3 ms·
Has anybody else been getting spam from "security researchers" and "ethical hackers" who tell you that you are missing a DMARC record and then ask for a bounty?
by newaccount74 5y ago
Has anybody else been getting spam from "security researchers" and "ethical hackers" who tell you that you are missing a DMARC record and then ask for a bounty?
- guessmyname 5y agoYes. I was the lead security engineer at my previous job, and these messages were always marked as “Informative” and, eventually, “Duplicate”. The major bug bounty websites like Bugcrowd and HackerOne have rules about duplicate and non-actionable submissions, which usually hurt the researcher, for example, by decreasing their reputation points. After the first couple of submissions, I got curious, so I decided to open a separate category for these submissions where I asked every researcher to provide a proof of concept of the attack. Unsurprisingly, none of them were able to. Some of them closed their own submissions, and the others lost some reputation points due to Bugcrowd or HackerOne’s intervention. Somehow, we did not receive more submissions about DMARC, SPF, or DKIM after that, which was interesting, as if all the researchers were working together to spam as many bug bounty programs as possible with the same “vulnerability” to get easy money from unsuspected program managers.
- Brajeshwar 5y agoYes, my domain is one such on the recipient end.