Artificial Bugs for Crowdsearch (2403.09484v1)
Abstract: Bug bounty programs, where external agents are invited to search and report vulnerabilities (bugs) in exchange for rewards (bounty), have become a major tool for companies to improve their systems. We suggest augmenting such programs by inserting artificial bugs to increase the incentives to search for real (organic) bugs. Using a model of crowdsearch, we identify the efficiency gains by artificial bugs, and we show that for this, it is sufficient to insert only one artificial bug. Artificial bugs are particularly beneficial, for instance, if the designer places high valuations on finding organic bugs or if the budget for bounty is not sufficiently high. We discuss how to implement artificial bugs and outline their further benefits.
- Bug Hunters’ perspectives on the challenges and benefits of the bug bounty ecosystem. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2275–2291, Anaheim, CA. USENIX Association.
- Böhme, R. (2006). A Comparison of Market Approaches to Software Vulnerability Disclosure. In Müller, G., editor, Emerging Trends in Information and Communication Security, Lecture Notes in Computer Science, pages 298–311, Berlin. Springer.
- Responsible Vulnerability Disclosure in Cryptocurrencies. Communications of the ACM, 63(10):62–71.
- Public Randomness and Randomness Beacons. https://a16zcrypto.com/posts/article/public-randomness-and-randomness-beacons/.
- Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts. In 27th USENIX Security Symposium (USENIX Security 18), pages 1335–1352, Baltimore, MD. USENIX Association.
- Cheesecloth: Zero-Knowledge proofs of real world vulnerabilities. In 32nd USENIX Security Symposium (USENIX Security 23), pages 6525–6540, Anaheim, CA. USENIX Association.
- Do you need a zero knowledge proof? Cryptology ePrint Archive, Paper 2024/050. https://eprint.iacr.org/2024/050.
- Federal Department of Finance of Switzerland (2022). Federal administration procures platform for bug bounty programmes [Press release]. https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-89868.html.
- Crowdsearch. CEPR Discussion Paper No. 18529.
- Goldreich, O. (2001). Foundations of Cryptography. Cambridge University Press.
- Efficient Proofs of Software Exploitability for Real-world Processors. In Proceedings on Privacy Enhancing Technologies, pages 627–640.
- The Rules of Engagement for Bug Bounty Programs. In Meiklejohn, S. and Sako, K., editors, Financial Cryptography and Data Security, Lecture Notes in Computer Science, pages 138–159, Berlin, Heidelberg. Springer.
- Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs. Journal of Cybersecurity, 3(2):81–90.
- Bug Bounty Programs for Cybersecurity: Practices, Issues, and Recommendations. IEEE Software, 37(1):31–39.
- Hacking for good: Leveraging HackerOne data to develop an economic model of Bug Bounties. Journal of Cybersecurity, 7(1):1–9.
- Stallings, W. (2020). Cryptography and Network Security: Principles and Practice. Pearson, 8th edition.
- An Empirical Study of Bug Bounty Programs. In 2020 IEEE 2nd International Workshop on Intelligent Bug Fixing (IBF), pages 35–44.
- Devising Effective Policies for Bug-Bounty Platforms and Security Vulnerability Discovery. Journal of Information Policy, 7:372–418.
- The Simple Economics of an External Shock on a Crowdsourced ‘Bug Bounty Platform’. Available at SSRN: https://ssrn.com/abstract=4154516.