://intra.prezi.com – wasn't among those listed in the competition.

That decision is rather at odds with the following statement about rewards on offer;

“If you succeed, we will give you cash. That’s right; we’ll pay cold hard currency into your bank account. Think of it as a thank you.”

Shah was eventually offered branded tat, which he rejected as inadequate payment and just not sporting.

After a lengthy correspondence (PDF) Prezi eventually did the right thing, admitting to A Bug in the Bugbounty and promising that “ from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users’ information and that their report triggers us to improve our code base.”

Prezi's parsimony and eventual reverse is not isolated: Yahoo! recently also made its bug bounty program more rewarding after complains from developers. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
SMASH the Bash bug! Red Hat, Apple scramble for patch batches
'Applying multiple security updates is extremely difficult'
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.