Tell us about yourself, your background ?

, I am 28 y/o. I’m a French guy who lives in Lyon. If you play CTF we have probably already met during an on site event as I play a lot of them with the French team Hexpresso.

 I was writing / reversing software for power plants.

I’m also a bug hunter, I’ve been in the top 10 hackers on 

 platform since the launch of the platform.

Why did you join YesWeHack and what is your role ?

It’s a team that I’ve known for quite some time through CTF, Bug hunting and 

We share the same principles and I do like the idea of bringing tools to the community.

 will be to support the hackers’ community, by providing tools, talks and workshop. I’ll attend the YesWeHack sponsored events, having great time with bug hunters and IT security researchers.

As a bug hunter and CTF player what are you driven by ?

To me, bug hunting is a lot like a puzzle game, I feel like every software, application is vulnerable to some kind of exploitation, you just need to find how.

Writing software is a difficult job, and developers are still human beings, so they make mistakes : our job is to find those mistakes and help developers to fix them before it gets worse.

One thing I love about the hacker community is the willingness to share information, tips or tools. There is always someone better than you in a specific field and most of the time those people will share their knowledge if you ask nicely.

What are the benefits of CTF (Capture The Flag) for those who want to start bug hunting ?

, the major difference is that in CTF you know that a vulnerability is there, you goal is “just” to exploit it.

So usually CTF tasks are quite small, you need to exploit a very specific bug. While in bug bounties, you are hacking real enterprise, their website can be huge and sometime you can find yourself lost in the scope. Bug Bounty has a whole reckon phase that CTF don’t have, it’s a new skill to learn.

CTF and Bug Bounties are different, but most of the time I use tricks and tips I’ve learn during CTF to exploit real life application in Bug Bounty.

What are the challenges of Private, Public and On-site Bug bounty Programs ?

I often read online that you should go and grab low hanging fruit and that’s why private bounties are better : first arrived – first served.

But I think It’s way more rewarding to hunt for business logic bugs : you’ll will need to spend more time and it can be a bit difficult in the beginning, but in the end you’ll find more critical bugs. In this regard, I think private and public bounties are really similar.

On site programs are a bit different. Most of the time developers are also on site. And that’s a very valuable asset, as you can ask them questions to try to understand how everything works behind the scenes. You are part of the same team, everyone is committed to hardening a product and everyone learns to work with others and ultimately all players gain and improve their knowledge and skills.

In terms of Bug Bounty Tips, do you have any resources, books, tools to share ?

My biggest tip for Bug Bounty would be to stay in touch with the new trends, read a lot of write ups (Bug Bounty or CTF), you won’t be able to find a bug if you don’t even know it can exist.

Also, don’t be too dependent on your tools : almost everybody uses the same set of tools (Burp Suite, sqlmap etc. ) so the difference between you and another hacker will be your own skills, tools are here to help you, to be able to be more efficient, but don’t expect them to do your job.

Why is Bug Bounty a good way to foster security/DevSecOps within DevOps’ pipeline?

Most companies don’t have enough internal resources to handle security testing. CrowdSourced Security and especially Bug Bounty is the way to approach this challenge. Through a 

, companies have access to a virtually unlimited pool of talents.

How do you manage the intensity of your hacking activities, do you take breaks to gain efficiency?

I used to play CTF all night but now I realize that the time I spend being awake too long I loose in efficiency, definitely. 🙂

You need to take breaks, It’s easy to get stuck in your own mindset. Have lunch, take a shower, go and grab something to drink, you’ll find new ideas quicker.

Join our community and happy bug hunting !

Lucas aka BitK: high level bug hunter and the brand new YesWeHack Tech Ambassador.

Cybersecurity is an urgent and major societal challenge. Highly correlated with the digitalization of our societies, cyberthreats have an increasing impact on our lives. It is therefore essential to ensure digital security and strategic autonomy of the EU by strengthening leading cybersecurity capacities. This challenge will require the coordination of Europe’s best competences, towards common research and innovation goals.

