Skoda Auto Bug Bounty Program

Description

This Bug Bounty program is an official and first program run by Škoda Auto a.s.

It is focused on the newest version of MyŠkoda mobile application available for iOS and Android.

We appreciate the possibility to work with you either remotely or by joining us at the factory and testing the app within our cars!

In advance, we thank you for your time and invite you to step into the era of a proactive approach to cyber security together!

Škoda Auto a.s.

Rules of engagement

By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
• Not complete orders on weekend days or holidays (according to the Czech calendar)

Validation times

We will validate all submissions within the below timelines, once your submission has been verified by Intigriti. Working day = In between 8 AM - 16 PM, CEST - only applicable for the validation of submissions, however submissions can be send whenever.

This remains at the discretion of Skoda Auto to award.

Check our fix We offer up to €50 bonus to verify a resolved issue for us (when requested). This remains at the discretion of Skoda Auto to award.

In-factory hacking option For Rules of engagement in the event of in-factory hacking, you will need to sign 2 additional agreements when coming to the factory. Please see attachments - Obligation of Secrecy (signed once for entry to the factory); Handover Protocol (signed each time a vehicle is handed over). Your ID will be checked upon entrance, and by reaching out to our e-mail address, you give us the confirmation to use your contact info to clear the details about the trip with you. All Terms and Conditions of the program are still valid.

In scope

Introduction We are happy to announce our program! We've done our best to clean up our known issues and now would like to request your help to spot the ones we missed! This program brings together Škoda's employees from IT security, MyŠkoda App, and Car Security topics and we are looking forward to connect with you as well!

Bounties disclaimer: Please note that due to technical setup of the platform and small scope of the program, only Tier2 of bounties is applicable and displayed.

Our worst-case scenarios are: Our worst case scenario is that someone gains full control over a car they don't own, and control it remotely without a valid user account, including opening doors, turning on the car's heating and climate control, causing significant damage to the car. The second worst-case scenario is obtaining large amount of user data.

Join us at Škoda in Czechia and test on our vehicles: We now have the posibility to lend you the cars so that you can test the app within them! If you are interested, please see the update about this oportunity for more details and write us at [email protected]!

Feedback We would really appreciate if you'd like to help us improve our program since this is our pilot Bug Bounty project. So please feel free to share your thoughts and send your anonymous feedback here: Program feedback link Please note this form will be checked periodically and should not be used for submission or support queries.

Out of scope

Account creation The account creation process takes place through identity.vwgroup.io. The vulnerabilities related to the account creation process are out of scope as of now. We are in contact with our backend provider to potentially include this in our scope in the future.

Other known issues Please be aware that there might be some already known issues by our brand that we're already working on, so we reserve the right to decline any already known findings.

What is forbidden Do not disclose details of found vulnerabilities (even resolved ones) to the public or any third party without the explicit consent of Škoda Auto a.s. Do not access or make changes to customer accounts Do not perform social engineering attacks, including phishing Do not perform any physical attacks Any lateral movement and post-exploitation past the initial exploitation is forbidden

Severity

This program follows Intigriti's triage standards

FAQ

Where can we get credentials for the app?

You can register into the application. For a full user experience and use of all functions in the application, it is necessary to have a Škoda vehicle enrolled into a app. We currently don’t offer any credentials to test.

What is the preferred bug hunting approach?

The hunting for bugs is preferred to be conducted with access to Škoda vehicle to be able to enroll the car into the app (vehicle identification number is needed for enrollment to MyŠkoda App) and to be able to utilize all apps's functionalities. You can either test only the app, or enrolled with your own vehicle or write us at [email protected] and set a date to come to the factory and test on our cars!

What if I don't have a Škoda vehicle but still want to participate?

Do not worry! The app is still functional without the vehicle, although with some limits, therefore having a car is preferred. Otherwise, there is the possibility available for you to come to Škoda, Mladá Boleslav, Czechia, borrow our car and do your research inside the factory! For more details, please see the update about the in-factory hacking on our feed here or write us at [email protected]!