From 9af59d95a97ce2719064576bb122173d3a33d65d Mon Sep 17 00:00:00 2001 From: Arkadiy Tetelman Date: Fri, 10 Nov 2023 19:32:41 -0800 Subject: [PATCH] Fix intigriti (#152) Co-authored-by: arkadiyt <> --- Makefile | 3 + lib/bounty-targets/intigriti.rb | 34 +- spec/bounty-targets/intigriti_spec.rb | 133 +++--- spec/fixtures/intigriti/programs.json | 99 +++-- spec/fixtures/intigriti/scopes.html | 184 ++++++++ spec/fixtures/intigriti/scopes.json | 592 -------------------------- 6 files changed, 350 insertions(+), 695 deletions(-) create mode 100644 spec/fixtures/intigriti/scopes.html delete mode 100644 spec/fixtures/intigriti/scopes.json diff --git a/Makefile b/Makefile index 38f6564..9a0cfd1 100644 --- a/Makefile +++ b/Makefile @@ -4,6 +4,9 @@ build: deploy: fly deploy +console: + fly ssh console + %: $(MAKE) build docker run --rm -v $${PWD}:/app/ -it bounty-targets make -f Makefile.docker $@ diff --git a/lib/bounty-targets/intigriti.rb b/lib/bounty-targets/intigriti.rb index 5f8bb48..f9f8294 100644 --- a/lib/bounty-targets/intigriti.rb +++ b/lib/bounty-targets/intigriti.rb @@ -40,8 +40,10 @@ def encode(component) end def directory_index - programs = ::JSON.parse(SsrfFilter.get(::URI.parse('https://api.intigriti.com/core/public/programs')).body) - programs.map do |program| + page = SsrfFilter.get(::URI.parse('https://www.intigriti.com/programs')).body + tag = page.match(%r{/_next/static/([^/]+)/_buildManifest.js})[1] + programs = ::JSON.parse(SsrfFilter.get(::URI.parse("https://www.intigriti.com/_next/data/#{tag}/en/programs.json")).body) + programs['pageProps']['programs'].map do |program| { id: program['programId'], name: program['name'], @@ -58,30 +60,22 @@ def directory_index end def program_scopes(program) - uri = ::URI.parse('https://api.intigriti.com/core/public/programs/' + encode(program[:company_handle]) + '/' + - encode(program[:handle])) - response = ::JSON.parse(SsrfFilter.get(uri).body) + document = ::Nokogiri::HTML(SsrfFilter.get(program[:url]).body) + in_scope = document.css('div.domain-container').map do |div| + { + type: div.css('.domainType').inner_text.strip.downcase, + endpoint: div.css('.reference').inner_text.strip, + description: div.css('.domain-description p').inner_text.strip, + impact: div.css('.impact').inner_text.strip + } + end { targets: { - in_scope: response['domains'].nil? ? [] : scopes_to_hashes(response['domains']), + in_scope: in_scope, out_of_scope: [] } } end - - def scopes_to_hashes(scopes) - latest_scope = scopes.max_by do |scope| - scope['createdAt'] - end - - latest_scope['content'].map do |content| - { - type: TYPES[content['type']], - endpoint: content['endpoint'], - description: content['description'] - } - end - end end end diff --git a/spec/bounty-targets/intigriti_spec.rb b/spec/bounty-targets/intigriti_spec.rb index d8181a8..47c9b4f 100644 --- a/spec/bounty-targets/intigriti_spec.rb +++ b/spec/bounty-targets/intigriti_spec.rb @@ -9,66 +9,103 @@ it 'fetches a list of programs' do programs = File.read('spec/fixtures/intigriti/programs.json') - stub_request(:get, %r{/core/public/program}).with(headers: {host: 'api.intigriti.com'}) + tag = '123' + stub_request(:get, %r{/programs}).with(headers: {host: 'www.intigriti.com'}) + .to_return(status: 200, body: "/_next/static/#{tag}/_buildManifest.js") + stub_request(:get, %r{/_next/data/#{tag}/en/programs.json}).with(headers: {host: 'www.intigriti.com'}) .to_return(status: 200, body: programs) expect(client.directory_index).to eq( [ { - id: '0d0034de-b53e-47b8-9a9d-41c302c49b5a', - name: 'Torfs', - company_handle: 'torfs', - handle: 'torfs', - confidentiality_level: 'public', - url: 'https://www.intigriti.com/programs/torfs/torfs/detail', + company_handle: 'doccle', + confidentiality_level: 'application', + handle: 'doccle', + id: '12715f4b-d10e-415f-a309-6ab042f6158a', status: 'open', - min_bounty: 0, - max_bounty: 5000 + url: 'https://www.intigriti.com/programs/doccle/doccle/detail', + max_bounty: {'currency' => 'EUR', 'value' => 2500}, + min_bounty: {'currency' => 'EUR', 'value' => 0}, + name: 'Doccle' }, { - id: '0d6d1230-beb5-489c-b306-cf9c2e06730f', - name: 'De Volkskrant', - company_handle: 'depersgroep', - handle: 'devolkskrant', - confidentiality_level: 'public', - url: 'https://www.intigriti.com/programs/depersgroep/devolkskrant/detail', - status: 'suspended', - min_bounty: 0, - max_bounty: 2000 + company_handle: 'bpost', + confidentiality_level: 'application', + handle: 'e-tracker', + id: 'a09e497e-fd75-4b56-afa0-7a6689389b76', + max_bounty: {'currency' => 'EUR', 'value' => 0}, + min_bounty: {'currency' => 'EUR', 'value' => 0}, + name: 'e-tracker', + status: 'open', + url: 'https://www.intigriti.com/programs/bpost/e-tracker/detail' } ] ) end it 'fetches program scopes' do - scopes = File.read('spec/fixtures/intigriti/scopes.json') - stub_request(:get, %r{/core/public/programs/vasco/vascomobileproducts}) - .with(headers: {host: 'api.intigriti.com'}).to_return(status: 200, body: scopes) - expect(client.program_scopes(company_handle: 'vasco', handle: 'vascomobileproducts')).to eq( - targets: { - in_scope: [ - { - description: 'DIGIPASS for Mobile app', - endpoint: '559799930', - type: 'ios' - }, - { - description: 'DIGIPASS for Mobile app', - endpoint: 'com.DIGIPASS_DEMO_ANDROID', - type: 'android' - }, - { - description: 'The DIGIPASS App', - endpoint: 'com.vasco.digipass.es', - type: 'android' - }, - { - description: 'The DIGIPASS App', - endpoint: 'the-digipass-app/id1172835583', - type: 'ios' - } - ], - out_of_scope: [] - } - ) + scopes = File.read('spec/fixtures/intigriti/scopes.html') + stub_request(:get, %r{/programs/Uphold/upholdcom/detail}) + .with(headers: {host: 'app.intigriti.com'}).to_return(status: 200, body: scopes) + expect(client.program_scopes(url: 'https://app.intigriti.com/programs/Uphold/upholdcom/detail')).to eq( + targets: { + in_scope: [ + { + description: 'iOS application. This is currently installable on Jailbroken devices, ' \ + 'please read the out-of-scope findings.', + endpoint: '1101145849', + impact: 'Tier 1', + type: 'ios' + }, + { + description: 'Production WebWallet Application. Do not test service degradation attacks ' \ + 'or horizontal