How best to report vulnerabilities? - page 3.

maydna

hero member

Activity: 2912

Merit: 556

Enterapp Pre-Sale Live - bit.ly/3UrMCWI

Quote from: btc78 on January 24, 2023, 03:45:14 AM

well Bug reporting does not mean we must be rewarded but for the team/casino side? giving at least generosity for people trying to help them out is better instead of just ignoring those people effort .
Bug is really something that must be addressed and even some big site are asking for bug bounty just to help them out.

I agree with this. At least we have tried to help them and pointed out a bug in their casino and hope they can fix it so that people do not abuse it. If the casino gives us a bounty, that's a good thing because it means they really appreciate our input and can fix bugs immediately too. But usually, if it's a big casino, they will give a reward to the person who found the bug to show gratitude.

serveria.com

legendary

Activity: 2422

Merit: 1191

Privacy Servers. Since 2009.

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

But since it is only certain games, from 1 provider, should I try to contact that provider instead? It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket. But I found it so strange that they immediately just alerted me that they have no bounty program. Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? Huh

Anyone else have any experiences of trying to report issues like this? I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

Dude, you created this forum user "owlbugreporter" with the only purpose of opening this thread? Just wow. Anyway, if you have reported this bug and their support said you're free to exploit it, so where is the issue? Just do what they said, that's not your problem anymore. It's a bit weird that they're letting you win more than you would normally without the bug. Perhaps they thought you're one of those scammers demanding bounty for fake exploit reports.

btc78

full member

Activity: 2520

Merit: 214

Eloncoin.org - Mars, here we come!

Quote from: Wapfika on January 21, 2023, 02:58:19 AM

Quote from: wxa7115 on January 20, 2023, 10:53:51 PM

Quote from: Nrcewker on January 20, 2023, 10:00:13 PM

You did your task mate. You didn’t exploit the bug, you reported it to the support team, so consider your work is done. If still now owlgames’s money gets drained out from their site, then they will be the only ones who will be responsible for this. Their immature behaviour and attitudes to such reports will surely land them into some trouble. I am really impressed by you OP that in this cruel world, where people are ready to do anything for making money, you thought about the site. Yes contacting the game service provider will be the ideal decision now.

This is what I think as well, I mean the OP found a bug and instead of keeping quiet about it and taking advantage of it they decided to alert the casino about the possible consequences of this bug for them.

But for some reason it seems the casino disregarded their report and at least for now it does not seem as if they will do anything to try to correct it, in my opinion the OP has already done enough and should not feel responsible at all if another gambler finds out the bug, takes advantage of it and the casino loses a huge amount of money as a result for their negligence.

The way I view the OP statement was he reported that there is a bug in the game to the support but he didn't explain the full details after the support tell him that there's no bug bounty program to reward him. I guess the bug is still not fixed since OP will not gonna think to report it on the game provider if he already told it to Owl and they just didn't take action on it. I mean he can simply abused it if Owl knew the existence of the bug and didn't solve it.

well Bug reporting does not mean we must be rewarded but for the team/casino side? giving at least generosity for people trying to help them out is better instead of just ignoring those people effort .
Bug is really something that must be addressed and even some big site are asking for bug bounty just to help them out.

Newlifebtc

member

Activity: 686

Merit: 21

Quote from: piebeyb on January 21, 2023, 02:14:21 AM

if there really is a bug in their game of course this should be a serious concern for them, but if indeed they feel it's not a bug I think you also need to provide complete evidence to give them confidence not just a screenshot or you can use it with another way to let them know, to my knowledge there aren't many casinos that provide bug bounties

I think that you are correct in this point you made but the problem is that I could not understand that the grammatical expression of your ear use of how much so please the next time I think you have to break it down for me to understand exactly what you mean at the last part of your sentence I am confused of the statement being casino provide a bug a bounty.

redsun114

hero member

Activity: 2730

Merit: 585

Leading Crypto Sports Betting & Casino Platform

Quote from: coin-investor on January 23, 2023, 10:10:14 AM

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

I am thinking that what if they truly take it seriously but they only reply like that (in a joking manner/tone) only to make it not obvious that they truly care because maybe they don't want to pay anything for that user who reported the bug.

