This Bug Bounty program is an official and first program run by Škoda Auto a.s. It is focused on the newest version of MyŠkoda mobile application available for iOS and Android. We appreciate the possibility to work with you either remotely or by joining us at the factory and testing the app within our cars! In advance, we thank you for your time and invite you to step into the era of a proactive approach to cyber security together! Škoda Auto a.s.
Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Working day = In between 8 AM - 16 PM, CEST - only applicable for the validation of submissions, however submissions can be send whenever.
Submissions validated outside of this may be awarded a €25 bonus.
| Vulnerability Severity | Time to validate |
|---|---|
| Exceptional | 2 Working days |
| Critical | 2 Working days |
| High | 5 Working days |
| Medium | 15 Working days |
| Low | 15 Working days |
This remains at the discretion of Skoda Auto to award.
Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Skoda Auto to award.
In-factory hacking option
For Rules of engagement in the event of in-factory hacking, you will need to sign 2 additional agreements when coming to the factory. Please see attachments - Obligation of Secrecy (signed once for entry to the factory); Handover Protocol (signed each time a vehicle is handed over). Your ID will be checked upon entrance, and by reaching out to our e-mail address, you give us the confirmation to use your contact info to clear the details about the trip with you. All Terms and Conditions of the program are still valid.
Introduction
We are happy to announce our program! We've done our best to clean up our known issues and now would like to request your help to spot the ones we missed! This program brings together Škoda's employees from IT security, MyŠkoda App, and Car Security topics and we are looking forward to connect with you as well!
Bounties disclaimer:
Please note that due to technical setup of the platform and small scope of the program, only Tier2 of bounties is applicable and displayed.
Our worst-case scenarios are:
Our worst case scenario is that someone gains full control over a car they don't own, and control it remotely without a valid user account, including opening doors, turning on the car's heating and climate control, causing significant damage to the car. The second worst-case scenario is obtaining large amount of user data.
Join us at Škoda in Czechia and test on our vehicles:
We now have the posibility to lend you the cars so that you can test the app within them! If you are interested, please see the update about this oportunity for more details and write us at BugBounty@skoda-auto.cz!
Feedback
We would really appreciate if you'd like to help us improve our program since this is our pilot Bug Bounty project. So please feel free to share your thoughts and send your anonymous feedback here:
Program feedback link
Please note this form will be checked periodically and should not be used for submission or support queries.
Account creation
The account creation process takes place through identity.vwgroup.io. The vulnerabilities related to the account creation process are out of scope as of now. We are in contact with our backend provider to potentially include this in our scope in the future.
Other known issues
Please be aware that there might be some already known issues by our brand that we're already working on, so we reserve the right to decline any already known findings.
What is forbidden
Do not disclose details of found vulnerabilities (even resolved ones) to the public or any third party without the explicit consent of Škoda Auto a.s.
Do not access or make changes to customer accounts
Do not perform social engineering attacks, including phishing
Do not perform any physical attacks
Any lateral movement and post-exploitation past the initial exploitation is forbidden
This program follows Intigriti's contextual CVSS standard
You can register into the application. For a full user experience and use of all functions in the application, it is necessary to have a Škoda vehicle enrolled into a app. We currently don’t offer any credentials to test.
The hunting for bugs is preferred to be conducted with access to Škoda vehicle to be able to enroll the car into the app (vehicle identification number is needed for enrollment to MyŠkoda App) and to be able to utilize all apps's functionalities. You can either test only the app, or enrolled with your own vehicle or write us at BugBounty@skoda-auto.cz and set a date to come to the factory and test on our cars!
Do not worry! The app is still functional without the vehicle, although with some limits, therefore having a car is preferred. Otherwise, there is the possibility available for you to come to Škoda, Mladá Boleslav, Czechia, borrow our car and do your research inside the factory! For more details, please see the update about the in-factory hacking on our feed here or write us at BugBounty@skoda-auto.cz!
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
