Positive dream hunting

Positive Technologies invites bug hunters to have a go at realizing events that are not tolerable for the company—namely, a funds theft and code injection. The winner will get 60,000,000 rubles.

Positive Technologies is a leading global provider of cybersecurity solutions. Over 2,300 organizations worldwide use technologies and services developed by our company. For more than 20 years, our mission has been to safeguard businesses and entire industries against the threat of cyberattacks. Positive Technologies is the first and only cybersecurity company in Russia to go public on the Moscow Exchange (MOEX: POSI).

Positive Technologies

Positive dream hunting · Bug Bounty

You will have to figure out how business processes work and what systems are involved, before trying to transfer up to 2,499 rubles from the company account to any account under your control. You must be the one who initiated the transaction, and the transaction must be processed by a bank. Transferring money to our employee is not considered a non-tolerable event. 
You must not exceed the specified amount. If you break the rules, you may face negative consequences outside of our control.
You are not allowed to directly affect bank systems used for money transfer and move funds within PJSC Positive Group.

Theft of funds

One of our company's core activities is developing information security tools, which are used by a variety of organizations. You are not allowed to penetrate our customers' networks using our solutions or updates. You have to figure out how the product creation and update procedures are carried out and attempt to disrupt the development process at any stage (code handled by developers, code in the storage systems, software build, storage, or updates).

Code injection (supply chain attack)

Positive Technologies specializes in developing information security solutions. Will you be able to paralyze the company's business? If so, you will gain never-fading hacking glory while also making bank.

**₽60 million reward for stealing funds or injecting code**

Realize a non-tolerable event by stealing funds from Positive Technologies accounts or injecting hypothetically malicious code into the company's products—and get a well-deserved reward. Please see the terms and conditions. 
The program's ultimate winner is the participant who follows the program rules and becomes the first to realize a non-tolerable event and present a report complying with the requirements and containing complete information about the attack chain.
The program's prizewinner is the participant who follows the program rules, fulfills one of the possible attack stages leading to a non-tolerable event, and presents a report complying with the requirements and containing complete information about the attack chain.

*A non-tolerable event* is an event brought about by a malicious actor and preventing the company from achieving its operational and strategic goals or leading to long-term disruption of its core activities.

## Overview of the non-tolerable events

## Theft of funds

Positive Technologies has processes related to moving funds: paying employees and partners, buying licenses and so on. You will have to figure out how business processes work and what systems are involved, before trying to transfer up to 2,499 rubles from the company account to any account under your control. You must be the one who initiated the transaction, and the transaction must be processed by a bank. Transferring money to an employee of Positive Technologies is not considered a non-tolerable event.
You must not exceed the specified amount. If you break the rules, you may face negative consequences outside of our control.
You are not allowed to directly affect bank systems used for money transfer and move funds within PJSC Positive Group.

## Code injection (supply chain attack)
One of our company's core activities is developing information security tools, which are used by a variety of organizations. You are not allowed to penetrate our customers' networks using our solutions or updates. You have to figure out how the product creation and update procedures are carried out and attempt to disrupt the development process at any stage (code handled by developers, code in the storage systems, software build, storage, or updates). The following scheme outlines the development process.

![image](https://api.standoff365.com/api/bug-bounty/program/docs/438bef80-e71d-4ae0-9c00-56afa4a63dcc)
 
Updates are distributed through front local update servers (FLUS) at update.ptsecurity.com. The manager of each product controls the availability of updates by allowing update downloads from internal global update servers (GUS) at gus.ptsecurity.com. Allowing downloads on a GUS server makes the build available for download from FLUS servers. That means it is necessary to ensure that a modified build appears on one of the update servers (FLUS or GUS) and that you have permissions to allow the build to be downloaded. 
To realize this non-tolerable event, you must do one of the following: 
* Place a hypothetically malicious function build (modified by potentially malicious code) on public update servers at update.ptsecurity.com and provide proof that the build can be made available for download.
* Place a hypothetically malicious function build (modified by potentially malicious code) on an internal update server at gus.ptsecurity.com and provide proof that the build can be made available for download from public servers.

