Devices - Penetration Testing Like a Hacker. - SecNiche Security Labs

(NEW) STANDARDSof Hatforce. Before they can see any details aboutthe test, the testers first have to sign the contractwith the client. This contract also includes an NDA(non-disclosure agreement), so that the testersshall not divulge any information about the test tothird parties.Crowd-sourcing seems not so well suitable forwhite-box penetration tests on proprietaryproducts, since the source code cannot be madeavailable in public.The testers are then able to start testing the client’sproduct. During the testing they should fill in a socalled test procedure.The test procedure is basically a description of whatthe tester has done during his test. The client will beable to visualize the descriptions and see what kind ofactions the tester has performed on the product. Thisgives the client the possibility to verify that no illegalhacking attempt has been conducted.3. Once a penetration tester has found avulnerability during a test procedure, he has tosubmit it on the website of hatforce.com. Theclient gets immediately informed about it andshould test it.Figure 2. Example of a test procedure description on Hatforce.com4. The client should be able to easily test thevulnerability by following the description providedby the penetration tester. If no any other tester hasfound the same vulnerability before, the client hasto pay the tester the specified reward.5. If the client approves the vulnerability, he pays theestablished reward to the corresponding tester.The marketNowadays on the IT Security market, a penetration testcosts approximately 200$ per hour and can becomemuch more expensive, depending on the experienceof the penetration tester. Usually the client has togive the most of information to the tester about itsproduct, because it is too expensive for a professionalpenetration tester to collect all the information freelyavailable by himself. Consequently, pure black-boxtests are not conducted very often. Unfortunately,exactly these tests represent at best an attack bymalicious persons.On the other side, there is the white-box testing.White-box tests make sense when the penetrationtester is highly skilled and able to analyse source codein order to find vulnerabilities. Crowd-sourcing seemsnot so well suitable for white-box penetration tests onproprietary products, since the source code cannotbe made available in public. Nevertheless, white-boxtests are possible for open source products and couldmaybe prevent people from hiding backdoors withinthem [7].There exist already on the market a couple ofplatforms which also involve crowd-sourcing intheir business model. One example is the ZeroDay Initiative (ZDI) from HP which rewards securityresearchers for the vulnerabilities they find in verypopular IT-products. However, their platform isdifferent than Hatforce.ZDI makes security researchers an offer for submittedvulnerabilities, while on Hatforce a reward for avulnerability is entirely set by the client so that testersknow in advance how much they will be rewarded. Byletting the client to freely define the amount of moneyhe is willing to pay per vulnerability, an evolving openmarket for pentesting is created.Security testing is very expensive nowadays andconsequently, private people or even small and middlesized companies usually do not want to invest in thisdomain. However, with the increasing amount ofhacking attempts that have been conducted over thelast couple of months by hacker groups like LulzSec,even the smaller companies will have to take actionand test their products. Therefore, penetration testingshould become accessible to all types of companies05/2011 (5) SeptemberPage 38http://pentestmag.com