Organisations Paid Hackers US$23.5 Million for These 10 Vulnerabilities in One Year
By : Krishna Anindyo | Friday, October 30 2020 - 11:20 IWST

Ilustration Hackers (Photo by Microwire.info)
INDUSTRY.co.id - Singapore - In times of uncertainty, security becomes an ever more pressing priority. The stakes are high: organisations are more reliant on technology than ever and anyone relying on technology can lose everything in a data breach. But some of the most recent vulnerabilities have one thing in common: they were detected, discovered and reported by friendly hackers who can think like attackers.
“This year, organisations worldwide were forced to go digital with their product offerings and services,” said HackerOne Senior Director of Product Management Miju Han.
“Businesses scrambled to find new revenue streams, creating digital offerings for customers whose lifestyles had dramatically changed. Tens of millions of workers started working remotely whether or not they were ready. With this accelerated pace of digital transformation, CISOs had to quickly facilitate new needs while ensuring the security of existing systems. Faced with these obstacles, security leaders have gained newfound appreciation for hacker-powered security as a nimble, scalable, and cost-effective solution to augment their own resources and offer a pay-for-results approach that’s more justifiable under tightened budgets,” added Miju Han.
HackerOne maintains the most authoritative database of vulnerabilities in the industry. With over 200,000 valid vulnerabilities found by hackers, HackerOne took a look into this data to glean insights from the top 10 most impactful and rewarded vulnerability types.
HackerOne’s Top 10 Most Impactful and Rewarded Vulnerability Types of 2020, in descending order, are:
Cross-site Scripting (XSS), Improper Access Control , Information Disclosure, Server-Side Request Forgery (SSRF)
Insecure Direct Object Reference (IDOR)
Privilege Escalation
SQL Injection
Improper Authentication
Code Injection
Cross-Site Request Forgery (CSRF)
Taking a closer look at this year’s top ten in comparison to the 2019 top ten vulnerabilities, key findings include:
Cross-site Scripting vulnerabilities continue to be a major threat to web applications as attackers exploiting XSS attacks can gain control of the user’s account and steal personal information such as passwords, bank account numbers, credit card information, personally identifiable information (PII), social security numbers, and more.
The most awarded vulnerability two-years running, XSS vulnerabilities cost organisations US$4.2 million in total bounty awards, up 26% from the previous year. These bugs account for 18% of all reported vulnerabilities, but the average bounty award is just US$501.
With the average bounty for a critical vulnerability being US$3,650, this means organisations are mitigating this common, potentially painful bug on the cheap.
Improper Access Control (up from ninth place in 2019) and Information Disclosure (still holding the third spot) remain common. Awards for Improper Access Control increased 134% year over year to just over US$4 million.
Information Disclosure was not far behind, increasing 63% year over year. Access control design decisions have to be made by humans, not technology, and the potential for errors is high, and both errors are nearly impossible to detect using automated tools.
SSRF vulnerabilities, which can be exploited to target internal systems behind firewalls, show the risk of cloud migrations. Previously, SSRF bugs were fairly benign and held our seventh place spot, as they only allowed internal network scanning and sometimes access to internal admin panels.
But in this era of rapid digital transformation, the advent of cloud architecture and unprotected metadata endpoints has rendered these vulnerabilities increasingly critical.
SQL Injection is dropping year-over-year. Considered one of the worst threats to web application security by OWASP and others, the scale of SQL injection attacks can be devastating, as sensitive data, including business information, intellectual property, and critical customer data, is stored on database servers susceptible to these attacks.
In years past, SQL injection was one of the most common vulnerability types. However, our data indicate that it’s been dropping year-over-year from fifth in 2019 to seventh in 2020. By shifting security left, organisations are leveraging hackers and other methods to proactively monitor attack surfaces and prevent bugs from entering code.
“Finding the most common vulnerability types is inexpensive,” Han continued.
“Of the top 10 most awarded weakness types, only Improper Access Control, Server-Side Request Forgery (SSRF), and Information Disclosure saw their average bounty awards rise more than 10%. The others fell in average value or were nearly flat. Unlike traditional security tools and methods, which become more expensive and cumbersome as goals change and attack surface expands, hacker-powered security is actually more cost-effective as time goes on. With hackers, it’s becoming less expensive to prevent bad actors from exploiting the most common bugs.” concluded Han.
Read Also
Synopsys Recognised as a Leader in Static Application Security Testing…
Universal Robots Reaches Industry Milestone with 50,000 Collaborative…
FARO Zone 3D 2021 Software Released for Optimal Forensic Scene Documentation…
November 2020’s Most Wanted Malware: Notorious Phorpiex Botnet…
ZALORA Launches Inaugural Southeast Asia TRENDER Report
Today's Industry

Rabu, 13 Januari 2021 - 16:00 WIB
ZASCHE Handling Rolls Out New Range of Electric Balancers
the E-Balancer is a versatile tool suited for a broad range of heavy-duty industrial applications.

Rabu, 13 Januari 2021 - 15:40 WIB
What is the Cost of Poor Software Quality in the U.S.?
And if you doubt its credibility, or that it applies to software, check out the latest report from the Consortium for Information & Software Quality (CISQ), in partnership with Synopsys, “The…

Jumat, 08 Januari 2021 - 17:35 WIB
DevSecOps: The good, the bad, and the ugly
DevSecOps is the practice of integrating security into every stage of the DevOps pipeline.

Rabu, 23 Desember 2020 - 14:05 WIB
Hypertherm Introduces Extreme Bevel Plasma Consumables for its MAXPRO200 Air and Oxygen Plasma System
The MAXPRO200 is a true workhorse for companies demanding great cut quality along with high productivity and low operating costs.

Jumat, 18 Desember 2020 - 13:20 WIB
How to Cyber Security: Software Security is Everyone’s Responsibility
Software security is a kind of team project — everyone in the organisation has an impact on security and risk.
News Comment