Unfaithful HackerOne employee steals bug reports to claim additional bounties

Bug bounty platform HackerOne disclosed that a former employee improperly accessed security reports submitted to claim additional bounties

The vulnerability coordination and bug bounty platform HackerOne disclosed that a former employee improperly accessed security reports submitted by white-hat hackers to claim additional bounties.

The investigation started on June 22nd, 2022, when a customer asked the company to investigate a suspicious vulnerability disclosure made outside of the HackerOne platform. This suspicious submission was similar to the one submitted through the HackerOne platform.

“Upon investigation by the HackerOne Security team, we discovered a then-employee had improperly accessed security reports for personal gain.” reads the incident report published by the company. “The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal of claiming additional bounties.”

According to the company, the threat actor had access to the internal systems between April 4th and June 23rd of 2022. On June 30, HackerOne terminated the employee.

The company identified the unfaithful employee by analyzing internal access logs for systems containing submissions. The experts noticed that only a single employee had accessed each disclosure that customers suspected of being re-disclosed by the threat actor.

“The threat actor created a HackerOne sockpuppet account and had received bounties in a handful of disclosures. After identifying these bounties as likely improper, HackerOne reached out to the relevant payment providers, who worked cooperatively with us to provide additional information. Following the money trail, we received confirmation that the threat actor’s bounty was linked to an account that financially benefited a then-HackerOne employee.” continues the report. “Analysis of the threat actor’s network traffic provided supplemental evidence connecting the threat actor’s primary and sockpuppet accounts.”

The company notified customers about the bug reports that were accessed by the employee, They found no evidence that the vulnerability data accessed was misused.

The company announced a series of additional improvements, such as implementing additional logging processes to improve incident response, implementing data isolation to reduce the “blast radius,” planning additional red teaming activities, and enhancing processes to identify anomalous access and proactively detect insider threats.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, bug bounty)

[adrotate banner=”5″]

[adrotate banner=”13″]