Innostage

Innostage is a Russian IT company, developer, system integrator, and information security cyberarchitect.
Innostage's infrastructure is built on its own cyber-resilience framework, which is a comprehensive five-stage approach that covers all levels and aspects of IT and cybersecurity, integrates best practices and industry expertise, and has already been tested on real projects. Cyber evaluation is a great way to verify the effectiveness of this approach.

Innostage · Bug Bounty

Исследователю необходимо разобраться в том, как работают бизнес-процессы, какие системы в них участвуют, и попробовать перевести до 2000 рублей со счета компании на любой подконтрольный себе счет. Транзакция должна быть инициирована исследователем и пройти через банк. Перевод денег сотруднику компании не считается реализацией недопустимого события.
Нельзя превышать указанную сумму. При нарушении условия для исследователя могут наступить негативные последствия, на которые компания не сможет повлиять.
Запрещены прямое воздействие на системы банков, обеспечивающих проведение платежей

Хищение денежных средств

Innostage Group specializes in information security. Will you be able to realize its non-tolerable event? If you can, there's a bounty in it for you!

**5 million rubles** for withdrawing funds from the company's account

Realize a non-tolerable event by stealing funds from the Innostage Group account and get a hard-earned reward. 
Please see the terms and conditions. 
The program's ultimate winner is the participant who follows the program rules and becomes the first to realize the non-tolerable event and present a report complying with the requirements and containing complete information about the attack chain.
The program's prizewinner is the participant who follows the program rules, fulfills one of the possible attack stages leading to the non-tolerable event, and presents a report complying with the requirements and containing complete information about the attack chain.

A **non-tolerable event** is an event caused by a malicious actor that prevents the company from achieving its operational and strategic goals or leads to long-term disruption of the company's core activities.

## Description of Innostage's non-tolerable event

## Theft of funds

Innostage has multiple processes related to moving funds: paying employees and partners, buying licenses, and so on. You will have to figure out how business processes work and what systems are involved, before trying to transfer up to 2,000 rubles from the company's account to any account under your control. You must be the one who initiated the transaction, and the transaction must be processed by a bank. Transferring money to an Innostage employee is not considered a non-tolerable event.
You must not exceed the specified amount. If you break the rules, you may face negative consequences outside of the company's control.
You are not allowed to directly affect bank systems used for money transfer.


## Scope

The program scope includes the Wi-Fi network and resources owned by Innostage Group. Researchers are encouraged to be inventive and use OSINT methods to discover the company's resources. Electrical outlets for computers and other devices for physical connection in the company's offices are off-limits.

*Note. Innostage Group includes the following legal entities: LLC Innostage (OOO "Innosteydzh"), LLC Artko (OOO "Artko"), LLC Innostage Development Center (OOO "Innosteydzh Tsentr Razrabotok," aka "Innostage DC"), and LLC Telecom Integration (OOO "Telekom Integratsiya").*

## Participation requirements

Participants must be at least 18 years old. Researchers aged 14–18 are allowed to participate if they can present the written consent of a parent or a legal guardian.

The following persons **cannot** participate in the program:

* Innostage Group employees.
* Former Innostage Group employees who terminated their contract less than three years ago.
* Innostage Group partners who have access to the Innostage Group infrastructure to perform work-related duties.
* Individuals who have consulted Innostage Group regarding information security and information technologies—that is, individuals who were given information about the company infrastructure within the last three years to perform work-related duties.

Participant obligations:

* Follow the report disclosure rules of this Innostage Group program and the Standoff Bug Bounty platform rules.
* Follow the rules related to the handling of sensitive information. Do not distribute any information that you accidentally come across when researching the infrastructure or attempting to realize a non-tolerable event.
* Do not disclose information concerning your research without the company's explicit agreement. If you have any questions, contact the security team using the Standoff Bug Bounty platform.
* Maintain communication with the security team, send them reports on your attempts to realize a non-tolerable event according to the program requirements, and provide feedback if they have questions about your report.

*Note. You must submit a report if you penetrate the network perimeter. You can submit it after you get kicked out of the infrastructure.*

## Innostage Group obligations

As part of this program, Innostage Group has the following obligations:

* To take researchers seriously and kick them out of the infrastructure ASAP.
* To not make baseless accusations towards researchers.
* To respect researchers. If researchers follow the program requirements and rules, Innostage Group waives any claim against them.

## Public disclosure of your research

By default, you are not allowed to disclose information. **Public disclosure may be possible if a mutual agreement between you and Innostage Group is achieved** regarding details and the depth of information disclosure.