SPARTA is a novel Cybersecurity Competence Network, supported by the EU’s H2020 program, with the objective to develop and implement top-tier research and innovation collaborative actions. Strongly guided by concrete challenges forming an ambitious Cybersecurity Research & Innovation Roadmap, SPARTA will setup unique collaboration means, leading the way in building transformative capabilities and forming a world-leading Cybersecurity Competence Network across the EU. From basic human needs (health) to economic activities (energy, finance, and transport) to technologies (ICT and industry) to sovereignty (eGovernment, public administration), four research and innovation programs will push the boundaries to deliver advanced solutions to cover emerging challenges.

 for France, at the intersection of scientific excellence, technological innovation, and societal sciences in cybersecurity. Together, along with SPARTA Associates, they aim at re-imagining the way cybersecurity research, innovation, and training are performed in Europe across domains and expertise, from foundations to applications, in academia and industry.

In sharing experiences and excellence, challenges and capabilities, SPARTA makes decisive contributions to European strategic autonomy.

 – Cybersecurity Competence Network –
on Twitter 

We are SPARTAns: Re-imagining cybersecurity for the European Union

Let’s meet with Kalin, Bug Hunter from Poland.

I’m 25 yo ,I didn’t study, it’s kind of a waste of time in Poland. Well, depends if hacking the school PCs in junior high school counts? xD
I have started my carrier in IT industry as a Data Center Operator, then I got promoted to Junior Dev. They had to do it because I have pwned their application once, and after promotion with the access to source code I was able to find few more critical bugs. Also with the help of Shellshock I was able to download/view the files of the CTO that were stored on one NAS.

3 years ago I have joined a awesome security company, and in my current position I’m responsible for : Mobile apps testing / Web apps testing / Code reviews / General technical advisory on the customer side.

My nickname Kalin comes from my surname KALINowski. I can be also found on the Internet by @llamaonsecurity/@llamasbytes handle.

It started bug bounties as a time-killer in my first job, then I forgot about it and came back to it when I started the carrier in IT security. Participating in bug bounties improves your skills and increase the overall knowledge. Once I had to dig into the PNG file format structure to execute the XSS payload on web servers. It was quite an unique experience. Financially speaking, 1 euro is equal to 4.15 PLN (my local currency) so participating in bug bounties can be profitable.

Bug Bounty requires skills, mental ability, a sort of digital hygiene : can you share some basics, principles ?

To be effective as a bug hunter you have to keep yourself in the information loop. Get the grasp of latest bugs, exploit techniques by following right people and visiting right websites. Personally, I can point you to an awesome active bug hunter: 

, his retweets helped me few times. As for websites, I would recommend 

Tell us about the Infosec community in Poland and more generally in the eastern part of Europe.

The IT Security community in Poland is mature. We have a great Infosec related websites:

If you want to go on IT Security conferences you can chose from many options
like 

 2018, they are hosted yearly. That said, I’m not aware of the situation in other eastern Europe countries.

Apart from this discipline, do you have any other interests ?

I’m a husband and a father of 4 yo, so I don’t have a lot of time for myself. But if I had to point one thing that helps me to relax, I would pick games: Digital and paper games.

How do you proceed for reporting a vulnerability when there are no official bug bounty programs ?

So it depends on many factors. Mainly, I am guided by 3 questions :

– “Is the target a government unit, public services provider?”
– “How much free time do I have?”
– “Does the affected vendor/page/app have a contact information in language that I can understand (hint: Polish,English)?”.

I can share some examples of my methodology.

1. if I have time for extra activities and the vulnerable app is from an English speaking country and the contact form is in English.
> Outcome: Report immediately.

2. If the vulnerable app is made by non English speaking people and the contact form is in language unknown to me.
> Outcome: Do not report the bug./Schedule for later.

3. If the app is a .gov domain. I’m trying to report the bug in the .gov domain even if I don’t have a lot of time.
> Outcome: Report to a proper cert in that country.

4. If the app is in Europe and it is related to a critical industry like banking, public transports etc.
> Outcome: I would look for direct contact if it fails I would try to look for an alternative it might be a CERT unit or some Coordinated Vulnerability Disclosure programs like 

5. If the app is a NGO or a hospital, contact form is in English and I have some time.
> Outcome: Direct contact.

Sometimes, I’m trying to reach specific organisation through my contacts, this is a last resort 🙂

 : if you want to enable your public profile like Kalin, please tick the box like depicted below :

Go to your profile https://yeswehack.com/user/profile

Click Edit, then tick the box Public. Last but not least, update your profile.

