Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

Re:Namecheap CEO offers $10k bounty for changing someone els... by gkoberger on Monday August 29, 2022 @11:38AM (#32639530)

How else is the CEO supposed to respond? He's in the tough position where he can't prove a negative; the burden of proof is on the original tweeter. So the CEO needs the "hacker" to either prove it or admit they were mistaken, and bug bounties are exactly how companies do this.

(Also, I feel like it's implied that "an account that isn't yours" doesn't mean "mess with any of our customers you want." He's clarifying that because with white-hat(ish) hackers, you'd be shocked how many people try to claim bug bounties from us because they "hacked" their own account using their own credentials.)

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by NamecheapCEO on Monday August 29, 2022 @11:54AM (#32639705)

Thanks for your comment and you are correct with your latter point and assumption. It's hard to word things properly when you're limited with the amount of allowed characters on twitter.

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by ebfe1 on Monday August 29, 2022 @07:30PM (#32644849)

love the bounty proposal but may I suggest creating a bounty target specifically for this and share it with everyone so whitehat folks can have a crack at it without raising concerns about hacking customers accounts? :)

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by eric__cartman on Monday August 29, 2022 @01:01PM (#32640597)

kek I thought this was a troll account until I saw your post history. I like your straight forward approach to username creation.

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by aaaaaaaaata on Tuesday August 30, 2022 @11:59AM (#32651906)

Approach to additional username creation, most likely!

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by muhehe on Monday August 29, 2022 @11:57AM (#32639749)

> you'd be shocked how many people try to claim bug bounties from us because they "hacked" their own account using their own credentials.

Wait ...what? Like, seriously?

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by gkoberger on Monday August 29, 2022 @12:00PM (#32639789)

Yup, but in a roundabout way.

For example, they'll inspect traffic and nab a session cookie. Then they'll use that session cookie on another internal API request to change a setting, and claim they were able to modify a setting by reverse engineering things.

They seem really scary at first, and then you dig into it and you're like "oh...".

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by Beltalowda on Monday August 29, 2022 @01:31PM (#32640978)

I'd say that >90% of "security incidents" that I've seen reported are completely bogus. And we don't even have a bug bounty program. They will still beg for free stuff like t-shirts and other tiddletat.

I think the majority is just ignorance rather than malice though.

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by chrismarlow9 on Monday August 29, 2022 @12:03PM (#32639821)

A few weeks ago I saw a vulnerability reported for an FTP server that claimed they could put a file on the remote server. With FTP! What madness! I wish I could find it but I cannot, still makes me chuckle.

[ Parent | on HN ]

Re:Namecheap CEO offers $10k bounty for changing someone els... by gkoberger on Monday August 29, 2022 @12:05PM (#32639844)

Yeah, we get those too. We let people write JavaScript to build their sites (we're a site builder), and people will use that feature and add an alert and then claim it's XSS (on their own account).

[ Parent | on HN ]