Robert Kugler and Paypal’s bug bounty eligibility requirements

For professional security researchers, participating in bug bounty programs is one means of earning money on the side. It is also the easiest means of building up street-cred. And many companies take advantage of their skills, recognizing that its either they find and fix bugs in their products first or the bad guys do and exploit them. For Black Hats, the underground market for exploit code is a very lucrative one.

So, many companies run these bug bounty programs to encourage White-Hat security professionals to show off their skills and make some money, while doing so. Robert Kugler is one such security professional who took part in Paypal’s bug bounty program. He found a Cross-Site Scripting (XSS) bug on Paypal.com and reported it, hoping to collect whatever reward was due.

But Paypal refused to pay. Why? At 17 years of age, Robert Kugler, according to Paypal, does not meet the age-related eligibility requirement for participating in the program. Curiously, that specific requirement is not stated in the publicly available description of the program, which is available here.

Not happy with Paypal for refusing to pay, Robert posted his finding (and the exploit code) at Packet Storm.

The email exchange between him and Paypal is shown in the three images.

Paypal Bug Bounty Robert Kugler

Paypal Bug Bounty Robert Kugler XSS

Paypal Bug Bounty Robert Kugler XSS

I think if this age-related requirement had been made very clear in the programs description, Paypal would have a good case for refusing to pay the bounty to Robert. So obviously, Robert is not a very happy kid. Paypal recognizes that and is trying to patch things up.

But Paypal’s way of compensating Robert for his efforts is a “Letter of Appreciation,” which you may read here (PDF file).

In that letter, Paypal promised to send him “some more tangible signs of our appreciation of your efforts.” Let’s wait and see what Paypal’s “more tangible signs of our appreciation” translates into.

Related Posts

Install Cinnamon 2.0 on Ubuntu 13.10 “Saucy Salamandar” Cinnamon 2.0, the latest edition of the Cinnamon desktop environment, was released just eight days ago, while Ubuntu 13.10, the latest version of the ...
How to reset user password on Ubuntu 14.10 After publishing How to reset passwords on Fedora 21 and 22, I thought it was appropriate to do the same for Ubuntu 14.10. So this tutorial will sh...
Kali Linux ISO: Build a custom KDE image Kali Linux is the latest incarnation of BackTrack Linux, a distribution designed for penetration testing and security professionals. The last edition ...
How to install AppMenu-QML on Fedora 16 KDE There are several menu styles available for users of the K Desktop Environment. Virtually all, should be familiar with the Classic menu, the Kickoff m...
How to dual-boot Linux Mint 17.2, Windows 10, Windows 8.1 on a PC with UEFI firmware This tutorial shows how to dual-boot Linux Mint 17.2 and either Windows 10 or Windows 8.1 on a single hard disk drive and on a computer with UEFI firm...
Mandriva Linux 2009 Titbits Mandriva Linux 2009 was recently released to the public. Here we provide some titbits from Mandriva One, one of the free editions of Mandriva Linux 20...

We Recommend These Vendors and Free Offers

ContainerizeThis 2016 is a free, 2-day conference for all things containers and big data. Featured, will be presentations and free, hands-on workshops. Learn more at ContainerizeThis.com

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


One Comment

  1. Hope PayPal likes having zero-days posted to the FD list with no advance warning.

Leave a Comment

Your email address will not be published. Required fields are marked *

*