Ninja Kiwi Games Bug Bounty program

Description

Creators of hit computer game franchises Bloons, Bloons TD and SAS: Zombie Assault for mobile and web. We have offices in Auckland, New Zealand and Dundee, Scotland. We are excited to engage with the security community to help us keep our users safe and our services secure. This is our second Bug Bounty program after a successful campaign in 2021.

Rules of engagement

By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Validation times We will validate all submissions within the below timelines, once your submission has been verified by Intigriti. Submissions validated outside of this may be awarded a €25 bonus.

This remains at the discretion of the Ninja Kiwi Games to award.

Check our fix We offer up to €50 bonus to verify a resolved issue for us (when requested). This remains at the discretion of Ninja Kiwi Games to award.

In scope

Introduction We are happy to announce our first bug bounty program on the Intigriti platform! We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed!

Our worst-case scenarios are

• Extracting secret keys for our cloud infrastructure access (eg AWS keys)
• Exfiltration of player PII (email address, hashed passwords, etc)
• Accessing internal administrator functionality for our main API (api.ninjakiwi.com)

Any useful infrastructure information:

• Our APIs at api.ninjakiwi.com and analytics.ninjakiwi.com are key targets for this program
• The majority of the in-scope assets are protected by Cloudflare. If you've found a vulnerability which may be exploitable if Cloudflare was bypassed please get in touch. We may accept these issues if they are exploitable after bypassing Cloudflare and are a high enough severity.

Game Data Consistency Please be aware that we will mark exploits that manipulate a game's server-side state as "informative" or cap at Low severity if the exploits don't lead to account compromise, PII leaks, access escalation, RCE style exploit, etc.

We've included some examples to help explain the types of exploits which we won't accept or will limit to Low:

• Injecting scores into a leaderboard
• Changing the state of a game lobby from public to private
• Increasing or reducing a players bank balance more than the game client would normally allow

Examples of in-scope vulnerabilities:

• Ability to log into another users account
• Enumerating email addresses
• Accessing any PII for users which isn't normally accessible to the game clients
• Accessing files or services on our servers which aren't normally accessible.

These rules are mostly applicable to api.ninjakiwi.com, analytics.ninjakiwi.com and ct.ninjakiwi.com.

Feedback Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here: Program Feedback Link Please note this form will be checked periodically and should not be used for submission or support queries.

Out of scope

Request Signature Validation Bypass

Some of our endpoints on the following domains skip our normal payload validation checks

• api.ninjakiwi.com
• api-staging.ninjakiwi.com

If you find a payload which isn't being validated the way you expect (ie ERR_PAYLOAD_INVALID error is not returned when you might expect it) please feel free to email [email protected] to check the endpoint or submit a report. If you submit a report and the endpoint is in the list without validation we'll close the report as Informative - this will not have any impact on your reputation.

CDN Cache Poisoning

• Cache poisoning or DOS exploits without showing a reasonable method for exploiting them in the real world will be rejected.
• For example showing that you can briefly poison a file when using a custom querystring without a clear indication of how the exploit could be used to disrupt legitimate traffic which doesn't use that querystring.
• If you are unsure please feel free to reach out to [email protected] for clarification

Game Applications

• All of our game client apps are out of scope. Bugs or security issues reported for the game clients themselves will be marked as out of scope.
• Game API's are out of scope.
• Please do not exploit any vulnerability against accounts other than your own.

Domains

• Any domain that is not listed in the Domains section, is out of scope for this program

Application

• API key disclosure without proven business impact
• Vulnerabilities requiring the victim to use a modified game client
• Exploits which gives an account additional in-game currencies or items, since this does not affect other players
• Manipulating non-authenticated server-side data (such as some leaderboard scores) unless that manipulation can lead to account compromise
• Gaining early access to upcoming in-game content or promotional material
• Wordpress usernames disclosure
• Pre-Auth Account takeover/OAuth squatting
• Self-XSS that cannot be used to exploit other users
• Verbose messages/files/directory listings without disclosing any sensitive information
• CORS misconfiguration on non-sensitive endpoints
• Missing cookie flags
• Missing security headers
• Cross-site Request Forgery with no or low impact
• Presence of autocomplete attribute on web forms
• Reverse tabnabbing
• Bypassing rate-limits or the non-existence of rate-limits.
• Best practices violations (password complexity, expiration, re-use, etc.)
• Clickjacking without proven impact/unrealistic user interaction
• CSV Injection
• Sessions not being invalidated (logout, enabling 2FA, etc.)
• Tokens leaked to third parties
• Anything related to email spoofing, SPF, DMARC or DKIM
• Content injection without being able to modify the HTML
• Username/email enumeration
• Email bombing
• HTTP Request smuggling without any proven impact
• Homograph attacks
• XMLRPC enabled
• Banner grabbing/Version disclosure
• Not stripping metadata of files
• Same-site scripting
• Subdomain takeover without taking over the subdomain
• Arbitrary file upload without proof of the existence of the uploaded file
• Blind SSRF without proven business impact (pingbacks are not sufficient)
• Disclosed/misconfigured Google Maps API keys
• Host header injection without proven business impact

General

• In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
• Spam, social engineering and physical intrusion
• DoS/DDoS attacks or brute force attacks
• Vulnerabilities that only work on software that no longer receive security updates
• Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
• Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
• Reports that state that software is out of date/vulnerable without a proof-of-concept

Mobile

• Shared links leaked through the system clipboard
• Any URIs leaked because a malicious app has permission to view URIs opened
• The absence of certificate pinning
• Sensitive data in URLs/request bodies when protected by TLS
• Lack of obfuscation
• Path disclosure in the binary
• Lack of jailbreak & root detection
• Crashes due to malformed URL Schemes
• Lack of binary protection (anti-debugging) controls, mobile SSL pinning
• Snapshot/Pasteboard leakage
• Runtime hacking exploits (exploits only possible in a jailbroken environment)
• API key leakage used for insensitive activities/actions

Severity

This program follows Intigriti's triage standards

FAQ

Where can we get credentials for the app?

For the domain api.ninjakiwi.com, you can sign up for a free account from inside any of our recent games. Most of these games are free to play and are available on mobile stores as well as Steam.

For mynk.ninjakiwi.com you can create a free account in our NK Archive application and then launch any of our legacy flash games (Bloons TD 5, etc)