privilege here.On the business app side, we allow you to create ' \ + "apps in sandbox, but you shouldn't be able to create them in Production.", + endpoint: 'api.uphold.com', + impact: 'Tier 1', + type: 'url' + }, + { + description: 'Android application. This is currently installable on Jailbroken devices, please ' \ + 'read the out-of-scope findings.', + endpoint: 'com.uphold.wallet', + impact: 'Tier 1', + type: 'android' + }, + { + description: 'Production WebWallet Application. Do not test service degradation ' \ + 'attacks or horizontal privilege here.', + endpoint: 'uphold.com/dashboard', + impact: 'Tier 1', + type: 'url' + }, + { + description: 'Use this environment for financial transaction testing, degradation attacks, ' \ + 'or horizontal privilege attacks. Fund with Crypto Testnet Faucet (e.g. ' \ + 'https://coinfaucet.eu/en/btc-testnet/ for Bitcoin).On the business app side, we ' \ + "allow you to create apps in sandbox, but you shouldn't be able to create them in Production.", + endpoint: 'api-sandbox.uphold.com', + impact: 'Tier 2', + type: 'url' + }, + { + description: 'Use this environment for financial transaction testing, degradation attacks, ' \ + 'or horizontal privilege attacks. Fund with Crypto Testnet Faucet (e.g. ' \ + 'https://coinfaucet.eu/en/btc-testnet/ for Bitcoin)', + endpoint: 'sandbox.uphold.com/dashboard', + impact: 'Tier 2', + type: 'url' + }, + { + description: 'We are willing to give bonuses on anything you find and we agree is impactful, ' \ + 'in the rest of our domain. Please note that third party services are out of scope ' \ + 'unless the issue is caused due to a misconfiguration by Uphold', + endpoint: '*.uphold.com', + impact: 'Tier 3', + type: 'url' + } + ], + out_of_scope: [] + } + ) end end diff --git a/spec/fixtures/intigriti/programs.json b/spec/fixtures/intigriti/programs.json index 6e5ce46..353ed2f 100644 --- a/spec/fixtures/intigriti/programs.json +++ b/spec/fixtures/intigriti/programs.json @@ -1,36 +1,65 @@ -[ - { - "programId": "0d0034de-b53e-47b8-9a9d-41c302c49b5a", - "status": 3, - "confidentialityLevel": 4, - "companyHandle": "torfs", - "companyName": "Torfs", - "companySustainable": false, - "handle": "torfs", - "name": "Torfs", - "description": "Torfs - the well-known shoe retailer in Belgium - is still a 100% family business today. This family character guarantees a number of important values within the company where employees are central. A head office in Sint-Niklaas and a spectacular distribution center in Temse offer support to the points of sale and customers of the E-Commerce website. With more than 80 stores in Flanders, 2 shops in the French part of Belgium and a growing online shop in Belgium, The Netherlands and several marketplaces, Torfs wants to be and remain the most customer-friendly optichannel shoe store chain.", - "minBounty": 0, - "maxBounty": 5000, - "lastUpdatedAt": 1592386899, - "lastSubmissionAt": 1595707171, - "logoId": "public_bucket_d4aeeaf1-2da5-468f-8a6f-aad1c2cc118c-d392363b-2601-4396-961f-1397c6a92c4a", - "tacRequired": false +{ + "pageProps": { + "seoTags": [ + ], + "title": [ + ], + "programs": [ + { + "programId": "12715f4b-d10e-415f-a309-6ab042f6158a", + "status": 3, + "confidentialityLevel": 2, + "companyHandle": "doccle", + "companyName": "Doccle", + "tacRequired": false, + "companySustainable": true, + "handle": "doccle", + "name": "Doccle", + "description": "Doccle, founded in 2014, is a Belgian company that hosts an online platform where you can receive, pay, share and store your administration in one place. You can add several suppliers to your Doccle account in a few mouse clicks. This way, you will receive all documents in one place. You can also pay, sign or share them via Doccle. All your documents are securely stored in your digital archive. The more companies you add, the more documents you will receive.", + "minBounty": { + "value": 0, + "currency": "EUR" + }, + "maxBounty": { + "value": 2500, + "currency": "EUR" + }, + "lastUpdatedAt": 1696411233, + "lastSubmissionAt": 1698666466, + "logoId": "public_bucket_a4befc61-5a0f-4ce1-b384-b9e34162fe51-e0f59d31-cc85-4c48-9415-0fcba05d5df1" + }, + { + "programId": "a09e497e-fd75-4b56-afa0-7a6689389b76", + "status": 3, + "confidentialityLevel": 2, + "companyHandle": "bpost", + "companyName": "bpost", + "tacRequired": false, + "companySustainable": false, + "handle": "e-tracker", + "name": "e-tracker", + "description": "This is an application which is accessed by bpost contractual customers like Amazon, zalando who can login and track the parcels history which was announced by them to bpost for handling.\nOnly the specific logged in senders can view thier own parcel status, not cross sender accounts.", + "minBounty": { + "value": 0, + "currency": "EUR" + }, + "maxBounty": { + "value": 0, + "currency": "EUR" + }, + "lastUpdatedAt": 1698408862, + "lastSubmissionAt": 1698569947, + "logoId": "public_bucket_e4f07036-ac87-4d12-b2fa-1b9aedbcfdef-60f29988-357a-4343-a7ac-462b167d3a5d" + } + ], + "dehydratedState": { + "mutations": [ + + ], + "queries": [ + + ] + } }, - { - "programId": "0d6d1230-beb5-489c-b306-cf9c2e06730f", - "status": 4, - "confidentialityLevel": 4, - "companyHandle": "depersgroep", - "companyName": "DPG Media", - "companySustainable": false, - "handle": "devolkskrant", - "name": "De Volkskrant", - "description": "De Volkskrant is a Dutch daily morning newspaper. Founded in 1919, it has a nationwide circulation of about 250,000 papers per day.", - "minBounty": 0, - "maxBounty": 2000, - "lastUpdatedAt": 1595768763, - "lastSubmissionAt": 1595768761, - "logoId": "public_bucket_3af586cd-c27b-4732-8f58-b335e49985c3-31b5959b-3df0-44cd-ba3f-00a68ad16aaa", - "tacRequired": false - } -] + "__N_SSG": true +} \ No newline at end of file diff --git a/spec/fixtures/intigriti/scopes.html b/spec/fixtures/intigriti/scopes.html new file mode 100644 index 0000000..9d49af4 --- /dev/null +++ b/spec/fixtures/intigriti/scopes.html @@ -0,0 +1,184 @@ + + Uphold.com - Bug Bounty Program - Intigriti + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Request demo
Uphold.com/Uphold.com/Detail
Detail Updates Leaderboard
Description