They say enjoy the bug and then by the time the guy try it out again, he will only be shocked that the bug doesn't work anymore but I think he won't get angry because that was also what he wanted to happen. He is too kind. I hope others will be like him. If only all gamblers are like this then I don't think the casino will be tough in terms of their requirements because they know that none of the gamblers will abuse it.

Desmong

member

Activity: 812

Merit: 13

Crypto bookmaker and casino

Op should not bother himself on the issues since the casinos had clearly stated that they do not have any bug bounty current so op should not feel like he want to show them what they are already aware of.
This might just be something they are aware of and they allow it to keep going because it won't have so much effect on there finance.

Jody.Drummer

hero member

Activity: 1708

Merit: 566

Leading Crypto Sports Betting & Casino Platform

Quote from: coin-investor on January 23, 2023, 10:10:14 AM

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

While people out there exploit casino vulnerabilities to their own advantage, Op is here to help keep this bug from leaking into the wrong hands. Instead of giving gifts but reciprocity which is not so good Op accept. Although vulnerability is one of the weaknesses of casinos, they should be grateful to whistleblowers and rewarded. So far, Op may need to enjoy the benefits that have been obtained, and as long as the casino doesn't give a positive response, the solution is to try to drain it. lol

bitbollo

legendary

Activity: 3276

Merit: 3537

Nec Recisa Recedit

It's the first time Roll Eyes

I've heard a casino say "take advantage of the bug".
maybe it's a "small" bug that can't have a big impact on their economy?

at this point it is certainly correct to talk to the provider of that specific game just to have a "clear conscience" and act honestly.
unfortunately there aren't many solutions in this case if they don't want to award the players and exploiting the bug I don't think is the correct solution (also because they may simply not pay you...)

BenCodie

legendary

Activity: 1666

Merit: 1037

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

But since it is only certain games, from 1 provider, should I try to contact that provider instead? It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket. But I found it so strange that they immediately just alerted me that they have no bounty program. Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? Huh

Anyone else have any experiences of trying to report issues like this? I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

You are probably one of the first people that a casino has turned around to and said "yes, enjoy the free winnings from a hole in our games!". Enjoy it! Win, withdraw, win, withdraw, until you can't no more. You do have their permission at the end of the day! I certainly wouldn't pass up the opportunity Cool

To answer your question though, the best way to report it is to record the anomaly and detail how exactly to replicate it. Then send it to the team, or as you said, to the game provider. Whichever is most applicable.

coin-investor

hero member

Activity: 2996

Merit: 598

Leading Crypto Sports Betting & Casino Platform

Quote from: AicecreaME on January 23, 2023, 09:33:42 AM

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

But since it is only certain games, from 1 provider, should I try to contact that provider instead? It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket. But I found it so strange that they immediately just alerted me that they have no bounty program. Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? Huh

Anyone else have any experiences of trying to report issues like this? I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

Either way that's a bad attitude they should at least acknowledge the report, even if they are not giving rewards at least they should be considerate enough to acknowledge, with that kind of answer they don't care because coming from their own mouth if this is true they will just not honor coming from bugs, the gambler is the one that will suffer because he thought his winning comes in playing fair, it turned out there is a bug, I want to see Owlgame answer into this allegation this is serious and gamblers will opted not to play in their platform.

TimeTeller

hero member

Activity: 2744

Merit: 588

Quote from: AicecreaME on January 23, 2023, 09:33:42 AM

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

I am thinking that they don't want to acknowledge but they are doing in the background to address the issue.
Yes, the OP can check if the bug is still not fix, either their team is not addressing it or they don't know how to address it.
If you have done your job of informing them and they just shrugged it off, it means, they should not blame anyone if another user found the bug and exploited it.
I believe, not all gambling sites have that kind of reaction towards a user who is reporting a bug, some will entertain your report and may possibly give you a reward or bonus though.