[ITW] Daniel Kalinowski: “Participating in bug bounties improves your skills and increase the overall knowledge.”

, Europe’s leading Bug Bounty platform, announced today it has raised €4 million from Open CNP, the corporate venture program of CNP Assurances, and Normandie Participations. This deal aims at asserting the company’s presence in France and accelerate its international development, notably in Europe and Asia.

 offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands’ cyber-security experts (ethical hackers) across 120 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

“YesWeHack mobilises collective intelligence to plug the widening gap in cybersecurity skills – one of the big challenges of the next few decades”

Guillaume Vassault-Houlière, CEO of YesWeHack

With this fund-raising, YesWeHack intends to play a key role in the development of an agile approach to security, as a way to accelerate the digital transformation. Bug Bounty fits into the DevSecOps trend (development-security-operations) which embeds security into projects in a more pro-active way, since their inception.

YesWeHack also strengthens its strategic capabilities with Laurent Seror, chairman of Outscale, Eric Leandri, Chairman and CEO of Qwant, Charles Beigbeder and Jonathan Denais of Open CNP joining the board.

With this new investment, Open CNP, the corporate venture program of 

adds its 7thproject to its partnerships with innovative start-ups. Open CNP was set up in 2016, tasked with channelling financial support to disruptive start-ups and working alongside them to develop advanced solutions in growth fields – fintech, assurtech, e-health and other technologies – with the long term vision of better serving its customers. CNP Assurance has been using the YesWeHack platform since July 2018 to run its Bug Bounty program.

 is participating in the dynamism of the region alongside other local financing players. Applying its principle of co-investing with private actors, Normandie Participations, funded with 100% Norman capital, targets companies at the stages of start-up, innovation, development, creation, transmission or turnaround. The regional fund has made 38 investments totalling €30 million in a little over 2 years.

YesWeHack raises €4 million and plans to disrupt Europe’s cybersecurity market

 is delighted to support the French Cyber Defence Command (COMCYBER), in order to leverage its 3,400 cyber-combatants+ force.

, a French start-up and Bug Bounty leader in Europe, equips COMCYBER with an innovative concept and tool to boost cooperation with all the Ministry’s cyber entities.

This bold initiative is part of the Ministry opening up towards the civil society and private actors.

Florence Parly, the French Armed Forces Minister, announced on the 22nd of January :

A partnership has been established between COMCYBER and a start-up, YesWeHack. So, yes, I do announce: we will launch the first Bug Bounty of the French Armed Forces Ministry at the end of February 2019. Ethical hackers, recruited within the cyber operational reserve, will be able to search for vulnerabilities in our systems and, if successful, be as they should be, rewarded.

-Florence Parly, the French Armed Forces Minister

With the signing of this partnership, the Armed Forces Ministry becomes the first French Ministry to launch a Bug Bounty program. COMCYBER will leverage YesWeHack Bug Bounty platform to meet the growing challenge posed by new cyber threats.

With the YesWehack Bug Bounty platform, COMCYBER will be able to best use its trusted community of reservists, in order to 

improve global security of the ministry’s entities

Guillaume Vassault-Houlière, YESWEHACK CEO

This Bug Bounty program opens new perspectives for the management of the operational cyber reserve. Ultimately, such initiative will make possible to train reservists and increase their skills to significantly and durably improve the Ministry’s level of security.

French Armed Forces Ministry launches a Bug Bounty program

For the past ten years or so, organizations have been trying to implement operational policies to avoid “Full Disclosure” reports or “Open Bug Bounty” whose methods are not that good in terms of honesty and responsibility.

Speaking of responsibility, you may be familiar with the notion of “Responsible Disclosure” and you wonder how it differs from the concept of Coordinated Vulnerability Disclosure aka 

The concept of responsible disclosure has too often been at the root of endless discussions:

On the one hand the vendors denounce “Disclosing a vulnerability without providing patches is not responsible”.
and the other, “Don’t fix this vulnerability as quickly as possible is not responsible”, say security researchers.