At Uphold, we make it easy to buy and sell any major digital currency. You can invest, transfer or send/receive between many cryptocurrencies, traditional currencies and precious metals. Our digital money app is slick, easy, and secure.

Bounties
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 9.4
Exceptional
9.5 - 10.0
Tier 1
€
50
650
1,100
3,000
4,000
Tier 1
€50 - €4,000
Tier 2
€
25
150
500
1,000
2,500
Tier 2
€25 - €2,500
Tier 3
€
0
0
250
500
1,000
Tier 3
Up to €1,000
Rules of engagement
Required
Not applicable
max. 5 requests/sec
Not applicable

Our promise to you

+
    +
  • We are happy to respond to any questions, please use the button in the right top corner for this.
    • +
  • We respect the safe harbour clause that you can find below
    • +
+

Your promise to us

+
    +
  • Provide detailed but to-the point reproduction steps
    • +
  • Include a clear attack scenario. How will this affect us exactly?
    • +
  • Remember: quality over quantity!
    • +
  • Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
    • +
  • Please do not use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉)
    • +
+
Domains
tier
All
type
All
1101145849
Tier 1
iOS

iOS application. This is currently installable on Jailbroken devices, please read the out-of-scope findings.

+

api.uphold.com

Tier 1
URL

Production WebWallet Application. Do not test service degradation attacks or horizontal privilege here.

+

On the business app side, we allow you to create apps in sandbox, but you shouldn't be able to create them in Production.

+
com.uphold.wallet
Tier 1
Android

Android application. This is currently installable on Jailbroken devices, please read the out-of-scope findings.

+

uphold.com/dashboard

Tier 1
URL

Production WebWallet Application. Do not test service degradation attacks or horizontal privilege here.

+

api-sandbox.uphold.com

Tier 2
URL

Use this environment for financial transaction testing, degradation attacks, or horizontal privilege attacks. Fund with Crypto Testnet Faucet (e.g. https://coinfaucet.eu/en/btc-testnet/ for Bitcoin).

+

On the business app side, we allow you to create apps in sandbox, but you shouldn't be able to create them in Production.

+

sandbox.uphold.com/dashboard

Tier 2
URL

Use this environment for financial transaction testing, degradation attacks, or horizontal privilege attacks. Fund with Crypto Testnet Faucet (e.g. https://coinfaucet.eu/en/btc-testnet/ for Bitcoin)

+

*.uphold.com

Tier 3
URL

We are willing to give bonuses on anything you find and we agree is impactful, in the rest of our domain. Please note that third party services are out of scope unless the issue is caused due to a misconfiguration by Uphold

+
In scope

IMPORTANT: Please only perform service degradation attacks or horizontal privilege attacks on the Sandbox URL's

+

We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed!

