NEW MyXL Bug Bounty Program

XL

Rp0 ~ Rp11.000.000Total reward

Description

PT XL Axiata

PT XL Axiata Tbk (formerly PT Excelcomindo Pratama Tbk), is an Indonesia-based mobile telecommunications services operator headquartered at Jakarta. It is the second largest mobile telecommunications company in Indonesia. The operator’s coverage includes Java, Bali, and Lombok as well as the principal cities in and around Sumatra, Kalimantan and Sulawesi. XL offers data communication, broadband Internet, mobile communication and 3G services over GSM 900 and GSM 1800 networks.

Initially, XL provided cellular mobile telephony services using the GSM 900 technology. A few years after launching services, the company was awarded a license for implementing a DCS 1800 network, and to operate an ISP and VoIP service. In 2006, XL obtained a 3G license, which services launched in September of the same year.

At the end of 2010, the company had more than 22,000 BTS towers across Indonesia. XL is the second largest mobile network operator in Indonesia, with a subscriber’s strength of 55.1 million users.

Shares of XL surged in May 2019, one day after Axiata Group announced talks with Norway’s Telenor aimed at combining their Asian operations.

Target info

SCOPE

The targets included in this program are web applications and mobile applications with the URL that can be access at the link below:

Android: https://drive.google.com/file/d/1w65PAe0IdOFLioJgkoogXBTtsNUcOH4H/view?usp=sharing

UPDATES:
05/06/24: Reward has been raised. see reward section for detail

All of the target bellow will be considered as out of scope eventhough the severity is critical: Bizstore e-atp tvkamu Laut Nusantara Sisternet flexiot XL Store

**All of the API key/secret key below will be considered as out of scope:

  1. firebase database url
  2. google api key
  3. google crash reported api key
  4. hansel app key
  5. msisdn enumeration / harvesting**

Known issues:
Please note that the XL Axiata Security Team also actively looks for vulnerabilities across all assets internally. Vulnerabilities listed below marked as known issues:

  1. HMAC Bypass using legacy endpoint API
  2. Fraud Indications using legacy endpoint API

Test Number:
Please use Indonesian mobile number XL. We use OTP to validate your number during login.

**WARNING:

  • Disclosing all kinds of vulnerabilities / submissions in this program to the public are prohibited, Researchers who do so will be banned and all awards will be annulled in this program **

* XL also want to know the vulnerability in other targets that are out of scope but can have a CRITICAL / HIGH impact on XL, either directly or indirectly (for example through 3rd party apps). For this reason, if researcher finds a new target outside the list listed above that has a CRITICAL / HIGH risk, please contact the RedStorm team via email to be considered for a reward*

[email protected]

RULE OF THE GAME

Reporting must go through the ’Submit Report’ feature on the RedStorm web application by including evidence and how to exploit it.
The level of risk from the findings can be selected and considered by the researcher provided are:

  • P1 - Critical
  • P2 - High
  • P3 - Moderate
  • P4 - Low
  • P5 - Information / Other

The points to be awarded by the system are:

  • P1 - 100
  • P2 - 50
  • P3 - 20
  • P4 - 10
  • P5 - 5

Prizes / rewards that will be given depend on considerations of security risks following the following scheme:

  • P1 - IDR 11.000.000 (+ Points)
  • P2 - IDR 7.000.000 (+ Points)
  • P3 - Points
  • P4 - Points
  • P5 - Points

The P1 Reward is only specifically for researchers who managed to find security bug that found the following data:

  1. Selfie photos
  2. Signature photo
  3. ID card photo
  4. Population data
  5. Financial Information such as payment data

GUIDELINES FOR CONDUCT

RedStorm wants to create a business environment that is safe and upholds ethical professionalism.
For this reason, there are three main aspects that every security researcher who participates in programs on our platform should pay attention to:

  • CONFIDENTIALITY - All reported security vulnerabilities should not leak into public spaces.
  • INTEGRITY - Only report security issues that are deemed valid and do not use the findings of the security vulnerabilities for tampering purposes. If there is more than 1 report regarding the same security problem, then the first one to report will be considered valid.
  • PROFESSIONALISM - Security researchers are fully responsible for the findings reported and should be contacted if necessary for explanation or other complementary information.

ACCEPTANCE CRITERIA

Submission process
If you believe you have found a security vulnerability, please file a report for the program concerned through RedStorm platform.
Any security vulnerability report submissions will be treated with high priority, including when the report is validated, when we need more information from you, or when you qualify for a reward. Each submission is evaluated by us on a first-in first-served basis.

* Basic Rules *
RedStorm is committed to protecting the interests of security researchers.
The more your behavior follows these rules, the more we can protect you in the event of an uneasy disclosure situation.

Each program can have varying rules.
Please carefully read the Program Summary for specific regulations, if any.
However, the following rules apply to all programs:

