Security bounties | Bitcointalksearch.org

?

Activity: -

Merit: -

Regarding your question about the bug category, it seems like the focus is primarily on accessing sensitive user information without their interaction or consent. If any additional details about users are revealed in a similar manner—like viewing private messages or account settings—those would likely also fall under this category, especially if they compromise user privacy or security.

As for associating an email with a username, if you find a method that allows you to easily correlate the two without proper authorization, it's worth reporting. Even if it's not a direct breach of sensitive information like passwords or email addresses, it could still pose a risk to user privacy. It's always better to err on the side of caution and inform the relevant parties about potential vulnerabilities.

theymos

administrator

Activity: 5222

Merit: 13032

Quote from: krishnaverma on June 06, 2024, 08:20:09 AM

Also, associating email to username is not valid in any case at all ? If there is some easy way to associate email to username , should I report it or is it not considered valid in any case at all ?

That's not valid at all.

Quote from: krishnaverma on June 06, 2024, 08:20:09 AM

For bug of this category

If you can access any arbitrary user's email address (if set hidden), password hash, viewed-topics log, or IP log; without any interaction from the user, and without any secret data such as user passwords.

Will any other details related to users if revealed with the bug be considered in this category or is it limited to only the options mentioned above?

For other data, it will not be considered as part of that bounty, but I may award some amount, depending on the details.

krishnaverma

full member

Activity: 1442

Merit: 108

For bug of this category

If you can access any arbitrary user's email address (if set hidden), password hash, viewed-topics log, or IP log; without any interaction from the user, and without any secret data such as user passwords.

Will any other details related to users if revealed with the bug be considered in this category or is it limited to only the options mentioned above?

Also, associating email to username is not valid in any case at all ? If there is some easy way to associate email to username , should I report it or is it not considered valid in any case at all ?

SickDayIn

member

Activity: 210

Merit: 31

Quote from: theymos on April 08, 2024, 03:07:00 PM

A lot of people try to run "website security scanners", and then report the "bugs" that these software packages find. Please don't do that. These scanners only ever report little configuration things which some people consider less than ideal, like allowing certain TLS ciphers, or sending/not-sending certain HTTP headers, and stuff like that. It's not useful.

Thank for your answers to my questions. The intention isn't to simply run Burp Suite Active Scan++ and then send a list of boring TLS/SSL cipher and protocol recommendations. It's really only worth raising findings that have a material impact or risk. I will poke my nose around and see if I find anything.

theymos

administrator

Activity: 5222

Merit: 13032

Quote from: SickDayIn on April 03, 2024, 12:53:47 AM

1) Is it required to have a persistent custom HTTP header in all requests, e.g. "X-Bug-Bounty: {bitcointalk username}"?

No.

Quote from: SickDayIn on April 03, 2024, 12:53:47 AM

2) Is it acceptable to use newly created / generic sock puppet accounts for testing?

Yes.

Quote from: SickDayIn on April 03, 2024, 12:53:47 AM

3) Is the "The Glider" forum badge assigned in all cases where a vulnerability is disclosed and patched, or only when a payment bug bounty is provided? (I am curious if this badge will be given out for low to medium risk findings that are not eligible for a payment bounty, but could still be useful)

Probably only for the listed security bounties.

Quote from: SickDayIn on April 03, 2024, 12:53:47 AM

4) If my genuine IP or testing accounts are banned for suspicious use whilst performing bug bounty testing, will my normal BitcoinTalk account remain unaffected?

IPs are only banned for making too many requests, not for suspicious behavior. So just don't make more than one request per second.

A lot of people try to run "website security scanners", and then report the "bugs" that these software packages find. Please don't do that. These scanners only ever report little configuration things which some people consider less than ideal, like allowing certain TLS ciphers, or sending/not-sending certain HTTP headers, and stuff like that. It's not useful.

SickDayIn

member

Activity: 210

Merit: 31

I have a few questions related to performing security testing on this site, particularly as I don't want to get my current account banned by accident.

