No More Free Bugs led to Bug Bounties, but some people believe that bug bounty hunters are low quality script kiddies and the most talented researchers aren't participating. The emergence of bug bounty programs is increasing the volume of vulnerability submissions, but how many of those can be found by running an automated scanning tool? Are any really critical bugs being found in the sea of clickjacking and weak password policy reports? How do you separate the signal from the noise, and more importantly, how do you shift the balance of bug reports to greater signal/less noise overall? In this presentation we will discuss several highly critical vulnerabilities that have been uncovered through a variety of bug bounty programs and their impact on the customers. With participation from researchers and vendors, attendees will not only see some sweet vulnerabilities broken down, but also why wading through another submission from @CluelessSec might be worth it.
With over 12 years experience in the information security industry, Kymberlee Price pioneered the first security researcher outreach program in the software industry. Price later was a principal investigator in the Zotob criminal investigation, and analyzed APT's at Microsoft. She then spent 4 years investigating product vulnerabilities in BlackBerry's Security Response Team followed by an offensive security role as the Director of the Synack Red Team. Today she is responsible for directing the efforts of Bugcrowd's global team of more than 16,000 security researchers, optimizing vulnerability reporting performance for customers and researchers, and aiding 'the Crowd' with ongoing skill development and overall success in Bugcrowd programs. Ms. Price holds a Bachelor of Science degree in Behavioral Psychology and a Bachelor of Science degree in Public Health Education. She has previously spoken at a number of conferences, including Black Hat USA, RSA, Kaspersky Security Analyst Summit, Metricon, and Derbycon.