AicecreaME

sr. member

Activity: 2436

Merit: 455

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

But since it is only certain games, from 1 provider, should I try to contact that provider instead? It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket. But I found it so strange that they immediately just alerted me that they have no bounty program. Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? Huh

Anyone else have any experiences of trying to report issues like this? I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

If that's their response towards you, then they aren't open for feedback and are slacking off their jobs to maintain the casino abuse-free which is really a cause of concern since these abusive activities are prohibited in the first place. Why would they even say a statement of enjoying the bug, if really there is any instead of acknowledging their shortcomings and giving a reward? Perhaps they are just too complacent and too confident that it won't happen, or they just don't want to acknowledge your report because they have to give a reward, which they don't want to.

Check whether the casino still have this bug and if they do, they probably are just confident and slacking off maintaining the casino away from glitches. If it suddenly don't have it after you reported, then most probably they have taken an action about your concern but decided not to credit you for noticing which I believe is such a jerk move if ever it is the latter reason.

robelneo

legendary

Activity: 3416

Merit: 1225

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

Include the screenshot of the conversation if you still have it or you can retrieve it, they might accuse you of just making up a story.

They have an obligation to report a bug or entertain people that find a bug because this is a trap, in the end, Owlgame will ban people for exploiting a bug, and some players unknowingly play the game and win money, and because of the bug they cannot cashout what they've won and get a ban instead.
Owlgame should address this issue as it puts its reputation at risk.

ethereumhunter

hero member

Activity: 2912

Merit: 541

Leading Crypto Sports Betting & Casino Platform

Quote from: Odusko on January 22, 2023, 05:15:26 PM

Quote from: Saint-loup on January 22, 2023, 04:50:20 PM

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end.

I think ops will not want to mention the name since he is trying every possible efforts to get the game provider attention to fix the bug, I don't know why a casino should take such a report with laxity.
What if ops decide to keep it to himself and continue to exploit the loophole and take advantage of the bug to exploit and abuse the casino system?
That could lead to more severe outcomes for both casino and the player and possibly the player could walk away knowing already what is involved in exploiting such loopholes.

It's normal that @OP doesn't want to say the name of the game and which casino it's from because he doesn't seem to want people to know about it and then have them report it to the casino so those people will get the bounty for finding the bug. And if the @OP decides not to report it to the casino and instead uses the bug to its own advantage, the casino will find out sooner or later because the casino can see who has a winning streak or can win a lot. And if the casino suspects it, the casino can investigate it and if it finds that @OP has cheated, the casino will freeze his account and not allow @OP to play again. This will prevent @OP from being able to gamble at that casino again, even though he can still gamble at other casinos.

Odusko

hero member

Activity: 1008

Merit: 520

Leading Crypto Sports Betting & Casino Platform

Quote from: Saint-loup on January 22, 2023, 04:50:20 PM

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end.

I think ops will not want to mention the name since he is trying every possible efforts to get the game provider attention to fix the bug, I don't know why a casino should take such a report with laxity.
What if ops decide to keep it to himself and continue to exploit the loophole and take advantage of the bug to exploit and abuse the casino system?
That could lead to more severe outcomes for both casino and the player and possibly the player could walk away knowing already what is involved in exploiting such loopholes.

Saint-loup

legendary

Activity: 2604

Merit: 2353

Quote from: owlbugreporter on January 20, 2023, 09:08:01 PM

So I discovered a bug affecting a mode of play at OwlGames casinos that results in certain games rewarding more money than they should. I tried to report it to OwlGames but was told that they have no bug bounty program and to "enjoy the bug" (not kidding). (of course their docs say that any "exploit" can result in not being paid out, but it's not an exploit if it's simply how things run under the given conditions - not that that would stop them from screwing someone over I'm sure)

Their poor attitude certainly doesn't do much to make me want to help them out anymore although that was my intent.