1) Is it required to have a persistent custom HTTP header in all requests, e.g. "X-Bug-Bounty: {bitcointalk username}"?
2) Is it acceptable to use newly created / generic sock puppet accounts for testing?
3) Is the "The Glider" forum badge assigned in all cases where a vulnerability is disclosed and patched, or only when a payment bug bounty is provided? (I am curious if this badge will be given out for low to medium risk findings that are not eligible for a payment bounty, but could still be useful)
4) If my genuine IP or testing accounts are banned for suspicious use whilst performing bug bounty testing, will my normal BitcoinTalk account remain unaffected?

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: n0nce on September 04, 2021, 05:45:11 PM

Or was SMF 1.1.19 modified in some way or another?

There are several features added to the SMF 1.1.19 codebase, and I don't believe the code for these features is public. Some of the modifications to SMF 1.1.19 may have been to close security holes/issues.

While following the terms in the OP (which primarily consist of the requirement that PenTesters not cause disruption to the forum, and not access 3rd party data, you can find security weaknesses in the forum software, and collect the respective bounties.

n0nce

hero member

Activity: 882

Merit: 5834

not your keys, not your coins!

I'm not sure how building forums with software like SMF works, but if BitcoinTalk is 'just' a specific configuration of SMF 1.1.19, are we essentially looking for bugs in SMF 1.1.19?
Or was SMF 1.1.19 modified in some way or another?

I'm asking because it usually makes sense to look for bugs in a locally installed version of software opposed to pentesting a live system.

actmyname

copper member

Activity: 2562

Merit: 2510

Spear the bees

Quote from: GazetaBitcoin on August 12, 2021, 09:08:26 AM

only once in your posting history, once you reach 1337 posts.

Unless you delete your posts after the fact Wink

Quote from: GazetaBitcoin on August 12, 2021, 09:08:26 AM

This is the story of the leet and here, on the forum, I think it was implemented as a funny easter egg.

IIRC this is just a native SMF easter egg: simply part of the toolkit. It just wasn't removed like a few of the other things as it has no significant impact.

GazetaBitcoin

legendary

Activity: 1680

Merit: 6524

Fully-fledged Merit Cycler|Spambuster'23|Pie Baker

Quote from: icopress on August 04, 2021, 06:54:32 AM

Has anyone ever come across such a display of the number of posts? I disabled the extension used but the situation has not changed.

As Xal0lex provided some examples, yes, there is no problem with the "leet" you saw at the profile, icopress. In case there is still any misunderstanding, this is a sort of easter egg, a perk, which appears only once in your posting history, once you reach 1337 posts. In Internet slang, the number 1337 is sometimes spelled as leet or l33t. This number / word is used instead of elite. So when someone tries to say s/he is part of the elite, in Internet slang s/he can write as leet, l33t or 1337.

This is the story of the leet and here, on the forum, I think it was implemented as a funny easter egg. However, the "leet" is not displayed with other occasions - such as when reaching 1337 merits, so it is only once in your life when you see it in your posting history. I am glad you took a screenshot of the moment

All in all, it's supposed to be something funny. Similar to the pic below:

Xal0lex

staff

Activity: 2436

Merit: 2347

I found several dozen topics only in the Meta about this Wink

1337
Posts: "leet"? What???
Post Count : leet
What is "leet"? In my profile
Did I just found the easter egg of the forum??

etc.

icopress

legendary

Activity: 1456

Merit: 5874

light_warrior ... 🕯️

Has anyone ever come across such a display of the number of posts? I disabled the extension used but the situation has not changed.

In order not to create a new thread, I will leave my observation here due to the fact that this thread is associated with possible errors found.

fronti

legendary

Activity: 2912

Merit: 1309

Maybe i missed it but why the bounties are in US$ and not in XAU anymore?

bL4nkcode

copper member

Activity: 2142

Merit: 1305

Limited in number. Limitless in potential.

Quote from: Rokon5 on April 04, 2021, 09:34:58 AM

Any one can invest here and can growing their trade because It has good security.

All investments posted here are actually held on other websites, what bitcointalk can only offer is safety and secured forum due to previous hacks/attacks that leaks user's privacy including emails, phone number, locations posted on pm when dealing someone.