+

We are specifically looking for;

+
    +

  • Leaking of large quantities of personal data, if you can find a way to expose bulk quantities of data, we want to know about it.

    +
    • +

  • Horizontal privilege escalation i.e breaking into someone elses wallet. This should only be attempted in the Sandbox environment.

    +
      +
    • This includes being able to see another users details; transactions, balances and the like.
      • +
    +
    • +

  • Specifically related to our trading business, we want to know if you're able to "create money", duplicate transactions or receive more funds into your wallet than are transferred. Any kind of issue which would negatively affect the balance sheet.

    +
    • +

  • For the "Uphold Card" functionality, being able to see the 16 digit card number or PIN for another user is a big one.

    +
    • +
+
Out of scope
    +
  • Third party services are out of scope unless the issue is caused due to a misconfiguration by Uphold
    • +
+

Application

+
    +
  • Wordpress usernames disclosure
    • +
  • Pre-Auth Account takeover/OAuth squatting
    • +
  • Self-XSS that cannot be used to exploit other users
    • +
  • Verbose messages/files/directory listings without disclosing any sensitive information
    • +
  • CORS misconfiguration on non-sensitive endpoints
    • +
  • Missing cookie flags
    • +
  • Missing security headers
    • +
  • Cross-site Request Forgery with no or low impact
    • +
  • Presence of autocomplete attribute on web forms
    • +
  • Reverse tabnabbing
    • +
  • Bypassing rate-limits or the non-existence of rate-limits.
    • +
  • Best practices violations (password complexity, expiration, re-use, etc.)
    • +
  • Clickjacking without proven impact/unrealistic user interaction
    • +
  • CSV Injection
    • +
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
    • +
  • Tokens leaked to third parties
    • +
  • Anything related to email spoofing, SPF, DMARC or DKIM
    • +
  • Content injection without being able to modify the HTML
    • +
  • Username/email enumeration
    • +
  • Email bombing
    • +
  • HTTP Request smuggling without any proven impact
    • +
  • Homograph attacks
    • +
  • XMLRPC enabled
    • +
  • Banner grabbing/Version disclosure
    • +
  • Not stripping metadata of files
    • +
  • Same-site scripting
    • +
  • Subdomain takeover without taking over the subdomain
    • +
  • Arbitrary file upload without proof of the existence of the uploaded file
    • +
  • Blind SSRF without proven business impact (pingbacks are not sufficient)
    • +
  • Disclosed/misconfigured Google Maps API keys
    • +
  • Host header injection without proven business impact
    • +
  • Creating apps in Sandbox is allowed (so if you find you can in Production, it's an issue, but not in Sandbox)
    • +
+

General

+
    +
  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
    • +
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
    • +
  • Spam, social engineering and physical intrusion
    • +
  • DoS/DDoS attacks or brute force attacks
    • +
  • Vulnerabilities that only work on software that no longer receive security updates
    • +
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
    • +
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
    • +
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
    • +
+

AWS Specific

+
    +
  • Publically readable S3 buckets. We have a selection of our S3 buckets available to the Internet as caches for our website and other public resources - UNLESS it is clear that the information should not be public, i.e. personal data, company confidential files and such. Please log a ticket if you're not sure with examples of the folder structure (do not download the data)
    • +
+

Mobile

+
    +
  • Shared links leaked through the system clipboard
    • +
  • Any URIs leaked because a malicious app has permission to view URIs opened
    • +
  • The absence of certificate pinning
    • +
  • Sensitive data in URLs/request bodies when protected by TLS
    • +
  • Lack of obfuscation
    • +
  • Path disclosure in the binary
    • +
  • Self-XSS that cannot be used to exploit other users
    • +
  • Lack of jailbreak & root detection
    • +
  • Crashes due to malformed URL Schemes
    • +
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
    • +
  • Snapshot/Pasteboard leakage
    • +
  • Exploits only possible in a jailbroken environment
    • +
  • API key leakage used for insensitive activities/actions
    • +
  • Attacks requiring physical access to the victim's device
    • +
  • Attacks requiring installing malicious applications onto the victim's device
    • +
  • Attacks using OS vulnerabilities, for instance an attack using a vulnerability on a specific android / iOS version
    • +
+
Severity assessment

This program follows Intigriti's contextual CVSS standard

+
FAQ

Where can we get credentials for the app?

+

You can self-register on the application but please don’t forget to use your @intigriti.me address.

+

How can I test with funds?

+

On the Sandbox, it's connected to crypto TestNets, so you can print as much money as you need, to test the platform!