**Important:** You must not distribute a modified build across the servers. You should only provide a screenshot demonstrating that you have the necessary permissions. 

*Note. A hypothetically malicious function build means a build with modified release content (docker containers, ZIP archives, and so on) or any other build with payload (non-malicious function code) that ensures correct installation of the solution and operation of its basic features. You must not add any functionalities that pose a security threat to users of the products.*

We understand that you and other program participants can encounter blind spots in certain circumstances. For example, if you made changes to a GitLab repository and then were kicked out of the infrastructure by our SOC specialists, you will not be able to see whether the changes have reached the final stage. In that case, we suggest that you submit a report describing your actions to become a prizewinner. The committee will analyze your results and assign you a fair reward. 
Note that, apart from public release cycles, there are feature and test cycles. Rewards are not guaranteed for code injections performed within a non-release (nonpublic) development cycle: the committee will decide whether to reward researchers in such cases. 

## Scope

The scope includes the resources and Wi-Fi network that belong to Positive Technologies. We encourage you to be inventive and use OSINT methods to discover our resources. Electrical outlets for computers and other devices for physical connection in our offices are off-limits.

## Participation requirements

Participants must be at least 18 years old. Researchers aged 14–18 are allowed to participate only with the written consent of a parent or a legal representative.

You cannot participate if:

* You are a Positive Technologies employee.
* You are a former Positive Technologies employee who terminated their contract less than three years ago.
* You are a Positive Technologies partner who has access to the Positive Technologies infrastructure to perform work-related duties.
* You consulted Positive Technologies regarding information security and information technologies—that is, you were given information about the company infrastructure within the last three years to perform work-related duties.

Participants' obligations:

* Follow the report disclosure rules of the Positive Technologies program and the Standoff 365 Bug Bounty platform.
* Follow the rules related to sensitive information. Do not distribute any information that you accidentally come across when researching the infrastructure or attempting to realize a non-tolerable event.
* Do not disclose information concerning your research without the company's explicit agreement. If you have any questions, contact the security team using the Standoff 365 Bug Bounty platform.
* Maintain communication with the security team, send them reports on your attempts to realize non-tolerable events according to the program requirements, and provide feedback if they have questions about the report.

*Note. You must send a report when you penetrate the network perimeter. You can send it after you get kicked out of the infrastructure.*

## Positive Technologies obligations

Positive Technologies has the following obligations:

* Take researchers seriously and kick them out of the infrastructure ASAP.
* Do not make baseless accusations towards researchers.
* Respect researchers. If researchers stay in line with the program requirements and rules, Positive Technologies waives any claim against them.

## Public disclosure of your research

By default, you are not allowed to disclose information. **Public disclosure may be possible if a mutual agreement between you and Positive Technologies** is achieved. You can publish a report after finalizing details and the depth of information disclosure with us.

## Prohibited actions

You are not allowed to do the following:

* Get hired to work for Positive Technologies to gain legal access to its systems and realize non-tolerable events.
* Bribe or collude with our employees.
* Get help from our employees (for any kind of cover-up, simplified access and realization of non-tolerable events, or use of company equipment).
* Influence our employees in any way that may pose a threat to their health and life, or kidnap employees and members of their families. You are not allowed to steal any devices, gadgets, or any other property belonging to our company or employees.
* Physically damage company property or use brute force to realize non-tolerable events. Perform physical attacks on Positive Technologies employees, data centers, or offices.
* Bribe, collude with or influence the company service providers and partners.
* Get hired to work for a company that provides services to Positive Technologies or a partner company to realize non-tolerable events.
* Exploit any mistakes, security issues, or vulnerabilities for personal gain.
* Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
* Conduct attacks that compromise integrity and availability of services (for example, DoS attacks) or attempt to exploit a vulnerability to cause resource exhaustion. 
* Delete any information that belongs to the company if it is not required to conceal any traces of your presence in the infrastructure. (You can delete records of your actions in security logs and your own artifacts.)
* Conduct attacks against Positive Technologies clients and partners—for example, using social engineering (phishing, vishing, and so on) and spamming. However, you can send phishing emails to Positive Technologies employees.

