Malwarebytes Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 629, "average_time_to_first_program_response": 10, "average_time_to_report_resolved": null, "handle": "malwarebytes", "id": 0, "managed_program": true, "name": "Malwarebytes", "offers_bounties": true, "offers_swag": false, "response_efficiency_percentage": 70, "submission_state": "open", "url": "https://hackerone.com/malwarebytes", "website": "https://www.malwarebytes.com", "targets": { "in_scope": [ { "asset_identifier": "*.cloud.malwarebytes.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes and ThreatDown services and products.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.cyrus-security.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.malwarebytes.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes services and products.\n\nExclusions:\n\n* academy.malwarebytes.com", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.mb-cosmos.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes services and products.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.mbamupdates.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes services and products.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.mwb-threatintel.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes services and products.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.mwbsys.com", "asset_type": "WILDCARD", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Domains supporting many Malwarebytes services and products.", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.threatdown.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "AdwCleaner", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "low", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "AdwCleaner is the world’s most popular adware cleaner finds and removes unwanted programs and junkware so your online experience stays optimal and hassle-free.\n\nProduct page: https://www.malwarebytes.com/adwcleaner\n\nDocumentation:\nhttps://help.malwarebytes.com/hc/en-us/categories/31589180730139-AdwCleaner ", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "Any other Malwarebytes asset", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Please use this category to report vulnerabilities in any other Malwarebytes assets not listed in other categories.\n\nNote: Due to the broad scope of this category, eligibility and rewards will decided on the case-by-case basis.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Any other ThreatDown asset", "asset_type": "OTHER", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Please use this category to report vulnerabilities in any other ThreatDown assets not listed in other categories.\nNote: Due to the broad scope of this category, eligibility and rewards will decided on the case-by-case basis.", "integrity_requirement": "not_defined", "max_severity": "critical" }, { "asset_identifier": "BrowserGuard (Firefox/Chrome/Safari browser extension)", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Malwarebytes Browser Guard crushes unwanted and unsafe content, giving you a safer and faster browsing experience. Not only that, it is the world’s first browser extension that can identify and stop tech support scams.\n\n* Product page: https://www.malwarebytes.com/browserguard\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002468293-Malwarebytes-Browser-Guard\n", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes Anti-Exploit", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Standalone Anti-Exploit, for Windows.\n\n* Product page: https://forums.malwarebytes.com/forum/126-anti-exploit-beta/\n* Documentation: https://support.malwarebytes.com/hc/en-us/sections/4416574256915-Malwarebytes-Anti-Exploit-for-Windows\n\n\n", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "Malwarebytes Privacy (VPN)", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "With a single click, our next-generation VPN helps protect your online privacy, secures your WiFi connection, and delivers speeds way faster than older VPNs.\n\n* Product page: https://www.malwarebytes.com/vpn\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360003545953-Malwarebytes-Privacy\n\n**Note**:\nThe standalone VPN (Win/macOS) is no longer supported, VPN features are now available in the Desktop Security application.\n \n", "integrity_requirement": "medium", "max_severity": "medium" }, { "asset_identifier": "Malwarebytes Remediation for CrowdStrike", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Malwarebytes Remediation for CrowdStrike works seamlessly with CrowdStrike Real Time Response (RTR) functionality. It provides automated remediation that thoroughly removes malware on machines where CrowdStrike Falcon has stopped an attack.\n\n* Product page: https://www.malwarebytes.com/business/crowdstrike\n* Documentation: https://service.malwarebytes.com/hc/en-us/articles/4413798516627-Malwarebytes-Remediation-for-CrowdStrike-integration-guide\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes Support Tool (MBST)", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "The Support Tool troubleshoots and repairs issues with Malwarebytes Desktop Security for Windows devices.\nProduct page: https://help.malwarebytes.com/hc/en-us/articles/31589431159579-Repair-Desktop-Security-with-the-Support-Tool ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes ToolSet (MBTS)", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Advanced antivirus and anti-malware with faster, safer web browsing.