Bug bounty and vulnerability coordination platform HackerOne has fired an worker for utilizing their place to entry prospects’ vulnerability information and promoting duplicated information again to them to become profitable.
On Friday, July 1st, the San Francisco-headquartered bug bounty and vulnerability coordination platform HackerOne disclosed that an worker they employed in April 2022 was fired for accessing safety stories submitted to the platform and resubmitting them to prospects for financial positive aspects.
Reportedly, the unnamed worker “anonymously disclosed this vulnerability data exterior the HackerOne platform” solely to assert bounties. Inside 24 hours of detecting this malpractice, the corporate reduce off the worker’s entry to vulnerability information and contained the incident. The worker was fired on 30 June 2022.
It should be famous that HackerOne is a platform the place white hat hackers can anonymously submit vulnerability stories in change for bounties. It is among the main Assault Resistance Administration platforms on this planet.
How was the Malpractice Detected?
HackerOne defined that on June twenty second, 2022, certainly one of its prospects received suspicious when somebody submitted vulnerability information utilizing aggressive and threatening language. The client shortly alerted the corporate, asking them to analyze a “suspicious vulnerability disclosure” submitted by somebody utilizing the deal with “rzlr.”
Surprisingly, the information was similar to a disclosure the corporate had beforehand shared with the identical buyer.
Investigation Reveals Startling Information
The corporate launched an investigation and discovered that an insider was accessing buyer disclosures. Inside log information evaluation confirmed that the rogue worker created a HackerOne sockpuppet account and resubmitted duplicate variations of vulnerability stories to the identical prospects to obtain cash.
“Following the cash path, we acquired affirmation that the menace actor’s bounty was linked to an account that financially benefited a then-HackerOne worker. Evaluation of the menace actor’s community visitors supplied supplemental proof connecting the menace actor’s major and sockpuppet accounts.”
HackerOne – Weblog Publish
How Many Clients Had been Focused?
HackerOne additionally revealed that the now ex-employee had entry to its programs between April 4th and June twenty third, 2022. Throughout this time, the worker was concerned in triaging vulnerability disclosures for various buyer packages and had contacted seven prospects in the identical method.
The corporate interviewed the worker and later fired him for violating the corporate’s insurance policies, tradition, and employment contract. HackerOne’s chief data safety officer Chris Evans and chief expertise officer Alex Rice dub it a “critical incident.”
However, the corporate has notified prospects in regards to the incident however haven’t but determined a few legal referral towards the worker.
