Origin Energy has made a big achievement with its Bug Bounty Program, making it public. The BugCrowd Bug bounty Program is designed to address potential security vulnerabilities. It is now offering up to $2500 for confirmed vulnerabilities. The company also appreciates the work undertaken by the research community to report potential security vulnerabilities.
Bugcrowd operating privately since 2018
The Origin Energy Bugcrow program has been operating privately since 2018. Last weekend, the Bugcrowd used the social media platform LinkedIn to announce that the program is now’’ public and joinable’’ for others. An Origin Energy Spokesperson in a media talk said, “Origin has been participating in the Bugcrowd vulnerability rewards program since 2018,”
He further added, “We use the Bugcrowd bug bounty program to reward cyber security researchers and white hat hackers for finding and reporting vulnerabilities in our software that have the potential to be exploited.’’
“It’s an always-on approach to cyber security, perfectly supplementing our internal security code audits and penetration tests as part of our vulnerability management program.”
Primary Publicly-facing assets
Now Origin Energy is looking forward to focusing its attention on ‘’ primary publicly-facing assets’’- its web applications. Which will cover content distribution networks, websites, and internet-facing APIs. Meanwhile, Bug focuses on server-side remote code execution and request, stored and reflected cross-site scripting, SQL injection, XML external entity attacks and access control vulnerabilities.
Origin Energy says that it will focus on vulnerabilities that leave customers’ information at risks. Such as offering discounts or redemption. And in other words, ‘’ subvert business controls.’’ The program follows the usual rules of Bugcrowd such as denial-of-service is not include. Also, researchers will not alter the origin’s or its user’s data. They are responsible for ensuring only test domains owned by Origin. If the tester is looking at authenticated sections of the target, they must be an Origin customer with MyAccount access.
