ExpressVPN Offering $100,000 To First Person Who Hacks Its Servers (bleepingcomputer.com) 28
ExpressVPN has updated its bug bounty program to make it more inviting to ethical hackers, now offering a one-time $100,000 bug bounty to whoever can compromise its systems. Bleeping Computer reports: Today, ExpressVPN announced that they are now offering a $100,000 bug bounty for critical vulnerabilities in their in-house technology, TrustedServer. "This is the highest single bounty offered on the Bugcrowd platform and 10 times higher than the top reward previously offered by ExpressVPN," the company shared in an email to BleepingComputer. The new $100,000 one-time bounty is offered with the following conditions:
- The first person to submit a valid vulnerability, granting unauthorized access or exposing customer data, will receive the $100,000 bounty. This one-time bonus is valid until the prize has been claimed.
- The one-time $100,000 bounty is only eligible for vulnerabilities in ExpressVPN's VPN Server.
- Activities should remain in scope to the TrustedServer platform. If unsure that your testing is considered in-scope, please reach out to support@bugcrowd.com to confirm first.
ExpressVPN also invites security researchers to uncover possible ways to leak the actual IP address of clients and monitor user traffic. The bug bounty program is run through BugCrowd, which offers a safe harbor for researchers who attempt to breach ExpressVPN's servers as part of the program.
- The first person to submit a valid vulnerability, granting unauthorized access or exposing customer data, will receive the $100,000 bounty. This one-time bonus is valid until the prize has been claimed.
- The one-time $100,000 bounty is only eligible for vulnerabilities in ExpressVPN's VPN Server.
- Activities should remain in scope to the TrustedServer platform. If unsure that your testing is considered in-scope, please reach out to support@bugcrowd.com to confirm first.
ExpressVPN also invites security researchers to uncover possible ways to leak the actual IP address of clients and monitor user traffic. The bug bounty program is run through BugCrowd, which offers a safe harbor for researchers who attempt to breach ExpressVPN's servers as part of the program.
Does This Include Vulnerabilities In Workers? (Score:4, Funny)
Give up those passwords quick with tinsnips.
Re: (Score:2)
Re: (Score:3)
No. https://www.expressvpn.com/bug... [expressvpn.com]:
Out of scope:
* Alpha and beta versions of our applications
* Social engineering (e.g., phishing)
* Physical security of our offices, servers, and employees
* Third-party software (except in cases where there is an exploitable vulnerability due to misconfiguration or patch level)
Re: (Score:2)
In other words, if what you're doing won't earn you the bug bounty, then you're better off ripping off all the information you can and then selling it.
So instead of getting notified about the bug, instead data is leaked about its users, and more than likely, be exploited over a period of time so tracking users on the service is possible.
If you find a vulnerability in the physical security of their office, instead of reporting it, you're better off exploiting it rather than reporting it.
Re: (Score:1)
why read stuff...
Photoshopped legal warrant (Score:2)
only to the first (Score:2)
because many will come
Re: (Score:2)
Apparently they have an ongoing bug bounty program and have been paying out, so idk.
3..2..1.. (Score:2)
They are not offering too much, so I guess they know what things are worth. I would expect the prize to be claimed shortly.
Re: (Score:3)
Lame! (Score:5, Insightful)
They seem to have crafted this in a way that indirect hacks (e.g. hacking something unrelated and then moving laterally) are ineligible.
Re: (Score:3)
Looking at the bounty they have excluded physical hacks, i.e. someone with access to their server hardware.
They should be able to defend against that. Encrypted RAM is available on Epyc, all ports can be secured, and they can use OS images loaded from the network with Secure Boot to mitigate modifying files on disk.
That's what Mulvad does. They don't trust the datacentres where their servers are hosted.
Link to actual program (Score:4, Informative)
Domestic/foreign intelligence agencies pay more (Score:2)
for this kind of information.
I am offering 200,000 (Score:4, Interesting)
North Korea is offering 1 million
Re: (Score:2)
Canada is offering 10 million... in Canadian Tire money.
Exciting if the act of hacking generated the award (Score:3)
One thousand $100 gift card codes are yours! lol :)
All VPN's are front for national intelligence... (Score:2, Interesting)
Re:All VPN's are front for national intelligence.. (Score:4, Insightful)
This is a job for Sneakers! (Score:3)
A Robert Redford film vehicle, but with a solid cast.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Sidney Poitier managed to make his character multi-dimensional, and with some good understated humor, which was perfect for that role.
Re: (Score:2)
How to get rich (Score:2)
1) Hack a VPN company for 100000 $
2) Use your enhanced privileges to raise the bounty to 100 Million
3) Profit!
Challenge accepted! (Score:2)
All I need is a key to the facilities and my trusty titanium hacksaw!
ExpressVPN also invites security researchers to un (Score:1)
> ExpressVPN also invites security researchers to uncover possible ways to leak the actual IP address of clients and monitor user traffic.
Apply for the job at ExpressVPN
thats the spirit (Score:1)
Waaw! (Score:1)