But since it is only certain games, from 1 provider, should I try to contact that provider instead? It's possible I imagine that it's not just OwlGames that might possibly lose money to the issue, though I really don't know.

I guess since these are casinos, losing a couple hundred to a few players every few days that would otherwise not have won anything maybe is just a drop in the bucket. But I found it so strange that they immediately just alerted me that they have no bounty program. Aren't casinos supposed to be pretty protective of their money even if they have a ton of it? Huh

Anyone else have any experiences of trying to report issues like this? I want to be rewarded for my time verifying the issue without taking advantage of it and alerting someone about it, too, so I'm also just worried about giving the info out and having them come up with some excuse like "oh it just needed a restart it's fine now, that's not a bug."

Without saying which game it is and which provider it belongs to, could you explain what kind of loophole or bug it is precisely and how it works exactly? Are you sure you're not just encountering a long winning streak on this game. Because one time I got many wining rounds in a row, and I really though the game was bugged but unfortunately it didn't continue like that for long and I lose almost all the winnings I made at the end.

livingfree

hero member

Activity: 2884

Merit: 579

Hire Bitcointalk Camp. Manager @ r7promotions.com

You just did it responsibly when you've seen the bug. But maybe it was way of your approach or explanation so that's how they reacted. Thus, it's on their end that's not really interested on knowing that bug. I can think of any other reasons.

As they say, they've got no bounty for that and just made it look like that they're not interested on it but on the other hand, they've already taken note of the reported bug of yours and have it fixed already.

Did you check if it's already been fixed? If so, then the latter part is correct.

Kakmakr

legendary

Activity: 3542

Merit: 1965

Leading Crypto Sports Betting & Casino Platform

I found a bug in a game called, "Mount Magma" a while ago .... and I also had the same problem. The bug was in the Jackpot system and it caused unfair wins to people who managed to pick up on the exploit.

It was quite simple.... if you bet high amounts close to the time when the Jackpot paid every day.... you basically won the Jackpot every time. (The more you win.. the higher you could bet.. and other people could not match your bets)

https://clashofslots.com/slots/pushgaming/mount-magmas/

I reported it on this forum and someone saw this and they pulled the game for months until they brought it back many months after that... with the Jackpot feature disabled. Roll Eyes

mak013

hero member

Activity: 2548

Merit: 769

Quote from: Wiwo on January 21, 2023, 02:57:06 PM

Quote from: mak013 on January 21, 2023, 09:03:19 AM

I think that they will just fix the bug without any payouts. Or it would be an opportunity to ban winners for bug using. If the OP told what the bug he had find the best way is to fix dialog with support screenshot to have some proves if they fix it. Anyway you can`t get some bounty here, and i even can`t say that casino is cheating if they will fix bug. But it can`t increase my interest to this casino.

I was about to point ops in that direction also, the bug should be reported to support ASAP and if supported with the necessary evidence in a pictural manner it will help the support agent to accept and processe your request. The casino team may have reacted that way because of the fact that at the moment the team is not paying anyone for bug discovery bit in other to protect everyone from this mess, you should continue your contact with them and provide evidence as mentioned,

Even if they haven`t the bounty system, the OP ought to fix bug and the answer of the support. Such moments always must be fixed, because we often see that the support tell us one thing and after that tell us the other. If we fix all such moments nobody can ban for "bag using" if the support said that it is ok and you can use it.

xSkylarx

hero member

Activity: 2366

Merit: 594

There are only a few people that won't be exploiting the bugs like you and didn't take advantage of them, but for sure, if others see this, they will take that opportunity to get more money. I'm hoping you were the only one who was aware of it. Even if they don't have any rewards, bug bounty hunters will usually send an email to the support team with information and screenshots about the bug. As you have already informed them and have received not good feedback from their support, try emailing those to them. I think they need hard proof before they will act on this.

Topic: How best to report vulnerabilities? - page 3. (Read 659 times)