  • Research that is carried out should only be on systems listed under the ’Scope’ section of the Program Brief. Any other system is beyond its scope.
  • Unless otherwise stated in the Program Summary, you must create test accounts for research purposes.
  • Submissions must be made EXCLUSIVELY through RedStorm to be considered a prize.
  • Submission-related communications must remain within RedStorm or the official RedStorm support channels during the disclosure process.
  • Actions that affect the integrity of the target program or destabilize it are prohibited. If you notice a decrease in performance on the target system, you should immediately suspend all use of automated tools.
  • The submission must have impact on the target’s security posture. Impact means a reported issue affecting the target user, system, or data security in a significant way. Researcher can be asked to keep the impact confidential in order to be eligible for the prize.
  • Submissions may be closed if the researcher is not responsive to requests for additional information after 7 business days.
  • The existence or details of programs are private or invitation may not be communicated to anyone who is not a RedStorm employee or an authorized employee of the organization responsible for the program.
  • We encourage researchers to include videos or screenshots (proof-of-concept) in reporting security vulnerabilities. These files may not be shared publicly. This includes uploading to any website that is publicly accessible (like Vimeo, Imgur, etc.). If the file exceeds 50 MB, upload the file to a secure online folder such as Dropbox that is protected with password.
  • The RedStorm Disclosure Policy applies to all submissions made through the RedStorm platform, including for Duplicate, Out of Scope, and Not Applicable findings reports. Program owners can choose a Disclosure, Coordinated Disclosure, or Specific Information Disclosure Policy to apply to their program summary. Please see our Additional Disclosure Policy for details on the different Public Disclosure Policies on RedStorm.
  • If a researcher wishes to retain disclosure rights for vulnerabilities that are outside the scope of a program’s scope, he or she must report the problem to the relevant vendor directly. RedStorm can assist researchers in identifying suitable email addresses to contact. Program owners are encouraged to ensure that their program coverage includes all the critical components for which they wish to receive vulnerability reports.
  • Violation of the disclosure policies stated by the program may result in enforcement action as outlined in the RedStorm Terms of Service.

Violation of these rules may result in the cancellation of delivery and confiscation of all prizes, both for current and future programs on the RedStorm platform.

* Types of Accepted Submission *
Below are the types of submission that are preferred to be accepted:
*Bypass Authentication & Authorization Login
*Account Take Over (ATO)

  • HMAC Bypass from the provided APK
  • Fraud Indication from the provided APK

* Types of Submission Excluded *
Some types of submissions are excluded because they are dangerous to assess, or because they have a low security impact on program owners. This section contains issues that XL cannot accept, which will immediately be marked invalid and not rewarded.

  • Bypassing HMAC from or by using old / legacy endpoint API or APK
  • Fraud from or by using old /legacy endpoint API or APK
  • Bypass Authentication & Authorization login/ATO by using old / legacy API or APK

Several types of submissions we rate do not qualify for prizes because they have a low security impact for program owners.
Below is a list of issues that are commonly reported and reproducible but do not meet the requirements.
We strongly advise you not to report this problem unless you can demonstrate a possible attack with valid security implications for program owners.

  • Descriptive error messages (eg stack traces, application or server errors).
  • HTTP 404 code / page or other non-200 HTTP code / page.
  • Banner disclosure on public services.
  • Disclosure of known public files or directories (eg Robots.txt).
  • Click-jacking and problems that are only exploited through it.
  • CSRF on a form available to anonymous users (eg contact form).
  • Login / Logout CSRF.
  • Presence of an application or an ’auto-complete’ or ’save password’ function in a web browser.
  • Lack of Secure and HttpOnly flags on cookies.
  • Lack of security speed bumps when leaving the website.
  • Weak captcha or bypass captcha.
  • Enumeration of username/msisdn via login page error message.
  • Enumerate username/msisdn via the message ’Forgot Password’.
  • Brute force on the login page or on the forgot your password page and result in account lockout.
  • HTTP TRACE option enabled.
  • SSL attacks such as BEAST, BREACH, or around a renegotiation vulnerability.
  • SSL forward secrecy.
  • SSL which supports cipher suite algorithms is not secure.
  • MIME-Sniffing or X-Content-Type-Options header.
  • HTTP security header not found.
  • Invalid or missing SPF (Sender Policy Framework) records or related to other e-mails (SPF / DKIM / DMARC).
  • Automated scanning results using tools such as vulnerability scanners (Nessus, nikto, Qualys, OpenVAS, Core Impact, Acunetix, Nexpose, SecureCheq, Retina, MBSA, HIAB, and so on) even though the results include a potential security risk.
  • Absence of Rate Limitation
  • API Key / Secret disclosure

Out of Scope bugs for mobile application:

  • Any URIs leaked because a malicious app has permission to view URIs opened.
  • Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries.
  • Absence of certificate pinning.
  • Path disclosure in the binary.
  • Lack of binary protection control in android app.
  • User data stored unencrypted on the file system/external storage.
  • Sensitive data in URLs/request bodies when protected by TLS.
  • Lack of obfuscation.
  • Lack of rooted/jailbreak detection.
  • Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceiver (exploiting these for sensitive data leakage is commonly in scope).
  • Any kind of sensitive data stored in app private directory.
  • Runtime hacking exploits that are only exploitable on your own device using tools like such as Frida/ Appmon (exploits only possible in a rooted environment).

PROGRAM REWARDS

You will be eligible for a prize if you are the first to report a previously unknown AND vulnerability to code or configuration that could impact to code changes, configuration changes or data changes. Rewards will be sent periodically every month.

Reward

This program adheres to the RedStorm Vulnerability Rating Taxonomy for the prioritization/rating of findings. if relevant, the deviations from the VRT shoul be listed here in a markdown table:

P1 POINT REWARD 100 Rp11.000.000
P2 POINT REWARD 50 Rp7.000.000
P3 POINT REWARD 20 Rp0
P4 POINT REWARD 10 Rp0
P5 POINT REWARD 5 Rp0

Targets

In Scope
APK MyXL
Android
Out of scope
Other
Other

1

Vulnerabilities rewarded
Latest hall of fame
Wahyu Arif Purnomo
Copyright © 2018 - RedStorm. All rights reserved.TermsPrivacyContact