## Prohibited actions

You are not allowed to do the following:

* Get hired to work for Innostage Group to gain legal access to its systems and realize non-tolerable events.
* Bribe or collude with the company's employees.
* Get help from the company's employees (for any kind of cover-up, simplified access and realization of non-tolerable events, or use of company equipment).
* Influence the company's employees in any way that may pose a threat to their health or life, or kidnap employees and members of their families. You are not allowed to steal any devices, gadgets, or any other property belonging to the company or employees.
* Physically damage company property or use brute force to realize non-tolerable events. Perform physical attacks on the company's employees, data centers, or offices.
* Bribe, collude with or influence the company's service providers and partners.
* Get hired to work for a company that provides services to Innostage Group or a partner company to realize non-tolerable events.
* Exploit any mistakes, security issues, or vulnerabilities for personal gain.
* Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
* Conduct attacks that compromise integrity and availability of services (for example, DoS attacks) or attempt to exploit a vulnerability to cause resource exhaustion. 
* Delete any information that belongs to the company if it is not required to conceal any traces of your presence in the infrastructure. (You can delete records of your actions in security logs and your own artifacts.)
* Conduct attacks against Innostage Group clients and partners—for example, using social engineering (phishing, vishing, and so on) and spamming. 
*Note. The only form of social engineering that you may use within this program is sending phishing emails to Innostage Group employees' corporate email addresses. Phishing attacks via social networks and messengers (including Telegram) are prohibited.*

## Bounty for realizing the non-tolerable event

If you are the first to realize the non-tolerable event and provide a report about it, you will receive 5 million rubles (before taxes). There can be only one winner. The bounty is paid in rubles. If the payment method is changed, the winner will be responsible for all fees and expenses.
Innostage Group may award researchers for intermediate results if they execute a step or several consecutive steps leading to the non-tolerable event. For example, a researcher manages to penetrate the perimeter, gain access to the payment software, create a bank transfer order, and then gets kicked out of the infrastructure. 


Within this program, no reward is provided for the following:
* Reports on configuration flaws.
* Other reports that do not contain information about the realization of the non-tolerable event.

## Additional rewards

Within this program, the following events are rewarded as such:

* Compromising a company user's corporate account and gaining persistence on the workstation: 100,000 rubles.
* Breaching the network perimeter and gaining persistence on a host within the infrastructure: 200,000–300,000 rubles (depending on the type of the host, account, or segment where this was achieved). 
* Gaining access to the accounting and payment order generation system, either under an account relevant to the non-tolerable event or under a privileged account: up to 1 million rubles.


## Report requirements

The report must contain the following:

* Evidence that you managed to enter the infrastructure through the Innostage Group network perimeter.
* Research details (technical description), including the method you used to penetrate the infrastructure, timestamps for each step, all affected systems, compromised users, details on how the non-tolerable event was realized, how you concealed your presence in the infrastructure, and information about artifacts used.
* Information about used exploits and their listing.
* Recommendations for remediation.

*Note. If some parts of the report are unclear or controversial or there are gaps in the description, the committee can ask you to clarify these parts and provide additional information. If you ignore these requests, your report may be rejected.*

In the technical description, list the steps that resulted in the non-tolerable event (or your steps until you were kicked out of the infrastructure). For example, the chain may consist of the following steps:

&nbsp;

```
2024-06-21 20:22 Scanned ports on host xxx.xx.xxx.xx (detected port 3389). 
2024-06-21 20:24 Bruteforcing via RDP (the user:qwerty account).
2024-06-21 20:32 Local reconnaissance on the host (found software vulnerable to CVE-XXXX-XXXXX related to privilege escalation).
2024-06-21 20:55 Privilege escalation by exploiting the vulnerability. Dug in on the host (created a SUPERUSER account with admin permissions). 
2024-06-21 21:34 Reconnaissance in the local network (found host yyy.yyy.yyy.yyy vulnerable to BlueKeep).
2024-06-21 22:22 Moving deeper into the network (RCE via BlueKeep).

<…>
```

&nbsp;

## Files uploaded to an attacked host

Specify in a report if, during the step, you uploaded any software or files to the attacked host and then used them for the attack.

Examples:

* cmd911.jsp: web shell uploaded to the /test/test/ directory.
* reGeorg: software for building a tunnel to the /test/test/ directory.
* pypykatz.py: software for extracting credentials from the OS memory to the /test/test/ directory.

You can attach videos and screenshots to your report, but they cannot replace the report (it must be filled out).