0%

Kraken Bug Bounty program patches isolated bug

2024年6月19日 4分读完
新闻文章的横幅图片

The bug was initially discovered by a third-party security research company who had exploited the flaw for financial gain before reporting it to Kraken’s Bug Bounty program. This flaw allowed certain users, for a short period of time, to artificially increase the value of their Kraken account balance without fully completing a deposit.

On discovery, a cross-functional effort at Kraken mitigated the issue in less than an hour. We then thoroughly tested the solution to guard against similar issues in the future.

Unfortunately, the third-party researchers that discovered the bug acted in bad faith and outside the rules of our established Bug Bounty program, which has been in operation for nearly a decade. Bug bounty program industry best practices generally involve careful collaboration between both parties, with security researchers expected to:

  1. Exploit only what is needed to prove a security vulnerability

  2. Promptly return assets that have been extracted

  3. Provide details of testing, such as proof-of-concept code, that allows the company to assist with the identification and remediation of the underlying flaw

We won’t be crediting the researcher of this disclosure because they didn’t comply with any of these industry expectations.

In return for bug bounty reports, developers like Kraken are expected to be attentive, patch the underlying issue quickly and publicly recognize the incredible work of the researcher. Most importantly, they’re also expected to reward the researcher with a generous bounty. We actively moved to hold up our side of this deal.

Security research is nothing new for Kraken, which has deep roots in the info-sec industry. Our Kraken Security Labs team has a track record of discovering and reporting security vulnerabilities to other crypto vendors, including Ledger and Trezor, to help them improve their products.

We understand the value that external security research can bring and how it can enhance the broader ecosystem. There’s simply no better way to secure all users on the crypto frontier than to work collaboratively.

“As a leader with roots in the hacking community, I can attest to the importance of leveraging the skills, knowledge and expertise across the security community to enhance companies’ security strategies and risk management controls,” said Nick Percoco, Kraken Chief Security Officer.

We see our Bug Bounty program as a vital shield to Kraken’s mission and a key part of our efforts to enhance our overall security systems and processes. We have worked with many talented, good faith security researchers over the years, and look forward to continuing this work in the future.

These materials are for general information purposes only and are not investment advice or a recommendation or solicitation to buy, sell, stake, or hold any cryptoasset or to engage in any specific trading strategy. Kraken makes no representation or warranty of any kind, express or implied, as to the accuracy, completeness, timeliness, suitability or validity of any such information and will not be liable for any errors, omissions, or delays in this information or any losses, injuries, or damages arising from its display or use. Kraken does not and will not work to increase or decrease the price of any particular cryptoasset it makes available. Some crypto products and markets are unregulated, and you may not be protected by government compensation and/or regulatory protection schemes. The unpredictable nature of the cryptoasset markets can lead to loss of funds. Tax may be payable on any return and/or on any increase in the value of your cryptoassets and you should seek independent advice on your taxation position. Geographic restrictions may apply.

The post appeared first on Kraken Blog.

热门新闻

How to Set Up and Use Trust Wallet for Binance Smart Chain
#Bitcoin#Bitcoins#Config+2 更多标签

How to Set Up and Use Trust Wallet for Binance Smart Chain

Your Essential Guide To Binance Leveraged Tokens

Your Essential Guide To Binance Leveraged Tokens

How to Sell Your Bitcoin Into Cash on Binance (2021 Update)
#Subscriptions

How to Sell Your Bitcoin Into Cash on Binance (2021 Update)

What is Grid Trading? (A Crypto-Futures Guide)

What is Grid Trading? (A Crypto-Futures Guide)

马上免费使用Cryptohopper进行交易!

免费使用——无需信用卡

开始吧
Cryptohopper appCryptohopper app

免责声明:Cryptohopper并非受监管机构。加密货币的机器人交易存在大量风险,过去的业绩表现并不能预示未来的结果。产品截图中展示的利润仅供参考,可能有所夸大。只有在您具备充足的知识或寻求了专业财务顾问的指导后,才应进行机器人交易。在任何情况下,Cryptohopper均不对任何人或实体因使用我们的软件进行交易而产生的全部或部分损失或损害,或任何直接、间接、特殊、后果性或附带的损害承担责任。请注意,Cryptohopper社交交易平台上的内容由Cryptohopper社区成员生成,并不代表Cryptohopper或其代表的建议或推荐。市场上展示的利润并不能预示未来的结果。使用Cryptohopper的服务即表示您承认并接受加密货币交易的固有风险,并同意免除Cryptohopper因您的任何责任或损失的责任。在使用我们的软件或进行任何交易活动之前,务必审阅并理解我们的服务条款和风险披露政策。请根据您的具体情况咨询法律和金融专业人士,获取个性化的建议。

©2017 - 2024 版权归属于Cryptohopper™ -版权所有。