+
All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Researchers
last contributors
logo
thee_eclipse
logo
efetimi
logo
messi69
logo
nego7
logo
justcacheme
logo
ahmedmuhammad125
leaderboard
logo
thisguyoverhere
logo
robin
logo
nullsecure
logo
dir
logo
parshwa_2108
logo
ji0w
Last 90 day response times
avg. time first response
< 3 days
avg. time to decide
< 1 week
avg. time to triage
< 3 days
Activity
10/9
Uphold.com
closed a submission
10/6
logo
thee_eclipse
created a submission
9/29
Uphold.com
closed a submission
9/29
Uphold.com
accepted a submission
9/23
logo
efetimi
created a submission
8/10
Uphold.com
closed a submission
8/10
logo
messi69
created a submission
8/4
Uphold.com
closed a submission
8/2
logo
dir
created a submission
8/1
Uphold.com
closed a submission
 + + + \ No newline at end of file diff --git a/spec/fixtures/intigriti/scopes.json b/spec/fixtures/intigriti/scopes.json deleted file mode 100644 index dfb0ab9..0000000 --- a/spec/fixtures/intigriti/scopes.json +++ /dev/null @@ -1,592 +0,0 @@ -{ - "programId": "12d99ae0-7d24-49d0-a185-6292a922be10", - "status": 4, - "confidentialityLevel": 4, - "companyHandle": "vasco", - "companyName": "OneSpan", - "handle": "vascomobileproducts", - "name": "OneSpan Mobile", - "description": "OneSpan (formerly known as VASCO Data Security) is a global leader in digital security with two-factor authentication, transaction data signing, document e-signature and identity management solutions designed for financial institutions, enterprises, healthcare institutions as well as government agencies.\n\nIn this project, we request researchers to validate the security of two mobile authentication products (soft tokens), namely DIGIPASS for Mobile and the DIGIPASS App.", - "domains": [ - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "k", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DPMOBESA", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "DIGIPASS" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "DIGIPASS" - } - ], - "createdAt": 1572992453 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DPMOBESA", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "DIGIPASS" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "DIGIPASS" - } - ], - "createdAt": 1573072191 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "DIGIPASS" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "DIGIPASS" - } - ], - "createdAt": 1580823447 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "DIGIPASS" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "DIGIPASS" - } - ], - "createdAt": 1580823469 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "The DIGIPASS App" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "DIGIPASS" - } - ], - "createdAt": 1580823485 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS FOR MOBILE (DP4MOBILE)" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "The DIGIPASS App" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "The DIGIPASS App" - } - ], - "createdAt": 1580823505 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "541882261", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "The DIGIPASS App" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "The DIGIPASS App" - } - ], - "createdAt": 1580823516 - }, - { - "content": [ - { - "id": "f9357f79-3eb4-402c-827f-15abc094423a", - "type": 3, - "endpoint": "559799930", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "40217af8-8ba5-4939-8b79-74e667bfca1b", - "type": 2, - "endpoint": "com.DIGIPASS_DEMO_ANDROID", - "businessImpact": 3, - "description": "DIGIPASS for Mobile app" - }, - { - "id": "74e22393-f82a-4d31-be49-4cbc406fe131", - "type": 2, - "endpoint": "com.vasco.digipass.es", - "businessImpact": 3, - "description": "The DIGIPASS App" - }, - { - "id": "b49e935b-f8c2-4d4f-a012-51090b6279d0", - "type": 3, - "endpoint": "the-digipass-app/id1172835583", - "businessImpact": 3, - "description": "The DIGIPASS App" - } - ], - "createdAt": 1580823694 - } - ], - "inScopes": [ - { - "content": "The scope of this project is limited to following mobile apps:\n# \tDIGIPASS for Mobile app\n**Application entry points: the apps are available at:**\n* iOS: see [Apple app store](https://itunes.apple.com/us/app/onboard/id559799930)\n*\tAndroid: see [Google Play store](https://play.google.com/store/apps/details?id=com.DIGIPASS_DEMO_ANDROID)\n\n**Accounts: researchers can activate these apps as follows:**\n1.\t(On a mobile device) Install the app\n2.\t(On a PC) Go to http://dp4mobile.demo.vasco.com/dp4mobile/index.jsp\n3.\t(On a PC) Enter email address and click \"Sign up\"\n4.\t(In the app) Click \"Activate your DIGIPASS\"\n5.\t(In the app) Scan the color QR Code displayed on the screen\n6.\t(On a PC) Click \"Start using your DIGIPASS for Mobile\"\n\n**Using the app:**\n\nResearchers can test the functionality of the app at http://dp4mobile.demo.vasco.com/dp4mobile.\n\n# The DIGIPASS App\n**Application entry points: the apps are available at:**\n* iOS: see [Apple app store](https://itunes.apple.com/fr/app/the-digipass-app/id1172835583) \n* Android: see [Google Play Store](https://play.google.com/store/apps/details?id=com.vasco.digipass.es) \n\n**Accounts: researchers can activate these apps as follows:**\n1.\t(On a mobile device) Install the app\n2.\t(On a PC) Visit the Self-Managed website of IDENTIKEY Authentication Server (IAS) at https://ias.scc.labs.vasco.com:9443/selfmgmt/ and select the menu Activate, and then the menu item Activation Using Color QR Code.\n3.\t(On a PC) Provide the username and static password provided through the Intigriti platform, and click OK.\n4.\t(In the app) Scan the color QR code\n5.\t(In the app) Protect the app with a fingerprint or PIN\n6.\t(On a PC) Enter the device code\n7.\t(In the app) Scan the second color QR code\n8.\t(On a PC) Enter the signature\n9.\t(In the app) Confirm the successful activation\n\n**Using the app: researchers can test the functionality of the app as follows:**\n1.\t(On a PC) Visit the Self-Managed website of IDENTIKEY Authentication Server (IAS) at https://ias.scc.labs.vasco.com:9443/selfmgmt/ and select the menu Manage, and then the menu item Login Test.