I am not advocating the replacing of penetration testing with cheaper bug bounties.\u00a0 Far from it. Running a bug bounty program on a system you have not tested thoroughly by other means is likely to lead to disaster and embarrassment.<\/p>\n
Bug bounties are meant to uncover additional problems after you have looked everywhere you can think of. When you have exhausted your standard means of security assurance and you think you are done. This is when bug bounty hunters come in and leave no stone unturned. As it happens, these are also the dark corners of your application that attackers will be looking at and what’s better than a security vulnerability disclosed to you before an attacker discovers it?<\/p>\n
So the big internet companies all have their bug bounty programs, but only Swisscom has a similar permanent offering in Switzerland. But we see some movement now.: Regulators are actively pushing for more openness in the development process, red teams are being formed and several Swiss companies are actively considering to launch Bug Bounty programs themselves. It is a big shift in corporate policies: We are seeing Swiss companies starting to embrace the hackers!<\/p>\n
We think this is a very useful development and it is so strong and so important that we have chosen “Embracing the Hackers” as our motto for Swiss Cyber Storm 2019.<\/p>\n
“Embracing the Hackers” also means that we leave the meta-discussions and conceptual talks of the “Trust” theme of 2018 behind and dig deeper into the systems, getting our fingers dirty with the code and thus closer to where the bugs are hidden.<\/p>\n
After all, it’s bugs that spice up the security game and it’s bugs that bring down bold programs.<\/p>\n
When the Federal Chancellery updated the regulation for E-Voting – or online voting if you will – they added relatively benign checkbox that a fully blown E-Voting system would need to publish it’s source code before being admitted to Federal Votes. Additionally, a political initiative from the national parliament lead to the inclusion of a limited public intrusion test into he regulation. Both items were meant to be little additions to complete the certification process, mostly imposed to raise the transparency and in consequence the public trust in the systems. You see the concept here.<\/p>\n
Yet in the case of Swiss Post, this is not how it played out. The source code was published in February, closely followed by the announcement of a separate public intrusion program maxing out at a top bounty of 50’000 CHF. This brought global attention to both programs and within weeks, several teams were picking apart the source code of Scytl, the Spanish partner of Swiss Post. This lead to three major findings that proved that the Swiss Post E-Voting system was not meeting the Swiss regulation as is.\u00a0 The media outcry was so loud, few people noticed that despite the bad quality of the source code, none of the attackers was able to actually exploit the Swiss Post systems which is an interesting twist to this partnership between a Spanish development company and a Swiss operator.<\/p>\n
But whatever. What we can learn here is, that not the formal review process and the costly audits lead to the discovery of the fundamental security problems in the Swiss Post E-Voting system. Instead, it was the publication of the source code, the bigger transparency and the bug bounty program that attracted hundreds of researchers.<\/p>\n
So the openness and engagement with the wider security research community brought immediate results.\u00a0 And there is one researcher that made a name for herself, with her team discovering no less than three fundamental bugs in the Scytl code. She is Sarah Jamie Lewis, the executive director of Open Privacy in Canada.\u00a0 And we are very happy to announce her as a speaker for Swiss Cyber Storm 2019.<\/p>\n
Sarah Jamie Lewis is an outspoken critic of big tech, a privacy activist and author of the book “Queer Privacy”. She has made a career as penetration tester and security auditor, she maintains the “OnionScan” Tor scanner and has a big interest in cryptography. That’s how she got hooked up on the Scytl E-Voting source code and literally spent days and nights for several weeks digging down into the rabbit hole. And while she maintains she and her team only scratched the surface, it was enough to stop Swiss Post from offering E-Voting for the national vote next Sunday.<\/p>\n
Swiss Cyber Storm 2019 will happen on October 15, 2019 in Bern.\u00a0 Please join us<\/a> to see Sarah Jamie Lewis and many, many other speakers. The early bird sale is open.<\/p>\n <\/p>\n
![\"Link](\"https:\/\/www.swisscyberstorm.com\/wp-content\/uploads\/2018\/05\/buy-ticket-now.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.swisscyberstorm.com\/wp-content\/uploads\/2018\/05\/christian-folini-circle-150x150.png\")
<\/a>