Partner links

Robert Kugler and Paypal’s bug bounty eligibility requirements

Zemanta Related Posts Thumbnail

For professional security researchers, participating in bug bounty programs is one means of earning money on the side. It is also the easiest means of building up street-cred. And many companies take advantage of their skills, recognizing that its either they find and fix bugs in their products first or the bad guys do and exploit them. For Black Hats, the underground market for exploit code is a very lucrative one.

So, many companies run these bug bounty programs to encourage White-Hat security professionals to show off their skills and make some money, while doing so. Robert Kugler is one such security professional who took part in Paypal’s bug bounty program. He found a Cross-Site Scripting (XSS) bug on Paypal.com and reported it, hoping to collect whatever reward was due.

But Paypal refused to pay. Why? At 17 years of age, Robert Kugler, according to Paypal, does not meet the age-related eligibility requirement for participating in the program. Curiously, that specific requirement is not stated in the publicly available description of the program, which is available here.

Not happy with Paypal for refusing to pay, Robert posted his finding (and the exploit code) at Packet Storm.

The email exchange between him and Paypal is shown in the three images.

Paypal Bug Bounty Robert Kugler

Paypal Bug Bounty Robert Kugler XSS

Paypal Bug Bounty Robert Kugler XSS

I think if this age-related requirement had been made very clear in the programs description, Paypal would have a good case for refusing to pay the bounty to Robert. So obviously, Robert is not a very happy kid. Paypal recognizes that and is trying to patch things up.

But Paypal’s way of compensating Robert for his efforts is a “Letter of Appreciation,” which you may read here (PDF file).

In that letter, Paypal promised to send him “some more tangible signs of our appreciation of your efforts.” Let’s wait and see what Paypal’s “more tangible signs of our appreciation” translates into.

Share:

Facebook
Twitter
Pinterest
LinkedIn

Partner links

Newsletter: Subscribe for updates

Subscribe
Notify of
guest
1 Comment
Inline Feedbacks
View all comments
AC
AC
10 years ago

Hope PayPal likes having zero-days posted to the FD list with no advance warning.

Get the latest

On social media

Security distros

Hacker
Linux distros for hacking and pentesting

Crypto mining OS

Bitcoin
Distros for mining bitcoin and other cryptocurrencies

Crypto hardware

MSI GeForce GTX 1070
Installing Nvidia GTX 1070 GPU drivers on Ubuntu

Disk guide

LVM
Beginner's guide to disks & disk partitions in Linux

Bash guide

Bash shell terminal
How to set the PATH variable in Bash
Categories
Archives
1
0
Hya, what do you think? Please comment.x
()
x