## Bounty

If you are the first to realize a non-tolerable event and provide a report about it, you will receive 60 million rubles (before tax). There can be only one winner. The bounty is payed in rubles. If the payment method is changed, the winner will be responsible for all fees and expenses.
Positive Technologies may award researchers for intermediate results if they execute a step or several consecutive steps leading to a non-tolerable event. For example, a researcher manages to penetrate the perimeter, gain access to the payment software, create a bank transfer order, and then gets kicked out of the infrastructure. 

Rewards for prizewinners:
* Breaching the network perimeter and gaining a foothold on a host within the infrastructure: 300,000–500,000 rubles (depends on the type of the host, account, or segment where this was achieved). 
* Making changes to release branches of product repositories that contain artifacts included in the final public release using an account with sufficient permissions: up to 1 million rubles.
* Introducing changes to the release build pipeline of a public artifact at the CI stage: up to 2 million rubles.
* Injecting code into a public product release at the storage or test stage: 3–5 million rubles.
* Injecting code into a public product release on update.ptsecurity.com servers: up to 10 million rubles.
* Gaining access to the accounting and payment order generation system under an account relevant for the non-tolerable event or under a privileged account: up to 2 million rubles.
* Gaining access to the payment system under a privileged account pertaining to a financial staff member: 3–5 million rubles.
* Sending a payment order that is then rejected by the bank: up to 10 million rubles.

Within this program, no reward is provided for the following:
* Reports on any vulnerabilities.
* Reports on configuration flaws.
* Other reports that do not contain information about the realization of a non-tolerable event.

*Note. Check out our [other program](https://bugbounty.standoff365.com/programs/ptsecurity) dedicated to uncovering vulnerabilities and configuration flaws in the infrastructure.*

## Report requirements

The report must contain the following:

•	Evidence that you managed to enter the infrastructure through the Positive Technologies network perimeter.
•	Research details (technical description), including the method you used to penetrate the infrastructure, timestamps for each step, all affected systems, compromised users, details on how the non-tolerable event was realized, how you concealed your presence in the infrastructure, and information about artifacts used.
•	Information about used exploits and their listing.
•	Recommendations for remediation.

*Note. If some parts of the report are unclear or controversial or there are gaps in the description, the committee can ask you to clarify these parts and provide additional information. If you ignore these requests, your report may be rejected.*

In the technical description, list the steps that resulted in the non-tolerable event (or your steps until you were kicked out of the infrastructure). For example, the chain may consist of the following steps:

&nbsp;

```
21.02.2022 20:22 Scanned ports on host xxx.xx.xxx.xx (detected port 3389). 
21.02.2022 20:24 Bruteforced via RDP (the user:qwerty account).
21.02.2022 20:32 Local reconnaissance on host (found software vulnerable to CVE-XXXX-XXXXX related to privilege elevation).
21.02.2022 20:55 Privilege elevation using vulnerability. Dug in on host (created SUPERUSER account with admin permissions). 
21.02.2022 21:34 Reconnaissance in local network (detected host yyy.yyy.yyy.yyy vulnerable to BlueKeep).
21.02.2022 22:22 Moving deeper into network (RCE via BlueKeep).

<…>
```

&nbsp;


## Files uploaded to an attacked host

Specify in a report if, during the step, you uploaded any software or files to the attacked host and then used them for the attack.

Examples:

* cmd911.jsp: web shell uploaded to the /test/test/ directory.
* reGeorg: software for building a tunnel to the /test/test/ directory.
* pypykatz.py: software for extracting credentials from the OS memory to the /test/test/ directory.

You can attach video files and screenshots to a report, but they cannot replace the report.