Skip to main content

HackerOne, Bountycraft, and Nullcon

  • March 13th , 2017

Around the world in seven days! My name’s Adam Bacchus, Chief Bounty Officer of HackerOne, and I’m here to tell you about the adventures I had in India this March presenting at Nullcon on “Bug Bounty Reports - How Do They Work?”.

What is Nullcon?

Nullcon, founded in 2010, is an annual security conference held in Goa, India to discuss and showcase the next-generation of security technology. Nullcon emerged out of “null,” the largest open security community in India, with over 8 chapters in major cities - Bangalore, Mumbai, Chennai, Pune, Hyderabad, Mysore, Trivandrum and Delhi.

Hanging out with Antriksh Shah, who helps organize and run Nullcon

 

I was invited to speak at the Bountycraft track at Nullcon on the topic of best practices in bug bounty reporting, and had the opportunity to see awesome bug bounty presentations delivered by the security teams of Facebook, Google, and Microsoft.

I had already written a blog on bug bounty reporting, which I expanded into a fully fleshed out talk. You can find the slides on slideshare, but if you want the full experience of the plethora of GIFs, I’d recommend the Google Slides version. A video of the preso should be coming soon!

Adam Ruddermann, Technical Program Manager, Facebook’s bug bounty team

 

Google and Microsoft Increase Bug Bounty Payouts

Google and Microsoft both gave awesome talks at Nullcon about their programs. Google shared some examples of cool bugs they’ve received through their Vulnerability Rewards Program, and announced they are upping the max bounty on remote code execution from $20,000 to a cool $31,337 (elite - get it?). Google also upped the max reward for “Unrestricted file system or database access” from $10,000 to $13,337.

Josh Armour, Technical Program Manager, Google’s Vulnerability Reward Program

 

Microsoft also announced that they will double bounties on Office 365 through May of 2017, and gave a talk on the intricacies of testing Azure from a bug bounty standpoint.

Akila Srinivasan, Security Program Manager, Microsoft Security Response Center

 

In addition having in-depth conversations with the security teams of these major companies on the future of bug bounties, I got the opportunity to get loads of face time with tons of hackers from the bug bounty community in India.

Based on HackerOne’s survey of 600+ hackers, we discovered that 20.7% of hackers surveyed were from India - this is the most of any country on our platform! I had a ton of fun meeting our hacker base in India.

Here’s a group shot of participants of the CTF put on at Bountycraft:

One hacker was such a big fan of HackerOne, he wrote it on his arm!

I got to meet up with Geekboy, currently the #3 hacker on HackerOne:

Geekboy introduced me to “feni,” a local Indian spirit made with cashews. The feni is mixed with a lemon-flavored soda called Limca - tasty stuff!

I also had a chance to be interviewed by Nullcon on the topics of information security and bug bounties:

Serious bizness

 

All in all, it was an awesome trip, and I’m incredibly thankful that I had the opportunity to have such a great experience with so many members of the bug bounty community. If you have any awesome Nullcon photos or stories to share, let me know!

@sushihack

Recent articles

Announcing The Largest DoD bug bounty challenge ever: Hack The Air Force

The Air Force is asking hackers to take their best shot following the success of Hack the Pentagon and Hack the…

Zero Daily Newsletter: Fun, yet informative, AppSec, bug bounty, and hacker news

Read the news every day, and check the usual websites? Want to get your industry news and have a little humor…

More Hardware, More Problems

Bounties are for hardware, too. Microwaves notwithstanding, there is an increasing amount of connected…