Module 02 · Cybersecurity Ethics, Laws, and Responsible Disclosure网络安全伦理、法律与负责任披露
Reading: Bug Bounty Programs and Ethical Hacking阅读：漏洞悬赏计划与道德黑客技术
Estimated time: 4 minutes
预计时间：4 分钟
Learning objectives: 学习目标
After completing this reading, you will be able to:
完成本阅读后，您将能够：
- Identify the purpose and types of bug bounty programs
识别漏洞悬赏计划的目的和类型 - Explain the stages in the bug bounty workflow
解释漏洞悬赏工作流程中的各个阶段 - Identify the benefits of bug bounty programs for ethical hackers
说明漏洞悬赏项目对道德黑客的好处
Introduction 引言
Consider the case of a financial services organization that deals with huge volumes of customer-sensitive data. Unsurprisingly, these organizations are the most at risk of cyberattacks and consequent losses. How can such organizations protect themselves?
考虑一个处理大量客户敏感数据的金融服务组织。毫不奇怪，这些组织最容易受到网络攻击和随之而来的损失。这样的组织如何保护自己？
Let's begin by understanding the purpose of bug bounty programs.
让我们从理解漏洞悬赏计划的目的开始。
Purpose of bug bounty programs 漏洞悬赏计划的目的
Bug bounty programs are structured initiatives that allow ethical hackers to proactively identify and report security vulnerabilities in software, applications, and systems before malicious actors can exploit them. In return, researchers often receive monetary rewards, recognition, or both. These programs enable organizations to strengthen their cybersecurity posture by leveraging the global security research community.
漏洞悬赏计划是结构化的举措，允许道德黑客在恶意行为者利用它们之前，主动识别和报告软件、应用程序和系统中的安全漏洞。作为回报，研究人员通常会获得金钱奖励、认可或两者兼得。这些计划使组织能够通过利用全球安全研究社区来加强其网络安全态势。
Types of bug bounty programs 漏洞悬赏计划的类型
Next, let's look at the types of bug bounty programs. These programs fall into two main categories: public and private.
接下来，让我们看看漏洞悬赏计划的各种类型。这些计划主要分为两类：公开和私有。
| Type 类型 | Description 描述 |
|---|---|
| Public programs 公开计划 | • These programs are open to all security researchers. Anyone can submit findings as long as they adhere to the program's rules 这些计划对所有安全研究人员开放。只要遵守计划规则，任何人都可以提交发现。 • These programs are usually hosted on platforms such as HackerOne, Bugcrowd, or Open Bug Bounty. 这些项目通常托管在 HackerOne、Bugcrowd 或 Open Bug Bounty 等平台上。 |
| Private programs 私有项目 | • These programs are restricted to invited researchers. Organizations may work with select individuals under a Non-Disclosure Agreement (NDA) 这些项目仅限于邀请的研究人员。组织可能根据保密协议（NDA）与特定个人合作。 • These programs are often used for testing sensitive systems or during the early stages of deployment. 这些项目通常用于测试敏感系统或在部署的早期阶段使用。 |
Workflow of a bug bounty program 漏洞悬赏计划的流程
The standard workflow of a bug bounty program consists of four stages: discovery, submission, validation and triage, and reward and acknowledgment.
漏洞悬赏计划的标准流程包括四个阶段：发现、提交、验证和分诊，以及奖励和认可。
Let's examine what happens in each of these stages.
让我们看看每个阶段会发生什么。
Discovery: A security researcher identifies a potential vulnerability within the scope defined by the program.
发现：安全研究员在计划定义的范围内识别出潜在的漏洞。
Submission: The vulnerability is reported through a structured submission platform, usually requiring detailed reproduction steps and evidence.
提交：漏洞通过结构化提交平台报告，通常需要详细的复现步骤和证据。
Validation and triage: The organization's security team verifies the issue and assesses its severity and potential impact.
验证和分诊：组织的安保团队验证问题，并评估其严重性和潜在影响。
Reward and acknowledgment: If the report is valid and unique, the researcher receives a reward based on the severity of the vulnerability, scope of impact, and novelty of the discovery.
奖励和认可：如果报告有效且独特，研究人员将根据漏洞的严重性、影响范围和发现的创新性获得奖励。
Notable bug bounty programs 值得注意的漏洞悬赏计划
Let's take a look at some of the prominent bug bounty programs.
让我们来看看一些著名的漏洞悬赏计划。
| Organization 组织 | Program highlights 计划亮点 |
|---|---|
| Google VRP 谷歌漏洞赏金计划 | Google's Vulnerability Reward Program (VRP) offers up to $31,000 for valid remote code execution vulnerabilities. 谷歌的漏洞悬赏计划（VRP）为有效的远程代码执行漏洞提供高达 31,000 美元的奖励。 |
| Facebook bug bounty 脸书漏洞悬赏 | In 2020, Facebook paid over $2 million USD in bounties to researchers worldwide. 2020 年，脸书向全球的研究人员支付了超过 200 万美元的悬赏。 |
| Microsoft bounty Program 微软悬赏计划 |
Microsoft offers bounties as high as $250,000 for critical vulnerabilities in its platforms. 微软对其平台中的关键漏洞提供高达 25 万美元的悬赏。 |
Benefits to ethical hackers 对道德黑客的好处
Participating in bug bounty programs offers several advantages for ethical hackers.
参与漏洞悬赏计划为道德黑客提供了几个优势。
Monetary compensation: High-severity vulnerabilities can yield substantial financial rewards.
经济补偿：高严重性漏洞可以获得可观的财务回报。
Professional recognition: Top contributors often gain public acknowledgment, invitations to private programs, and career opportunities.
专业认可：顶尖贡献者通常获得公众认可、受邀参加私人项目以及职业发展机会。
Legal protection: Researchers operate within a clearly defined and authorized scope, reducing legal risks associated with independent testing.
法律保护：研究人员在明确界定且获授权的范围内进行操作，从而降低独立测试相关的法律风险。
Challenges and considerations 挑战与考量
Despite the benefits, bug bounty programs have some inherent challenges.
尽管有诸多益处，但漏洞悬赏计划也存在一些固有挑战。
Duplicate submissions: If another researcher has submitted the same vulnerability first, your report may not qualify for a reward.
重复提交：如果另一位研究人员首先提交了相同的漏洞，您的报告可能无法获得奖励。
Strict scoping rules: Programs define rules based on the scope. Any violation of those rules may lead to disqualification or account suspension.
严格的范围规则：项目根据范围制定规则。任何违反这些规则的行为都可能导致取消资格或账户暂停。
Reward variability: Payout amounts vary significantly between programs and are often determined by impact, reproducibility, and the organization's discretion.
奖励的差异性：不同项目之间的支付金额差异很大，通常由影响、可重复性和组织的自由裁量权决定。
Summary 摘要
In this reading, you've learned about the various aspects of bug bounty programs.
通过本次阅读，您了解了漏洞悬赏项目的各个方面。
- Bug bounty programs represent a collaborative approach to cybersecurity, bridging the gap between independent researchers and organizations.
漏洞悬赏计划代表了一种协作式的网络安全方法，连接了独立研究人员与组织。 - The standard workflow of a bug bounty program includes four stages: discovery, submission, validation and triage, and reward and acknowledgment.
漏洞悬赏计划的标准工作流程包括四个阶段：发现、提交、验证与分诊，以及奖励与认可。 - By participating ethically and professionally, security researchers can help build a safer digital world while gaining rewards and recognition for their contributions.
通过合乎道德和专业地参与，安全研究人员可以在获得奖励与认可的同时，帮助构建一个更安全的数字世界。