IntegraXor HMI/SCADA Bug Bounty Program

This Bug Bounty Program is part of our effort to make IntegraXor SCADA more secure, safe & stable. Below are the rules for joining. Terms & conditions apply.

Considerations

• We only concern on the issue that will impact our customers’ installation of IGX SCADA system, any issue related to our commercial websites is not included in this program.
• You must download & setup your own testing environment, do not attempt to access any real time or demo system that wasn’t setup by you.
• You must provide a complete step to reproduce the bug or describe the PoC.
• For security vulnerability issue, ensure it must be a closed disclosure, any zero day or third party disclosure is not qualified.
• Major consideration is any vulnerability that affecting the integrity of data linked to external devices, particularly tag data. DoS attack is not in consideration.
• We do not consider any issue affecting use of beta, release candidate, out-of-date IntegraXor server/editor, browsers and plugins. On the other hand, we *also* do not accept any issue that already fixed in beta/release candidate, although very likely those issues would have reported earlier.
• Only the first reporter for same issue will be considered. We will publish the first reported date in our Release Note orVulnerability Report or in our website where we find appropriate that accessible by public, when the issue is being fixed later.
• Please contact support to obtain our email address to send in your report.

IntegraXor HMI/SCADA Bug Bounty Program | SCADA Bug Bounty Programm

Coinbase – Owning a Bitcoin Exchange Bug Bounty Program

When I first started analyzing the Coinbase website I had a quick look over the site layout and the functionality/attack surface available for potential exploitation. I quickly determined it was running Ruby on Rails based on the encoding of the “_coinbase_session” cookie. This was supported by the fact Coinbase’s founder Brian Armstrong had a lot of Ruby snippets on his Github Gist and some more Ruby questions on his Stack Overflow account.

Reflected XSS vulnerability on Coinbase

I had a lot of fun in the few hours I spent looking at Coinbase while procrastinating from exam study. They have done a lot of things right in regards to CSP, HttpOnly session cookies and two-step authentication but are let down with the integration of third party components such as Doorkeeper and ZeroClipboard. It is difficult to get any reasonably complex site completely secure and even sites doing more than $15 million USD per month in Bitcoin transaction volume can have a number of critical issues which a blackbox attacker could discover. I would recommend for all web developers to check out the guides on the OWASP website which cover all the key areas where security problems can occur in web apps.

The article will cover following vulnerabilities: 

• Reflected XSS
• Persistent XSS on Merchant Checkout Pages
• Insecure OAuth Application Approval
• Insecure OAuth Redirect URI in the Coinbase Mobile App

Full article | Donncha O'Cearbhaill

How I Hacked PayPal Users Reports System

During PayPal’s bug bounty program, I located a ton of vulnerabilities in the Iportal application. In the end, PayPal just decided to get rid of it entirely.

Source

PayPal denies teenager reward for finding website bug

A 17-year-old German student contends PayPal has denied him a reward for finding a vulnerability in its website.

Source