Bug bounty hub HackerOne has introduced that its person base of freelance bounty-hunting hackers have reported a whopping 66,000+ verified vulnerabilities in 2021, a 20% improve over final yr’s whole. What, precisely, could possibly be occurring to trigger such a surge this yr, when the final was the precise yr of uncertainty and COVID-induced chaos?

Along with the rise within the variety of verified bugs, HackerOne’s report additionally discovered that the median bounty paid out for a important bug (rated utilizing the CVSS scale) rose by 13%, and by 30% for bugs rated “excessive severity,” which is one step beneath important. 

SEE: Password breach: Why popular culture and passwords do not combine (free PDF) (TechRepublic)

Corresponding with elevated bug detection and bigger payouts, the variety of what HackerOne calls “hacker-powered safety applications” grew by 34% in 2021, with the biggest progress being within the aviation/aerospace, medical know-how and authorities industries. HackerOne additionally identified that use of hacker-based safety within the monetary companies trade continues to develop by 62% (the fourth largest), which it mentioned is anticipated as a result of “exterior of core tech industries, [financial services] tends to paved the way with forward-thinking and agile safety options.” 

What kind of bugs are being discovered?

Understanding the types of bugs which are being discovered is a vital a part of constructing a safety downside ready to answer the form of issues which are trending within the safety world. 

In line with HackerOne’s analysis, cross-site scripting vulnerabilities stay probably the most found from 2020 to 2021, with a 7% year-over-year improve. Info disclosure elevated 58% YoY, triggering its rise from third to second place. It displaced improper entry management, which slid to 3rd. 

Probably the most harmful risk this yr, nonetheless, has been enterprise logic errors, which rose by 67% YoY to enter the highest 10 for the primary time within the 5 years HackerOne has printed its report. 

Enterprise logic errors are methods attackers misuse authentic features on a website to the detriment of the location’s proprietor. Examples of this embody issues like cancelling a purchase order quick sufficient to not be charged, however to nonetheless achieve loyalty factors related to a purchase order; or injecting decrease costs on objects in an ecommerce cart by abusing the best way the location handles its pricing logic. These errors aren’t a lot a strategy to break methods, and extra a strategy to abuse authentic, however poor, website design. 

Are there extra bugs, or simply extra studies?

The central query of this report, whether or not or not the variety of bugs in software program is definitely rising, or if present bugs are being discovered extra incessantly attributable to elevated bug bounty program recognition, cannot be definitively answered with out further insights. I’ve reached out to HackerOne for its opinion, however have but to listen to again; this text shall be up to date if I do.

With out that perception it is nonetheless doable to attract conclusions, although, particularly when contemplating HackerOne’s numbers on how bugs are being discovered. Bug bounty applications, for instance, solely rose by 10% this yr, reporting 42,805 bugs to 2020’s 38,863. Of the 2 kinds of bug bounty applications, non-public bounties (accessible solely to invited hackers) grew by 16%, whereas public bounties solely rose by 2%. 

The opposite two strategies of discovering bugs, vulnerability disclosure applications (VDPs) and penetration exams, have been the place the true progress was. Reviews from VDPs rose by 47%, and bug studies from pentests rose by an incredible 264%. 

HackerOne mentioned that it is seeing an enormous rise within the recognition of pentests, which it mentioned is because of “enhanced buyer deal with compliance with safety laws and requirements.” By way of sheer numbers, nonetheless, pentests are solely discovering a sliver of the bugs that non-public bug bounties do: Pentests uncovered 1,804 bugs in 2021 to non-public bounty’s 25,278. 

SEE: Google Chrome: Safety and UI ideas that you must know  (TechRepublic Premium)

Whatever the kind studies are available in, HackerOne mentioned that hacker-powered options are proving their worth. “The info and vulnerability insights organizations achieve from their bug bounty, VDPs and pentests are enabling them to raised determine the place issues are originating and the place sources and coaching must be directed,” the report concludes. 

Whether or not or not that ought to consolation you is up within the air: It appears extra bugs are being discovered not as a result of the variety of bugs is rising, however as a result of the variety of white-hat hackers utilizing their powers for good (and revenue) is rising. What that basically means is that your methods are in all probability simply as riddled with bugs as everybody else’s. The one downside is that you have not discovered yours but. 

Cybersecurity Insider E-newsletter

Strengthen your group’s IT safety defenses by retaining abreast of the newest cybersecurity information, options, and greatest practices.
Delivered Tuesdays and Thursdays

Join right now

Additionally see