Backblaze

Description

No technology is perfect and Backblaze believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Non-Disclosure Please note: This program does not allow disclosure at any time, even after you leave the program. You may not release information about vulnerabilities found in this program to the public or anyone other than Backblaze. Any offender of this non-disclosure policy shall be removed from the program, shall repay any rewards payment to Backblaze, and shall be subject to the Bugcrowd policies and guidelines on Bugcrowd’s sites, including but not limited to the Bugcrowd Code of Conduct. This does not constitute a waiver of any rights Backblaze may otherwise have under applicable laws. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Special Rewards & Bonuses ($15k Reward) Backblaze is offering a special $15k reward for any researcher that is able to Bypass Backblaze's enhanced ransom ware protection and break object lock. Demonstrate a way to delete files prior to the object lock expiration. Permanently delete files so that they are not available in the version history and bypass the 30 day, 1 year or forever file retention policies.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Backblaze not listed in the targets section is out of scope. Security configuration changes to well known protocols such as email or DNS are not in scope. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Backblaze, you can report it here. However, be aware that it may not be eligible for rewards or points-based compensation. Target Information: Security is a top priority at Backblaze. If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure that you are fairly rewarded for your discovery. We encourage all submissions to contain a brief, less than 2 minute, proof of concept video demonstrating the vulnerability when it is complex. If you have questions about the Backblaze service or are trying to get help with your own Backblaze account, please visit our support page for assistance. Here are a few relevant resources that may come in handy while doing your research: Backblaze Personal Backup Overview Backblaze Business Backup Overview Backblaze B2 Cloud Storage Overview Backblaze B2 Cloud Storage APIs How to make strong encryption easy to use Service Scopes: The applications and services in-scope include the following The Web Application ( https://.backblaze.com , this includes any API's used on the site through ajax calls that are public or private) Personal Backup Clients (Mac and Windows) Restore Downloaders (Mac and Windows) B2 & S3 API's ( https://.backblazeb2.com ) Git Repositories (b2-sdk-java, b2-sdk-python & B2 Command Line Tool) b2dcv.com (used for custom domain validation) Credentials: Researchers are not provided with equipment or credentials. However, they are free to self-register for a trial account on Backblaze using their @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Desktop applications can be accessed by logging into your account and downloading the binary's from the overview page. Focus Areas: We are most interested in remote code execution vulnerabilities and leaks of personal information (authentication/authorization bypasses). We request that researchers focus on these critical areas. Backblaze reserves the right to decide if an issue meets the minimum severity threshold, and whether it is a duplicate of an earlier report. Out-of-Scope: Backblaze, like many SaaS providers, uses third party services which are not in scope. Please report the issues directly to their respective vendors. Hubspot - Follow the instructions on https://bugcrowd.com/hubspot for issues on the following domains: https://hub.backblaze.com , https://trynow.backblaze.com , https://info.backblaze.com , and https://status.backblaze.com . ZenDesk - Follow the instructions on https://hackerone.com/zendesk for issues on the following domain: https://help.backblaze.com . Document360 - Follow the instructions on https://document360.com/security/ for issues found on the following URL: https://www.backblaze.com/docs . WPEngine - Follow the instructions on https://wpengine.com/security/ for issues found on the Backblaze Blog: https://www.backblaze.com/blog Vulnerabilities that rely on data stored in Backblaze Cloud Storage Buckets. The buckets contain data created by Backblaze customers. These URLs are of the following form, with asterisks () representing any string in this position, and NNN representing numerals in this position: Friendly URL: https://fNNN.backblazeb2.com/file/ S3 URL: https://.s3.-NNN.backblazeb2.com/* Native URL: https://fNNN.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=* Additional out-of-scope issues: Vulnerabilities for the following domain(s) are accepted but not eligible for a reward: ir.backblaze.com and partnerportal.backblaze.com Denial of Service (DoS) attacks that just overwhelm resources (as apposed to crash systems) Best practice concerns not accompanied by in scope exploits (e.g. missing HTTP headers, outdated software, etc.) Generic email spoofing issues Vulnerabilities in third parties using Backblaze Any vulnerability obtained from a compromised account Vulnerabilities resulting from insecure or compromised client computers or browsers (e.g. a stolen laptop with no password, preexisting malware, etc.) Vulnerabilities which depend upon users exhibiting substandard security practices (e.g. displaying credentials in public locations, failing to log out of a shared computer, etc.) Physical attacks against our infrastructure, facilities, and offices Social engineering attacks, including those targeting employees, contractors, and vendors Safe Harbor: When conducting vulnerability research according to and in compliance with this program and other applicable policies and guidelines on Bugcrowd’s sites (collectively “Bugcrowd Policies”), we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.