\n2.\t(On a mobile device) Launch the DIGIPASS App\n3.\t(On a PC) Provide the username as well as the one-time password generated by the DIGIPASS App\n", - "createdAt": 1506588503 - }, - { - "content": "The scope of this project is limited to following mobile apps:\n# \tDIGIPASS for Mobile app\n**Application entry points: the apps are available at:**\n* iOS: see [Apple app store](https://itunes.apple.com/us/app/onboard/id559799930)\n*\tAndroid: see [Google Play store](https://play.google.com/store/apps/details?id=com.DIGIPASS_DEMO_ANDROID)\n\n**Accounts: researchers can activate these apps as follows:**\n1.\t(On a mobile device) Install the app\n2.\t(On a PC) Go to http://dp4mobile.demo.vasco.com/dp4mobile/index.jsp. **This website is out of scope**!\n3.\t(On a PC) Enter email address and click \"Sign up\"\n4.\t(In the app) Click \"Activate your DIGIPASS\"\n5.\t(In the app) Scan the color QR Code displayed on the screen\n6.\t(On a PC) Click \"Start using your DIGIPASS for Mobile\"\n\n**Using the app:**\n\nResearchers can test the functionality of the app at http://dp4mobile.demo.vasco.com/dp4mobile. **This website is out of scope**!\n\n# The DIGIPASS App\n**Application entry points: the apps are available at:**\n* iOS: see [Apple app store](https://itunes.apple.com/fr/app/the-digipass-app/id1172835583) \n* Android: see [Google Play Store](https://play.google.com/store/apps/details?id=com.vasco.digipass.es) \n\n**Accounts: researchers can activate these apps as follows:**\n1.\t(On a mobile device) Install the app\n2.\t(On a PC) Visit the Self-Managed website of IDENTIKEY Authentication Server (IAS) at https://ias.scc.labs.vasco.com:9443/selfmgmt/ and select the menu Activate, and then the menu item Activation Using Color QR Code. **This website is out of scope**!\n3.\t(On a PC) Provide the username and static password provided through the Intigriti platform, and click OK.\n4.\t(In the app) Scan the color QR code\n5.\t(In the app) Protect the app with a fingerprint or PIN\n6.\t(On a PC) Enter the device code\n7.\t(In the app) Scan the second color QR code\n8.\t(On a PC) Enter the signature\n9.\t(In the app) Confirm the successful activation\n\n**Using the app: researchers can test the functionality of the app as follows:**\n1.\t(On a PC) Visit the Self-Managed website of IDENTIKEY Authentication Server (IAS) at https://ias.scc.labs.vasco.com:9443/selfmgmt/ and select the menu Manage, and then the menu item Login Test. **This website is out of scope**!\n2.\t(On a mobile device) Launch the DIGIPASS App\n3.\t(On a PC) Provide the username as well as the one-time password generated by the DIGIPASS App\n", - "createdAt": 1506948102 - } - ], - "outScopes": [ - { - "content": "**Please note that all products, websites, IT systems of VASCO Data Security are out of scope except the ones mentioned in the “in scope” section.**\n\n**The scope of this project is limited to the mobile apps themselves. The back-end systems which the apps communicate with are NOT in scope.**\n\nYou will not receive a reward and your submission will be rejected if they are out of scope or if they are one of the following:\n\n# General\n*\tViolations against best practices that only have a theoretical chance of exploitation\n*\tHighly speculative reports about theoretical damage. Be concrete.\n*\tReports that state that software is out of date/vulnerable without proven exploitable risks\n*\tVulnerabilities as reported by automated tools without additional analysis as to how they're an issue\n*\tPhysical or social engineering attempts (this includes phishing attacks against employees)\n\n# Application\n*\tDebug information\n*\tiOS automated screen snapshot creation\n*\tbeing able to execute any of the known “weaknesses of mobile apps”, for example:\n * being able to take screenshots (unless the app has active screenshot prevention)\n * being able to reverse engineer the app\n * being able to run the app on a rooted/jailbroken device (unless the app is protected with root/jailbreak detection features)\n\n# Application business logic\n*\tFindings related to SSL/TLS configurations and certificates used by the app.\n* Findings related to weak passwords\n*\tFor apps not protected with RASP: cloning or replicating the app from one device to another\n*\tUsage of outdated libraries in the apps\n", - "createdAt": 1506588503 - }, - { - "content": "**Please note that all products, websites, IT systems of OneSpan are out of scope except the ones mentioned in the “in scope” section.**\n\n**The scope of this project is limited to the mobile apps themselves. The back-end systems which the apps communicate with are NOT in scope.**\n\nYou will not receive a reward and your submission will be rejected if they are out of scope or if they are one of the following:\n\n# General\n*\tViolations against best practices that only have a theoretical chance of exploitation\n*\tHighly speculative reports about theoretical damage. Be concrete.\n*\tReports that state that software is out of date/vulnerable without proven exploitable risks\n*\tVulnerabilities as reported by automated tools without additional analysis as to how they're an issue\n*\tPhysical or social engineering attempts (this includes phishing attacks against employees)\n\n# Application\n*\tDebug information\n*\tiOS automated screen snapshot creation\n*\tbeing able to execute any of the known “weaknesses of mobile apps”, for example:\n * being able to take screenshots (unless the app has active screenshot prevention)\n * being able to reverse engineer the app\n * being able to run the app on a rooted/jailbroken device (unless the app is protected with root/jailbreak detection features)\n\n# Application business logic\n*\tFindings related to SSL/TLS configurations and certificates used by the app.\n* Findings related to weak passwords\n*\tFor apps not protected with RASP: cloning or replicating the app from one device to another\n*\tUsage of outdated libraries in the apps\n", - "createdAt": 1528104138 - } - ], - "faqs": [ - { - "content": "** Can we receive test accounts?