Just a few weeks to go and the new result determination system of the cantons of St. Gallen and Thurgau will be transferred to the Public Bug Bounty Program. Time for a first report.
The gateway to the Private Bug Bounty Program: users registering here submit their findings to Abraxas in a structured manner and receive a reward based on criticality worth up to 10,000 Swiss francs.
More than 100 security researchers have accepted the offer since the program was launched at the end of May 2022. The number of those working with the result determination system and searching for vulnerabilities has grown continuously.
The Abraxas team has used the smooth launch of the program to optimally align the first Abraxas Bug Bounty program of the IT service provider for digital Switzerland’s researcher community managed by its partner Bug Bounty Switzerland.
The product and security team continuously analyses what attackers are focusing on and initiate appropriate in-house measures. Teams that work on different components and are affected by the findings are coordinated more closely.
«The program is very successful, provides valuable insights, and is great fun for all involved», says Sandro Nafzger, CEO of Bug Bounty Switzerland.
Currently, more than 100 ethical hackers and security researchers have been invited to join the program. 16 reports have already been received, six of which were accepted as valid vulnerabilities and rated as follows: 2 low, 4 medium, 0 high, 0 critical. A total of CHF 9,400.– was paid out in bounties. The security researchers receive a qualified response immediately. The average response time for the Abraxas Private Bug Bounty Program is 1 d 6 h 21 min – for the whole analysis.
A challenging task
The result determination system may seem rather unusual to many of the security researchers. Normally, such key digital democracy systems are not publicly accessible. The vulnerabilities are not easy to find as confirmed by the security researchers we talked to and we assume that there are still some to be found.
The challenging task is to find in the complex software, which consists of several modules, the gaps which might endanger the democratic process by enabling voting and election results to be falsified without anyone noticing.
Improving the skills of all program participants
As part of its «security through transparency» concept, Abraxas provides the security researchers with the source code of the result determination system. This makes it easier for them to verify and document their findings. They are also given access to a pre-release version of the actual system plus the peripheral systems. Researchers can also assume different roles in the system, thus creating the optimum conditions to search for vulnerabilities – with a comprehensive setup.
Participating in the Abraxas Bug Bounty Program hones the skills of the security researchers. It also enables Abraxas to continuously audit its own security processes during development and to improve software resilience. In addition, it is also important to me and the team to interact with the security researchers on an equal footing, to respond quickly and to address their findings individually. A big thank you to everyone who has contributed to the security of Switzerland with their findings so far.
Register yourself now
To participate in the private program, you can register here - later the program will become public. Until then, participants in the private program enjoy benefits.
Application link: www.bugbounty.ch/hacker/?application_to_program=Abraxas
