Summary

Intro

Since the founding of HackerOne, we have kept a steadfast commitment to disclosing security incidents because we believe that sharing security information far and wide is essential to building a safer internet. HackerOne's culture is to disclose more often, and in more detail than the rest of the industry. This document represents our 431st disclosure to date and we hope it will prove useful to defenders everywhere.

If you were one of the customers directly impacted by this incident, you will have already received direct communication from us providing actionable details.

Incident Summary

On June 22nd, 2022, a customer asked us to investigate a suspicious vulnerability disclosure made outside of the HackerOne platform. The submitter of this off-platform disclosure reportedly used intimidating language in communication with our customer. Additionally, the submitter’s disclosure was similar to an existing disclosure previously submitted through HackerOne. Bug collisions and duplicates, where multiple security researchers independently discover a single vulnerability, commonly occur in bug bounty platforms. However, this customer expressed skepticism that this was a genuine collision and provided detailed reasoning. The HackerOne security team took these claims seriously and immediately began an investigation.

Upon investigation by the HackerOne Security team, we discovered a then-employee had improperly accessed security reports for personal gain. The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal of claiming additional bounties. This is a clear violation of our values, our culture, our policies, and our employment contracts. In under 24 hours, we worked quickly to contain the incident by identifying the then-employee and cutting off access to data. We have since terminated the employee, and further bolstered our defenses to avoid similar situations in the future. Subject to our review with counsel, we will also decide whether criminal referral of this matter is appropriate. Our full discussion of the incident is below.

Investigation Timeline

Investigation

Our investigation has concluded that a (now former) HackerOne employee improperly accessed vulnerability data of customers to re-submit duplicate vulnerabilities to those same customers for personal gain.

The investigation began after a customer notified us of reportedly receiving a threatening communication, outside the HackerOne platform, about a vulnerability disclosure. We immediately launched an investigation. Within 30 minutes of the investigation, additional evidence surfaced that caused us to escalate the priority of the incident. We began to run down every scenario of a possible exposure to disclosure data, including potential exploitation of our application, a remote compromise of the hacker, customer, or analyst, a leak by misconfiguration, and others. There was information to support only one of our hypotheses, an internal threat actor.

Upon this discovery, we began a separate investigation into the insider threat with a contained group. These steps were necessary as we worked to investigate and eliminate the prospect of multiple insiders. We are now confident that this incident was limited to a single employee who improperly accessed information in clear violation of our values, our culture, our policies, and our employment contracts.

Within 24 hours of the tip from our customer, we took steps to terminate that employee's system access and remotely locked their laptop pending further investigation.

We were able to reach our conclusion quickly using the following methods. Our internal logging monitors employee access to customer disclosures for regular business operations, namely vulnerability intake and triage. Analysis of this log data suggested a likely actor soon after our internal investigation kicked off. Only a single employee had accessed each disclosure that our customers suspected of being re-disclosed by the threat actor.

The threat actor created a HackerOne sockpuppet account and had received bounties in a handful of disclosures. After identifying these bounties as likely improper, HackerOne reached out to the relevant payment providers, who worked cooperatively with us to provide additional information. Following the money trail, we received confirmation that the threat actor's bounty was linked to an account that financially benefited a then-HackerOne employee. Analysis of the threat actor’s network traffic provided supplemental evidence connecting the threat actor's primary and sockpuppet accounts.

We identified seven customers who received direct communication from the threat actor. We notified each of the customers of our investigation and asked for information related to their interactions. We are grateful for their involvement in our investigation and we thank them for their willing cooperation. Facts shared from their own investigations corroborated the conclusion from our investigation and allowed us to act more quickly.

We have issued platform bans for the employee's known HackerOne accounts. We have terminated the employee for violating our values, our culture, our policies, and our employment contracts. Subject to review with counsel, we will decide whether criminal referral of this matter is appropriate. We continue forensic analysis on the logs produced and devices used by the former employee. We are reaching out to other bug bounty platforms to share details in case their customers received similar communications from "rzlr". The threat actor's motives appear to be financial in nature.

The threat actor had access to HackerOne systems between April 4th and June 23rd of 2022.

Our investigation will continue. We hope to learn and share more as the investigation continues and will update this post as needed.