**\n\nPlease review the above information regarding the activation of the apps. Intigriti will provide you with the credentials required to activate the DIGIPASS App.\n", - "createdAt": 1506588503 - }, - { - "content": "#### Can we receive test accounts?\n\nPlease review the above information regarding the activation of the apps. Intigriti will provide you with the credentials required to activate the DIGIPASS App.\n", - "createdAt": 1573072812 - } - ], - "severityAssessments": [ - { - "content": "It will be the responsibility of Intigriti to pay ethical hackers in a timely and legal way. Payouts will only take place after agreement with VASCO on the severity of the impact and only if the submission was the first of its kind and agreed to be valid.\n\nDuplicates policy: When two identical issues are reported, with different endpoints being the only difference between submissions, only the first submission will have the severity below assigned.\nIf similar reports by the same user are reported within 14 days after accepting the previous (only differentiating in endpoint), the reports will be accepted but in a lower severity, hence affecting the bounty.\nVASCO provides following monetary rewards in addition, researchers will be listed in VASCO’s Hall of Fame, if they agree so.\n\n**Exceptional: € 4.000 **- examples:\n*\tFor apps protected using RASP (DIGIPASS for Mobile):\n * Recovering cleartext DIGIPASS secrets used to generate one-time passwords.\n * Bypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Critical: € 1.500** - examples:\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): \n *\tBypassing the repackaging detection feature of RASP\n\n**High: € 750** - examples:\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): bypassing following RASP security features:\n * Screenshot and screenreader prevention\n * Debugger prevention\n *\tDetection of library injection\n * Emulator detection\n * Native code hook detection\n\n*\tFor apps not protected using RASP (DIGIPASS App):\n *\tRecovering the cryptographic key used to encrypt DIGIPASS secrets\n *\tRecovering cleartext DIGIPASS secrets used to generate one-time passwords.\n *\tBypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Medium: € 500 **– examples:\n*\tFor apps protected using RASP (DIGIPASS for Mobile) detection: \n * Bypassing the root or jailbreak detection capabilities of the app\n *\tBypassing the hooking framework detection\n *\tApp cloning: copying the app from one device to another, and using the app on the latter device to generate a valid one-time password\n*\tFor apps not protected using RASP (DIGIPASS App)\n *\tInsecure usage of Android keystore or iOS keychain\n *\tInsecure usage of TouchID or other fingerprint scanners\n *\tInsecure random number generation\n\n**Low **– examples:\n* Leakage of sensitive information from the binary of the app\n\n\n", - "createdAt": 1506588503 - }, - { - "content": "It will be the responsibility of Intigriti to pay ethical hackers in a timely and legal way. Payouts will only take place after agreement with OneSpan on the severity of the impact and only if the submission was the first of its kind and agreed to be valid.\n\nDuplicates policy: When two identical issues are reported, with different endpoints being the only difference between submissions, only the first submission will have the severity below assigned.\nIf similar reports by the same user are reported within 14 days after accepting the previous (only differentiating in endpoint), the reports will be accepted but in a lower severity, hence affecting the bounty.\nOneSpan provides following monetary rewards in addition, researchers will be listed in VASCO’s Hall of Fame, if they agree so.\n\n**Exceptional: € 4.000 **- examples:\n*\tFor apps protected using RASP (DIGIPASS for Mobile):\n * Recovering cleartext DIGIPASS secrets used to generate one-time passwords.\n * Bypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Critical: € 1.500** - examples:\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): \n *\tBypassing the repackaging detection feature of RASP\n\n**High: € 750** - examples:\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): bypassing following RASP security features:\n * Screenshot and screenreader prevention\n * Debugger prevention\n *\tDetection of library injection\n * Emulator detection\n * Native code hook detection\n\n*\tFor apps not protected using RASP (DIGIPASS App):\n *\tRecovering the cryptographic key used to encrypt DIGIPASS secrets\n *\tRecovering cleartext DIGIPASS secrets used to generate one-time passwords.\n *\tBypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Medium: € 500 **– examples:\n*\tFor apps protected using RASP (DIGIPASS for Mobile) detection: \n * Bypassing the root or jailbreak detection capabilities of the app\n *\tBypassing the hooking framework detection\n *\tApp cloning: copying the app from one device to another, and using the app on the latter device to generate a valid one-time password\n*\tFor apps not protected using RASP (DIGIPASS App)\n *\tInsecure usage of Android keystore or iOS keychain\n *\tInsecure usage of TouchID or other fingerprint scanners\n *\tInsecure random number generation\n\n**Low **– examples:\n* Leakage of sensitive information from the binary of the app\n\n\n", - "createdAt": 1528104163 - }, - { - "content": "It will be the responsibility of Intigriti to pay ethical hackers in a timely and legal way. Payouts will only take place after agreement with OneSpan on the severity of the impact and only if the submission was the first of its kind and agreed to be valid.\n\nDuplicates policy: When two identical issues are reported, with different endpoints being the only difference between submissions, only the first submission will have the severity below assigned.\nIf similar reports by the same user are reported within 14 days after accepting the previous (only differentiating in endpoint), the reports will be accepted but in a lower severity, hence affecting the bounty.