During this precious time when both sides argue, the system concerned is at the opponent’s mercy.

In order to move towards greater efficiency and to get out of sterile debates, it is therefore important to avoid speaking of “responsible disclosure”. This is why many organizations advocate the concept of “Coordinated Vulnerability Disclosure” (CVD) in order to promote and strengthen cooperation between the various actors in cybersecurity, all of whom have a common goal: Make the Internet safer.

Coordinated Vulnerability Disclosure (CVD) is a process aimed at reducing risk and ultimately mitigating potential damage caused by a vulnerability affecting an information system. CVD is a process that cannot be reduced to the deployment of a patch or publication of a report, even though these events are indicators of the efficiency of cooperation.

 Bug Bounty Platform facilitates the cooperation of thousands of security experts and organizations.
Cooperation: it is a key element of Cyber Governance.
Guillaume Vassault-Houlière | YesWeHack CEO

Coordinated Vulnerability Disclosure is therefore the process of collecting information from Security Researchers, coordinating the sharing of this information among actors, and disclosing the existence of vulnerabilities (software or even hardware) and their mitigation measures to various stakeholders, including the public.

Coordinated Vulnerability Disclosure significantly increases the likelihood of success of any vulnerability response process. Contributions are often vulnerability reports written by security researchers.

CVD reports for a product (software or hardware) typically include patches as well as vulnerability report documentation or recordings in a vulnerability database.

NB: many operational vulnerabilities can be corrected by the operator and do not necessarily result in public disclosure.

Vulnerability disclosure is a process by which vendors and people who discover vulnerabilities can work collaboratively to find solutions that reduce the risks associated with a vulnerability.

ISO/IEC 29147 standard defining Vulnerability Disclosure

This process includes actions such as the reporting, coordination and publication of information on one vulnerability, its mitigation or, ideally, its remediation.

Consider CVD as a process navigating between the “best” and the “worst”.

Ensure that identified vulnerabilities are – well – addressed;

Provide users with sufficient information to assess the risks associated with the vulnerabilities of their systems;

:
Coordinated Vulnerability Disclosure commonly begins with the detection of a vulnerability and ends with the deployment of patches or mitigation.

Therefore, several actors are involved in the CVD process:

Security researcher – the person or organization that identifies vulnerability.

Reporter – the person or organization who notifies the vendor

Vendor – the individual or organization that created or maintains the product that is vulnerable

System Administrator – an individual or organization that must implement a corrective action or take other corrective actions.

Coordinator – an individual or organization that facilitates the coordinated response process

Discovery – Someone discovers a vulnerability in a product.

Report – The product vendor or a third party coordinator receives a vulnerability report.

Qualification – The recipient of a report validates it to ensure its accuracy before prioritizing it for further action.

Remediation – A remediation plan (ideally a software patch) is developed and tested.

Public Awareness – Vulnerability and corrective measures are disclosed to the public.

Deployment – Corrective measures are applied to the systems concerned.

The reporting step is important because it requires the creation of secure channels to ensure that transmitted information is not intercepted by a third party.

No vendor contact available – This may occur because a contact could not be found or because the contact is not reactive.

Termination of cooperation – participants in the CVD process may have other priorities that attract their attention.

Information leakage – Whether intentional or unintentional, information for a small group of actors can be passed on to others who are not involved in the CVD process.

Independent Discovery – Any vulnerability that can be found by one individual can be found by another, and not everyone will tell you about it.

Active Exploitation – Evidence that a vulnerability is being actively exploited by adversaries requires accelerating the CVD process to reduce users’ exposure to risk.

Communication is deteriorating – CVD is a process of coordinating human activities. As such, its success depends on the quality of the relationships between the participants.

Marketing – In some cases, vulnerabilities can be used as a marketing tool. This is not always conducive to the smooth running of the CVD process.

Vulnerability disclosure practices are no longer restricted to web applications. The Internet of Things and the constellation of SCADA systems, connected health devices, CCTV, Connected cars, etc. have become so dependent on software and the Internet that they increase the exposure perimeter and will inevitably be exposed to new attacks.