\n\n* Product page: https://www.malwarebytes.com/techbench\n* Documentation: https://service.malwarebytes.com/hc/en-us/categories/4413802057875-Toolset\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes Windows Firewall Control", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Windows Firewall Control is a powerful tool which extends the functionality of Windows Firewall and provides new extra features which makes Windows Firewall better. It runs in the system tray and allows the user to control the native firewall easily without having to waste time by navigating to the specific part of the firewall.\n\n* Product page: https://www.binisoft.org/wfc\n* Documentation: https://www.binisoft.org/pdf/guides/Malwarebytes-WFC-User-Guide.pdf\n", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "Malwarebytes for Mac", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Advanced antivirus and anti-malware with faster, safer web browsing.\n\n* Product page: https://www.malwarebytes.com/mac\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002468253-Malwarebytes-for-Mac\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes for Teams", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Advanced antivirus and anti-malware with faster, safer web browsing.\n\n* Product page: https://www.malwarebytes.com/business/teams\n* Documentation: https://service.malwarebytes.com/hc/en-us/categories/4414671777043-For-Teams\n\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "Malwarebytes for Windows", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Advanced antivirus and anti-malware with faster, safer web browsing.\n\n* Product page: https://www.malwarebytes.com/premium\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002458014-Malwarebytes-for-Windows\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ThreatDown Browser Phishing Protection", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "ThreatDown Browser Phishing Protection is a browser extension that protects against browser-based phishing attacks. It uses heuristics and signatures to block malicious phishing sites, search URL hijacking attempts, unwanted ads, tracking scripts, and scams.\nProduct page: https://www.threatdown.com/products/browser-phishing-protection/\nDocumentation: https://support.threatdown.com/hc/en-us/articles/4413802501395-Protection-policy-settings-in-Nebula#Browser_Phishing_Protection_10\n\nOnboarding with OneView or Nebula platforms. ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ThreatDown Device Control", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Control access and prevent infection from peripherals (such as USB devices) plugged into endpoints.\n\n* Product page: https://www.threatdown.com/products/nebula/\n* Documentation: \nhttps://www.threatdown.com/glossary/what-is-device-control/", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ThreatDown Endpoint Detection & Response (EDR)", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "ThreatDown EDR is a cross-platform threat prevention and remediation for Windows, Mac, and Linux.\nIt delivers effective protection—from prevention through identification to response actions—that users with emerging cybersecurity acumen can learn and use with ease.\n\n* Product page: https://www.threatdown.com/products/endpoint-detection-and-response/\n\nIn scope for the bug bounty program is to identify security vulnerabilities in the EDR agent, drivers, update mechanism, management plane and NOT to benchmark its detection efficacy. Software bypasses are considered in scope but engine detection misses are out of scope and considered part of the ongoing evolution of detection capabilities of our product. \nPlease report detection gaps using our customer support channel.\n\nOnboarding using OneView or Nebula platforms.\n\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ThreatDown Endpoint Protection", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "ThreatDown Endpoint Protection is a complete malware protection and remediation\nsolution with predictive threat detection, proactive threat blocking, and integrated\nend-to-end protection.\n\n* Product page: \nhttps://www.threatdown.com/products/endpoint-protection/\n\nOnboarding using OneView or Nebula platforms.\n\n\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "ThreatDown Patch Management", "asset_type": "OTHER", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Understand risks quickly and strengthen defenses across your digital ecosystem with modules for our cloud-based security management platform.\n\n* Product page: https://www.threatdown.com/products/patch-management/\n* Documentation: https://www.threatdown.com/products/patch-management/\n\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "USB Flash Drive Control", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "USB Flash Drives Control is a freeware program that runs in system tray, next to the system clock, and provides access to control the way in which the USB removable drives are used on your computer. These options are available through the right click context menu on the system tray icon of the program. \n\n* Product page: https://www.binisoft.org/usbc\n\n", "integrity_requirement": "low", "max_severity": "medium" }, { "asset_identifier": "blog.malwarebytes.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty.\nHowever, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "cloud.malwarebytes.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": " Single-tenant, cloud-based platform for the entire endpoint security stack.\n\n* Product page: \nhttps://cloud.threatdown.com\n* Documentation: https://www.threatdown.com/products/nebula/", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "cloud.threatdown.