ExpressVPN has announced that it has updated its bug bounty program to offer a one-time $100,000 (12 million yen) bug bounty to anyone who can compromise the company’s systems.
ExpressVPN is one of the most widely used VPN (Virtual Private Network) products, providing users with web browsing privacy and the ability to bypass geo-restrictions.
This privacy is achieved by passing the user’s Internet traffic through an encrypted tunnel, which hides the user’s actual IP address from those provided by the VPN service.
Damaging the security of this type of system would compromise one of the most important selling points of these products: user privacy.
This is why ExpressVPN offers a bug bounty program, where security auditors and researchers can report vulnerabilities in the company’s infrastructure and software and receive a monetary bug bounty reward.
New 0,000 bounty for serious bugs
ExpressVPN has announced that it is offering a new $100,000 bug bounty for a critical vulnerability in its technology, TrustedServer.
This is the highest single bounty offered on the Bugcrowd platform, and is 10 times the highest bounty ExpressVPN has offered previously
This new $100,000 one-time bounty is offered under the following conditions.
- The first person to submit a valid vulnerability that causes unauthorized access or exposure of customer data will be eligible for a $100,000 USD bounty. This one-time reward is valid until the award is claimed.
- The one-time US$100,000 reward is for ExpressVPN’s VPN server vulnerabilities only.
- Activity must remain within the scope of the TrustedServer platform. If you are unsure if your test is considered in scope, please contact support@bugcrowd.com first to verify.
ExpressVPN is also looking for security researchers to discover possible ways to leak the actual IP addresses of clients and monitor user traffic.
This bug bounty program is run by BugCrowd and provides a safe harbor for researchers who try to break into ExpressVPN’s servers as part of the program.
Why you might have a hard time hacking it
TrustedServer is a custom-built operating system based on Debian Linux, with unique security enhancements that make it ideal for use in VPN infrastructures.
ExpressVPN uses a system that makes the server RAM-only and periodically erases data on reboot.
We also have build validation in place to prevent insider code tampering events, and weekly patches are applied to all ExpressVPN servers with a clean install.
It can be difficult to find bugs to take advantage of, especially since the bug bounty program has been offered for the past 6 years and hence the payments have been rising.
If you are confident in your hacking abilities and are interested in the above challenge, you can join the program here.
Comments