What is Cryptobox?

Cryptobox provides businesses and organizations with a sharing and collaboration solution to secure internal and external exchanges, using end-to-end encryption.

You can securely access your documents from any device, control your data and costs with a scalable architecture and a patented security solution. Cryptobox can be deployed on premises, in the cloud or in a hybrid model depending on customer architecture requirements.

Security

Cryptobox has been qualified by ANSSI for use at the "restricted" level, and certified at the Common Criteria EAL3+ level.

Ercom is convinced that working with skilled security hunters around the globe is a relevant part of the flow remediation process dedicated to maintain a high security level.

Rules

What hunters must do

• All our program rules must be agreed and complied by hunters.
• All tests shall be done following the processes set by YesWeHack.
• Ercom provides a dedicated test platform for vulnerability assessment at https://bounty.cryptobox.com. This is the only platform that shall be challenged.
• Each hunter will get access to 2 accounts, so that hunters can try attacking one of their account from the other.

What hunters must not do

• Tests not compliant with rules of YesWeHack will not receive any reward, and will be deemed illegal.
• Hunters must not violate any local, state, national or international law.
• Hunters must not attack other another accounts than one of theirs.
• Hunters must not use social engineering attacks.
• Hunters shall not use more than 1 GB per account.
• All documents provided to the hunters are currently confidential and shall not be disclosed.
• Hunters shall not publicly disclose the bug until Ercom has confirmed the bug is fixed. Even then they shall not make exploits publicly available unless required by law or with Ercom’s written permission.

Supported browsers

• Current versions of Firefox, Chrome and Edge.

Supported apps

• Cryptobox for Android
• Cryptobox for iOS

Note

Cryptobox is a product that can be deployed either on premise or in the cloud, with one platform being deployed for a given company. It is expected that users of a given Cryptobox platform have access to each other information. This includes the email address, first name, last name and public certificates. In the context of this bug bounty, we deployed one dedicated platform https://bounty.cryptobox.com for all hunters. As a consequence, please be aware that your account information (first name, last name, email) will be visible by all other hunters.

Rewards

Ercom will pay rewards at Ercom’s discretion for a serious and reproducible vulnerability. Submissions will be evaluated in regard to the impact of uncovered vulnerabilities to these assets. Hunters are responsible for any applicable taxes associated with any reward you receive. Any report that results in a change in our code base will be rewarded, at minimum, by a €100 reward. Only the first hunter who find a given vulnerability is eligible to get a reward.

Please note that we may modify the terms of this program or terminate it at any time.

Reports of leaks and exposed credentials

In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and identified outside of our program’s scope, such as:

• Exposed credentials in/from an out-of-scope asset/source
• Sensitive information exposed in/from an out-of-scope asset/source

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.

This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

To summarize our policy, you may refer to this table :

Important precautions and limitations

As a complement to the Program’s rules and testing policy :

• DO NOT alter compromised accounts by creating, deleting or modifying any data
• DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
• DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
• In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
• In case of sensitivie information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.