\nOneSpan provides following monetary rewards in addition, researchers will be listed in VASCO’s Hall of Fame, if they agree so.\n\n**Exceptional: € 4.000**:\n*\tFor apps protected using RASP (DIGIPASS for Mobile):\n * Recovering cleartext DIGIPASS secrets used to generate one-time passwords.\n * Bypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Critical: € 1.500** :\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): \n *\tBypassing the repackaging detection feature of RASP\n\n**High: € 750**:\n\n*\tFor apps protected using RASP (DIGIPASS for Mobile): bypassing following RASP security features:\n * Screenshot and screenreader prevention\n * Debugger prevention\n *\tDetection of library injection\n * Emulator detection\n * Native code hook detection\n\n*\tFor apps not protected using RASP (DIGIPASS App):\n *\tRecovering the cryptographic key used to encrypt DIGIPASS secrets\n *\tRecovering cleartext DIGIPASS secrets used to generate one-time passwords.\n *\tBypassing the app’s user authentication mechanism (e.g. PIN, fingerprint). This means being able to generate an authentication token that is accepted by the backend without providing the user credentials (e.g. PIN, fingerprint).\n\n**Medium: € 500**:\n*\tFor apps protected using RASP (DIGIPASS for Mobile) detection: \n * Bypassing the root or jailbreak detection capabilities of the app\n *\tBypassing the hooking framework detection\n *\tApp cloning: copying the app from one device to another, and using the app on the latter device to generate a valid one-time password\n*\tFor apps not protected using RASP (DIGIPASS App)\n *\tInsecure usage of Android keystore or iOS keychain\n *\tInsecure usage of TouchID or other fingerprint scanners\n *\tInsecure random number generation\n\n**Low**:\n* Leakage of sensitive information from the binary of the app\n\n\n", - "createdAt": 1573072794 - } - ], - "rulesOfEngagements": [ - { - "description": "# Guidelines\n*\tProvide detailed but to-the point reproduction steps\n*\tInclude a clear attack scenario, a step by step guide in the PoC is highly appreciated\n*\tRemember: quality over quantity!\n*\tProvide details on the timestamp when you conducted the test and about the username that you used to conduct the test.\n\n# Response timeframe\n* We will respond to reports within 5 days.\n\n# Application availability\n* The IAS server will automatically reboot each day at 0:00 CET.\n* The IAS server might automatically reboot after the installation of updates (typically around 3:00 CET)\n", - "safeHarbour": true, - "createdAt": 1506588503 - }, - { - "description": "# Guidelines\n*\tProvide detailed but to-the point reproduction steps\n*\tInclude a clear attack scenario, a step by step guide in the PoC is highly appreciated\n*\tRemember: quality over quantity!\n*\tProvide details on the timestamp when you conducted the test and about the username that you used to conduct the test.\n\n# Application availability\n* The IAS server will automatically reboot each day at 0:00 CET.\n* The IAS server might automatically reboot after the installation of updates (typically around 3:00 CET)\n", - "safeHarbour": true, - "createdAt": 1559901437 - } - ], - "bounties": [ - { - "maxBounty": 4500, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4500, - "businessImpact": 3 - } - ], - "createdAt": 1505294991 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1506411069 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1506588503 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1573072191 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823447 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823469 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823485 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823505 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823516 - }, - { - "maxBounty": 4000, - "criticalityExponent": 1, - "bountyRows": [ - { - "multiplier": 1, - "low": 0, - "medium": 500, - "high": 750, - "critical": 1500, - "exceptional": 4000, - "businessImpact": 3 - } - ], - "createdAt": 1580823694 - } - ], - "lastContributors": [ - { - "avatarId": "public_bucket_0ba15b5f-9e34-4295-bdc2-94f246a52da7-97afabd3-25aa-4f4b-a295-c4c0c4ce74ee", - "userName": "kingamir" - }, - { - "avatarId": "public_bucket_a90600d3-05e6-4834-9df8-40fb394e1bfa-2ab2f48b-a6aa-4f76-8f2e-c1e8c4a59b91", - "userName": "d_roanze" - }, - { - "avatarId": null, - "userName": "meimoon" - }, - { - "avatarId": "public_bucket_cdf7ff24-7c61-437b-a7a9-69fe517e0f71-e4128a29-2586-45c3-86e7-e5bce852a581", - "userName": "dauntless" - }, - { - "avatarId": "public_bucket_7b839c5c-a9d2-4ccf-a575-c2a834ec7ebc-83a35152-fc01-40d2-aa6d-23761930f22d", - "userName": "pieter" - } - ], - "lastActivity": [ - { - "timestamp": 1580947775, - "type": 11, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580918150, - "type": 11, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580907626, - "type": 9, - "name": "kingamir", - "logoId": "public_bucket_0ba15b5f-9e34-4295-bdc2-94f246a52da7-97afabd3-25aa-4f4b-a295-c4c0c4ce74ee" - }, - { - "timestamp": 1580907626, - "type": 13, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823694, - "type": 4, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823694, - "type": 5, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823516, - "type": 4, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823516, - "type": 5, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823505, - "type": 4, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - }, - { - "timestamp": 1580823505, - "type": 5, - "name": "OneSpan", - "logoId": "public_bucket_90f7e40c-0048-454b-9a0b-4db89fbe06dc-7d4c6164-4a29-4e95-8996-d6a80998d5a6" - } - ], - "averagePayout": 0, - "submissionCount": 0, - "acceptedSubmissionCount": 0, - "totalPayout": 0, - "identityCheckedRequired": false, - "awardRep": true, - "skipTriage": false, - "lastUpdatedAt": 1580907626, - "lastSubmissionAt": 1594106016, - "logoId": "public_bucket_6870a0a8-6fdd-49fb-8b4c-a0f75521863b-bedd0a24-80bb-4a3c-8065-c197c6dc51f8", - "external": { - "enabled": false, - "email": null - } -}