Bug Bounty Information

What was the Bug Bounty Express on Evitag NFC HSM at CONAND 2018?

The Bug Bounty Express on Evitag NFC HSM was a security challenge that consisted of detecting vulnerabilities on the product Evitag NFC HSM. The product included an Android application and an NFC electronic module. The challenge was to recover the login and password hosted inside an Evitag NFC HSM safe.

The Bug Bounty Express lasted for two days, from 10 am to 6:30 pm, on February 7 and 8, 2018. It was free and open to anyone who wanted to participate. It took place on the Fullsecure booth at the Congress Center of Andorra la Vella, where five Evitag NFC HSM devices were available for testing. Each device contained five labels, five login and five passwords, brute force enabled with administrator password and jamming enabled. One device was dedicated to physical brute force attacks (Tamper-proof).

Each participant had to register online and submit their vulnerability reports online. The material provided for testing included an oscilloscope, a NFC reader card for PC, a professional thermal sensor with thermal image capture, a WIFI router for creating a local network for the EVILOCK NFC function, and the Android application and the web plugins for Evitag NFC HSM.

The participant was free to use any type of material to carry out their attacks. The participant brought their material under their sole responsibility, such as computer, smartphone, measuring devices and/or radio frequency.

For physical brute force attacks, the participant had to bring their tools and/or physical attack solutions. However, tools and/or solutions that could harm the physical integrity of people were prohibited within the framework of the CONAND event. In the event that the participant wanted to carry out this type of test, they had to make an explicit and motivated request. The request accepted by Fullsecure, had to be carried out outside the framework of the event in a secure environment by the participant. At least one witness was present during the physical attack and was filmed by a person from Fullsecure.

In general, all brute force attacks were allowed, whether passive and/or intrusive.

What were the rewards for the Bug Bounty Express on Evitag NFC HSM at CONAND 2018?

The rewards for the Bug Bounty Express on Evitag NFC HSM were as follows:

• For each vulnerability detected, the participant received a certificate of participation and a trophy with the name of the vulnerability and the name of the participant.
• For the first vulnerability detected, the participant received a gift voucher of 100 euros.
• For the second vulnerability detected, the participant received a gift voucher of 200 euros.
• For the third vulnerability detected, the participant received a gift voucher of 300 euros.
• For the fourth vulnerability detected, the participant received a gift voucher of 400 euros.
• For the fifth vulnerability detected, the participant received a gift voucher of 500 euros.

The maximum amount of rewards per participant was 1500 euros. The rewards were cumulative and could be combined with other rewards offered by other partners of the event.

Buy

How to get Evitag NFC HSM?

Evitag NFC HSM is a product marketed in white label by Fullsecure, a company specialized in the distribution of IT security solutions. To learn more about Evitag NFC HSM or to place an order, you can contact Fullsecure at the following coordinates:

How to join the Bug Bounty Express on Evitag NFC HSM?

If you are interested in joining the Bug Bounty Express on Evitag NFC HSM, you can find more information about the challenge, the rules, the rewards and the registration process on the following link: Bug Bounty Express on Evitag NFC HSM. This is a great opportunity to test your skills, learn new techniques and earn incentives for finding vulnerabilities on this innovative product. Don’t miss this chance to join the cybersecurity community and contribute to making the digital world safer.