The Coordinated Vulnerability Disclosure is a major ally to federate the largest number of cyberspace actors and stimulate the exchange of knowledge to ensure both security and privacy protection by design.

By encouraging cooperation, CVD will enable all stakeholders not only to defend their common information assets but also to fight more effectively against the black market and the resale of Zerodays.

The set is now planted, so let’s switch from theory to practice.

In order to respond to the lack of contacts available to disclose a vulnerability on a website, security researcher 

, well inspired by the role of the famous robots. txt, suggested since the beginning of August 2017 to include in each website the file 

 as a reference file containing the procedure to be followed to disclose more effectively to the editor of a site a bug, a vulnerability.

This approach has the merit of establishing clear guidelines for security researchers on how to report security issues and allows bug bounty programs to use them as a basis for defining the attack perimeter for future researchers.

Where should I put the security.txt file?

The security.txt file should be placed under the /.well-known/ path (/.well-known/security.txt) [

Bug Bounty as part of your disclosure policy

As part of agile development on their own products, more and more vendors are choosing to be proactive by stimulating and cooperating with IT researchers:

by relying on in-house resources and expertise;

by contracting directly with external researchers;

via a platform that will connect researchers and one vendor. The latter will therefore pay for the result and will be able to choose between various options such as program management or even patch management if its internal resources are not sufficient.

NB: The creation and long-term implementation of a Bug Bounty program is considered as an indicator of the maturity of publishers’ E-governance in terms of vulnerability.

Since 2013, YesWeHack has been developing tools that greatly facilitate the implementation of an incentive policy for CVD.

YesWeHack, its community and ecosystem of services enable organizations and IT security researchers to better cooperate.

Thanks to the tools developed by YesWeHack, beneficiary organizations can more easily overcome the obstacles encountered by their CVD policy. In addition, organizations gain reputation by demonstrating their appetite and willingness for continuously improving their systems.

YesWeHack.com as the first European Bug bounty platform.

Cooperation with European partners and providers as a matter of sovereignty.

Legal and technical infrastructure that meets the highest security requirements.

Security and confidentiality of communications based on encryption and compliance with ISO standards.

Securing financial transactions between organizations and security researchers.

Payment platform compliant with European anti-money laundering and anti-terrorist financing arrangements.

Support throughout the entire process: from the drafting of the program to assistance with corrective measures.

Operational ranking of the best researchers: Management of a security research community.

Reactivity that enables the best researchers to be mobilized in record time.

Ability to organize different types of Bounty bug programs (Private / Public / In situ / Hardware and/or Software).

What should I do if a product does not offer Bug Bounty or Security.txt?

A simple and effective tool to avoid full disclosure of vulnerabilities in the wild.

It is important to note that some products (software or hardware) do not have their own Bug Bounty program. Thus, it is difficult for a security researcher to report a vulnerability to a vendor. Not all countries have a law allowing this kind of practice, as is the purpose of Article 47 of the Law for a Digital Republic initiated by ANSSI.

YesWeHack has created Zerodisclo.com to facilitate the escalation of vulnerabilities in a secure and even anonymous way and put in touch the different actors working for a safer Internet.

Thanks to Zerodisclo several obstacles are removed: no login, anonymization of the report via the Tor (.onion) network and mandatory and automatic encryption of the report content with the public PGP key of the CERT chosen.

Incentive Policy for Coordinated Vulnerability Disclosure

Adopt a proactive security posture now

Harness the power of crowdsourced security to supercharge the discovery and remediation of vulnerabilities.

The YesWeHack Blog

Lucas aka BitK: high level bug hunter and the brand new YesWeHack Tech Ambassador.

We are SPARTAns: Re-imagining cybersecurity for the European Union

[ITW] Daniel Kalinowski: “Participating in bug bounties improves your skills and increase the overall knowledge.”

Lucas aka BitK: high level bug hunter and the brand new YesWeHack Tech Ambassador.

YesWeHack raises €4 million and plans to disrupt Europe’s cybersecurity market

French Armed Forces Ministry launches a Bug Bounty program

Incentive Policy for Coordinated Vulnerability Disclosure

YesWeHack raises €4 million and plans to disrupt Europe’s cybersecurity market

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us