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "ThreatDown Nebula is the single-tenant cloud-hosted security management platform that allows you to manage control of any malware or ransomware incident—from alert to fix. Integrating all Malwarebytes products into a single view, ThreatDown Nebula augments our solutions with a guided user interface, next generation threat intelligence, brute force attack protection, and integration capabilities that maximize your security investments across the organization.\n\nProduct page: https://www.threatdown.com/products/nebula/\nDocumentation: https://support.threatdown.com/hc/en-us/categories/4413798473491-Nebula", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "com.malwarebytes.Malwarebytes", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": "high", "confidentiality_requirement": "medium", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Get all the extra iOS security you need in one app. Protect yourself from online threats and put a stop to annoying spam calls and texts. Browse the web with confidence and focus on the messages that matter.\n\n* Product page: https://www.malwarebytes.com/ios\n* Appstore: https://apps.apple.com/us/app/malwarebytes-mobile-security/id1327105431\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002468273-Malwarebytes-for-iOS\n", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "forums.malwarebytes.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty.\nHowever, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "https://oneview.threatdownstage.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Testing environment of the ThreatDown OneView product.\nThis is the MSP partner portal that provides a multi-tenant dashboard to centrally manage customer and partner accounts, cloud subscriptions for servers and workstations, invoicing, and integrations. It allows MSP partners to create/manage customer trials, paid licenses, and gain real-time visibility into account usage.\n- Product page: https://www.threatdown.com/partner-program/msp/\n- Documentation: https://support.threatdown.com/hc/en-us/categories/4413802057491-OneView\n- Self-registration by using your @wearehackerone.com email address : https://dev-www.threatdown.com/partner-program/msp/oneview-trial-request/\n- Login: https://oneview.threatdownstage.com", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "my.malwarebytes.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Portal to manage your subscriptions and billing.\n\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002458094-My-Account-Billing", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "oneview.threatdown.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "ThreatDown OneView is the MSP partner portal that provides a multi-tenant dashboard to centrally manage customer and partner accounts, cloud subscriptions for servers and workstations, invoicing, and integrations. It allows MSP partners to create/manage customer trials, paid licenses, and gain real-time visibility into account usage.\n\n- Product page: https://www.threatdown.com/partner-program/msp/\n- Documentation: https://support.threatdown.com/hc/en-us/categories/4413802057491-OneView\n\nPlease use the Stage environment for testing:\n- Self-registration by using your `@wearehackerone.com` email address : https://dev-www.threatdown.com/partner-program/msp/oneview-trial-request/\n- Login: https://oneview.threatdownstage.com\n ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "org.malwarebytes.antimalware", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Advanced antivirus and anti-malware with faster, safer web browsing.\n\n* Product page: https://www.malwarebytes.com/android / https://www.malwarebytes.com/chromebook\n* Documentation: https://support.malwarebytes.com/hc/en-us/categories/360002458034-Malwarebytes-for-Android-Chrome-OS\n", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "support.malwarebytes.com", "asset_type": "URL", "availability_requirement": "medium", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty.\nHowever, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "www.malwarebytes.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "Malwarebytes Anti-Ransomware", "asset_type": "DOWNLOADABLE_EXECUTABLES", "availability_requirement": "low", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "low", "max_severity": "none" }, { "asset_identifier": "estore.malwarebytes.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty. However, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "malwarebytes.zoom.us", "asset_type": "URL", "availability_requirement": "not_defined", "confidentiality_requirement": "low", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "pages.malwarebytes.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty. However, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "store.malwarebytes.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty. However, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "store.threatdown.com", "asset_type": "URL", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty. However, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": "not_defined", "max_severity": "none" }, { "asset_identifier": "view.malwarebytes.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "This subdomain is operated by a third party, therefore, submissions will not be eligible for a bounty. However, valid reports will still be addressed and reputation will possibly be awarded.", "integrity_requirement": null, "max_severity": "none" } ] } }

Malwarebytes

In scope

Recent changes

Community reports

Your notes

Out of scope