Rokon5

newbie

Activity: 264

Merit: 0

This is probably the highest security bounty of any forum.I am new here but I know it's security is high for this reason I love bounties.Any one can invest here and can growing their trade because It has good security.

alpha_wisdom

newbie

Activity: 6

Merit: 0

You should put this bounty into SMF Forum's core also.

JeromeTash

legendary

Activity: 2338

Merit: 1261

Heisenberg

Quote from: fokinlipat on October 04, 2020, 09:32:46 AM

Is only bitcointalk.org domain considered for this or any other also ?

Like it is said in the OP. The security bounties are exclusively for the forum (bitcointalk.org). Why would admin create security bounties for other domains that the forum is not affiliated with?

Quote from: theymos on October 12, 2013, 12:09:00 PM

The forum is offering bounties for security vulnerabilities.

fokinlipat

jr. member

Activity: 187

Merit: 2

Is only bitcointalk.org domain considered for this or any other also ?

Security Engineer

newbie

Activity: 14

Merit: 1

Hello theymos.

I quote here two post regarding BitcoinTalk's security and I hope you will do what I recommended.

Quote from: ?? on ??

@theymos If I'm you I would remove Google reCaptcha before a DoS hits your main server! The sitekey my boy, the sitekey... I also did some research around the SSL certificates you got from Sectigo... Later I will contact you when I decided what to do with all this.

You don't want to keep that Google reCaptcha there mainly not only because I was able to indentify your server behind cloud but you don't need that at all! Before the cloud it was useful but now you can use just one captcha... better for you.

Quick tips for mitigation: Remove Google reCaptcha and implement Argo Tunnel

Quote from: Security Engineer on August 29, 2019, 05:44:20 PM

Quote from: Chikito on August 29, 2019, 05:35:59 PM

Quote from: Security Engineer on August 29, 2019, 11:46:09 AM

administrator of this forum without any knowledge of programming. I have read his post from the very first one and nothing indicates he had any knowledge of programming.

Bitcointalk are Big forum have over 2.6 Million member need knowledge of management. And not necesarry know about programing.
Manager can recruit people who have knowledge about it.

That is correct DroomieChikito! Wink

If @theymos do what I recommended to him here: https://bitcointalksearch.org/topic/doubt-about-bitcointalk-5179950 and in PM than he never again would need to even think about that something bad happens to the server(s) of BitcoinTalk. In the current state BitcoinTalk is vulnerable. If he does what I recommended it will mitigate all types of attacks once and forever.

This topic will loose it relevance immediately: https://bitcointalksearch.org/topic/m.3326091 meaning that no more bounty. Some regarding the forum and email can be still ongoing but he would need to rewrite the entire post.

Cheers!

I can't reply to your PM theymos Cheesy

I'm to new here... Roll Eyes

I got your PGP key. I will send you what you asked. Right now I'm busy with something else. I can assure you soon you will get the response in PM or in an encrypted email.

Is this yours?

Code:

STT

legendary

Activity: 4088

Merit: 1452

I will speak to someone next week who does this vulnerability testing professionally. Maybe he will tip me if he has a trick from work and manages to do anything :p

Quote from: STSToken on July 09, 2018, 07:19:27 AM

Is there any plans to increase the bounty awards?

They increase every day so long as the gold price does

Quote from: cescudero95 on September 12, 2018, 07:35:31 PM

Sorry, but what is XAU exactly?

https://www.xe.com/currencycharts/?from=XAU&to=USD&view=10Y

XAG is silver

https://www.xe.com/iso4217.php#X

Quote from: dree12 on October 13, 2013, 06:57:21 PM

Is there a particular reason why amounts are in Troy ounces of gold? I know the US is running a risk of default, but I do not see the dollar devaluing so much as to justify using Gold as a "stable" currency.

The forum is internationally based could be one point but mostly I think of Dollar as the pre nixon standard of being fixed to gold hence its always reasonable to offer gold long term especially to an international audience. If I have no liabilities in dollars then the gold could be preferable, dollars do depreciate over time and this topic is years old. Honestly everyone should keep a little gold, maybe I'm biased or maybe people forgot +10% interest rates, etc. I havent.

Topic: Security bounties (Read 167600 times)