Guidance for customers

As a result of the findings of our investigation, we believe we have taken the necessary steps to contain the insider's access. Customers will understandably have questions that we hope to answer here. As any conversation about this disclosure occurs, we will update this guidance with answers to questions as necessary.

How do I know if I have interacted with this threat actor?

All off-platform disclosures known to us have been made with the handle “rzlr”. If you have been contacted by this individual, and are not already coordinating with us, please contact [email protected] immediately. If you receive any security report (on or off the HackerOne platform) that is aggressive or threatening in tone, please contact us immediately.

What access did the threat actor have to customer data?

The former employee's role was to triage vulnerability disclosures for numerous customer programs. This access was granted through their normal job role and their access was visible to our investigation through standard logging within our product. No access to customer data beyond this specific job role was granted or authorized - not through our developer environment, infrastructure, or otherwise. We are confident about access they were granted and what they accessed (authorized, or not) based on this logging.

What data did the threat actor access?

Based on internal logging, we have a clear record of what the threat actor did and did not access. In the vast majority of instances, we have no evidence that the vulnerability data accessed was misused, but we have individually notified customers who had any reports accessed by the threat actor and specified the reports that were accessed along with time of access.

I received an email from HackerOne about this incident; what do I do?

The email you received will identify which reports have been accessed by the threat actor. For the sole purpose of mitigation, unauthorized access to these particular disclosures should be assumed. We recommend escalating the priority in mitigating the risks involved with these disclosures.

I did not receive an email from HackerOne about this incident; what do I do?

We have emailed all customers who may have been impacted by this incident, based on the facts of our investigation. If you were not emailed, our investigation does not suggest that any other data was accessed. We do not recommend any further action at this time. We will update this post and notify customers of any new findings.

I was contacted by this threat actor; what do I do?

Please contact your HackerOne customer success manager and/or [email protected] with the communication, we’ll include it in our investigation, and assist in any manner we can.

My question hasn't been answered yet; what do I do?

Please contact our dedicated incident responders at [email protected] so we can assist.

Guidance for Hackers

You may be concerned that your disclosures may have been unfairly re-submitted by the threat actor and may have somehow disrupted bounty eligibility by the threat actor involved. Our investigation so far has not discovered any situation where the threat actor made a duplicate disclosure that interfered with the judgment or bounty amount for the original disclosure. All disclosures made from the threat actor were considered duplicates. Bounties applied to these submissions did not impact the original submissions. We will be careful to consider fairness to hackers as our investigation continues.

If one of your reports was accessed by the threat actor, we will send you an email shortly containing the list of accessed reports. We're sharing these in the spirit of transparency. We would appreciate hearing from you ([email protected]) if you believe any of our conclusions above are incorrect.

Additional Improvements

We uphold our commitments to protect your data by continuously improving our resilience to attacks. We have identified several areas that have prompted continual improvement following this incident.

Logging: We are happy that our previous investments in logging enabled an expedient investigation and response. While we were able to quickly identify a threat actor in this instance, we will ensure we are further equipped for any eventuality. We have identified further logging improvements that will improve our ability to respond to incidents in the future.

Detection and Response - Investigation: Our existing capabilities did not proactively detect and prevent this attack. To ensure we can proactively detect and prevent future threats, we are adding additional employees dedicated to insider threats that will bolster detection, alerting, and response for business operations that require human access to disclosure data.

Detection and Response - Engineering: We are allocating additional engineering resources to invest further in internal models designed to identify anomalous access to disclosure data and trigger proactive investigative responses.

Enhance Hiring Screening: Our existing industry standard background, criminal, and reference check processes did not screen out the threat actor. We are evaluating possible additional enhancements tailored to this unique threat.

Data Isolation: Limiting the impact of a single compromised or malicious insider is an important control in our defenses. We will invest in additional analyst capacity and workflow changes to further reduce the "blast radius" of incidents of this type.

Red Team Tabletops: We are planning additional simulations designed to continuously evaluate and improve our ability to effectively resist insider threats.

In summary, this was a serious incident. We are confident the insider access is now contained. Insider threats are one of the most insidious in cybersecurity, and we stand ready to do everything in our power to reduce the likelihood of such incidents in the future. A special thank you to the customer who originally alerted us to the possibility of something being wrong and to all the customers who subsequently assisted with this incident.

Chris Evans (CISO) and Alex Rice (Founder & CTO)