Sony PlayStation Bug Bounty Program Launches In Collaboration With HackerOne
Sony has announced via an official PlayStation blog post that it has launched a new bug bounty program for the PlayStation 4 game console in collaboration with the security platform HackerOne. Sony says that it started the Bug Bounty program because security is a fundamental part of creating amazing experiences for the community. The program has rewards in place for various issues, including critical issues on the PS4.
Those who discover a critical vulnerability for the PS4 are eligible for bounties as high as $50,000. The image below shows the range of bounties offered for issues of different types. PlayStation says that it was running this bug bounty program privately with some security researchers before this official announcement.
The rollout of the program to the broader community comes after Sony says it recognized the valuable role that the research community played in enhancing security. Details on the scope of the bounty program are offered via HackerOne. The scope of the program is currently interested in reports on the PlayStation 4 system, operating system, accessories, and the PlayStation Network. Domains considered in scope for the bounty program include:
- *.playstation.net
- *.sonyentertainmentnetwork.com
- *.api.playstation.com
- my.playstation.com
- store.playstation.com
- social.playstation.com
- transact.playstation.com
- wallets.api.playstation.com
Domains that are out-of-scope include:
- PlayStation 1, PlayStation 2, PlayStation 3, PS Vita and PSP or any other hardware
- Any domains not explicitly listed in the scope above
- Corporate IT infrastructure
- Open source software vulnerabilities which have been public for less than 7 days
- Software published by third party entities, including games, applications, etc
The program does require participants to agree to responsible disclosure by giving PlayStation time to address the vulnerabilities before talking about them publicly, among other things. The full list of responsible disclosure practices can be seen at the HackerOne website, along with a list of out-of-scope vulnerabilities.
In other PlayStation news, earlier this month, a comparison photo surfaced that shows how massive the PlayStation 5 is compared to past console generations.
