Description

Flemish Radio and Television Broadcasting Organization

Bounties

Responsible disclosure

Rules of engagement
Required
Not applicable
max. 5 requests/sec
Not applicable

Our promise to you

  • If you have complied with the above terms of the Responsible Disclosure Policy and have not committed any other breaches, we will not take any legal action against you.
  • We will respond to your report within a short period of time
  • We will treat your report confidentially and will not share your personal data with third parties without your consent unless this is necessary to comply with a legal obligation.
  • We will keep you informed of the progress of solving the problem.
  • To thank you for any report of a security problem that is not yet known to us, we offer the opportunity to be listed in our "Hall Of Fame".
  • We strive to solve all problems within a reasonable period of time, taking into consideration the criticality of the issue.
  • We may choose to ignore low quality reports.

If you have any questions, we encourage you to contact us.

In case of doubt about the applicability of this policy, please contact us first, to ask for explicit permission.

We reserve the right to change the content of this Policy at any time, or to terminate the Policy.

Your promise to us

  • Please refrain from using (high impact) automatic scanners, to minimize the chance of a negative effect on our services. Stay below 50 requests / second !!!
  • When you notice the target is having problems responding to normal requests, please stop the test. You are also encouraged to inform us of this type of problem.
  • Don’t disclose the vulnerability until we have been able to correct it. See below for possible publication.
  • Don’t exploit the vulnerability by unnecessarily copying, deleting, adapting or viewing data. Or, for example, by downloading more data than is necessary to demonstrate the vulnerability.
  • Don’t apply the following actions:
    • Placing malware (virus, worm, Trojan horse, etc.).
    • Copying, modifying or deleting data in a system.
    • Making changes to the system.
    • Repeatedly accessing the system or sharing access with others.
    • Using automated scanning tools.
    • Using the so-called "brute force" of access to systems.
    • Using denial-of-service or social engineering (phishing, vishing, spam,...).
  • Don’t use attacks on physical security, social engineering, distributed denial of service, spam or third-party applications.
  • Immediately erase all data obtained through vulnerability as soon as it is reported to the VRT.
  • Don’t perform actions that could have an impact on the proper functioning of the system, both in terms of availability and performance, but also in terms of confidentiality and integrity of the data.

Acts under this Responsible Disclosure Policy should be limited to conducting tests to identify potential vulnerabilities, and sharing this information with the VRT.

If, after the vulnerability has been removed, you wish to publish information about the vulnerability, we ask you to notify us at least one month before publication, and to give us the opportunity to respond. Identifying us in a publication is only possible after we have given our explicit approval.

This text is a derivative work of "Responsible Disclosure" by Floor Terra, used under a Creative Commons Attribution licence 3.0.

Domains

*.radioplus.be

Tier 2
URL

*.canvas.be

No Bounty
URL

*.dewarmsteweek.be

No Bounty
URL

*.ketnet.be

No Bounty
URL

Out of scope: shop.ketnet.be

*.klara.be

No Bounty
URL

*.mnm.be

No Bounty
URL

Out of scope: shop.mnm.be

*.radio1.be

No Bounty
URL

*.radio2.be

No Bounty
URL

*.sporza.be

No Bounty
URL

*.stubru.be

No Bounty
URL

Out of scope: shop.stubru.be

*.vrt.be

No Bounty
URL
No Bounty
iOS

Ketnet Junior

No Bounty
iOS

Ketnet

No Bounty
iOS

Wall of Moments

No Bounty
iOS

Radio 1

No Bounty
iOS

Radio 2

No Bounty
iOS

MNM

No Bounty
iOS

Klara

No Bounty
iOS

VRT NU

No Bounty
iOS

Studio Brussel

No Bounty
iOS

Sporza

No Bounty
iOS

Kaatje van Ketnet

No Bounty
iOS

VRT NWS

No Bounty
iOS

Sporza Voetbal

No Bounty
Android

Kaatje van Ketnet

be.vrt.ketnet.ketnet

No Bounty
URL

Ketnet

No Bounty
Android

Ketnet Junior

No Bounty
Android

VRT NWS

No Bounty
Android

Sporza voetbal

No Bounty
Android

Klara

No Bounty
Android

MNM

No Bounty
Android

Radio 1

No Bounty
Android

Radio 2

No Bounty
Android

Studio Brussel

No Bounty
Android

VRT NU

No Bounty
Android

Sporza

In scope

!!! Don't flood our systems with requests! We will not accept reports that can be matched with high traffic scans !!!

The VRT (Flemish Radio and Television Broadcasting Organization) considers it important that its information and systems are secure.

Despite our concern for the security of these systems, it may occur that there still is a vulnerability.

If you have found a vulnerability in one of our systems, please let us know so that we can take measures as quickly as possible. We would like to work with you to protect our audience and our systems in a better way.

We have therefore opted for a policy of coordinated disclosure of vulnerabilities (also known as the ‘Responsible Disclosure Policy’) so that you can inform us when you discover a vulnerability.

This Responsible Disclosure Policy applies to all VRT systems. In any case of doubt, please contact us to clarify matters.

We are specifically looking for

  • leaking of personal data
  • horizontal / vertical privilege escalation
  • SQLi
  • ...

For that part of our services that are hosted on AWS, there's a limitiation on which amazon services you can test without additional approval. The most up to date info is available on https://aws.amazon.com/security/penetration-testing/ .

Out of scope

Out of scope domains

  • shop.*.be
  • interactief.*

Amazon

Part of our infrastructure is hosted on Amazon Web Services. The following actions are explicitly forbidden:

  • DNS zone walking via Amazon Route 53 Hosted Zones
  • Denial of Service (DoS) and Distributed Denial of Service (DDoS)
  • Port flooding
  • Protocol flooding
  • Request flooding (login request flooding, API request flooding)

Part of our infrastructure also lies in the hands of external partners (adobe, google, microsoft, ...) and our responsible disclosure is not applicable on them. If you are unsure if a certain domain or product is in scope, you can always contact us before starting your tests to ask for information.

Application

  • Self-XSS that cannot be used to exploit other users 
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Bypassing rate-limits or the non-existence of rate-limits.
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking on pages with no sensitive actions
  • CSV Injection
  • Host Header Injection
  • Sessions not being invalidated (logout, enabling 2FA, ..)
  • Hyperlink injection/takeovers
  • Mixed content type issues
  • Cross-domain referer leakage
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection
  • Username / email enumeration
  • E-mail bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing / Version disclosure
  • Open ports without an accompanying proof-of-concept demonstrating vulnerability
  • Weak SSL configurations and SSL/TLS scan reports
  • Not stripping metadata of images
  • Disclosing credentials without proven impact
  • Disclosing API keys without proven impact
  • Same-site scripting
  • Subdomain takeover without taken over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate.
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks.
  • Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted
  • Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts
  • Recently disclosed zero-day vulnerabilities in commercial products where no patch or a recent patch (< 2 weeks) is available. We need time to patch our systems just like everyone else - please give us 2 weeks before reporting these types of issues.
  • Reports that state that software is out of date/vulnerable without a proof-of-concept

Mobile

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
  • API key leakage used for insensitive activities/actions
  • Attacks requiring physical access to the victim's device
Severity assessment

This program follows Intigriti's contextual CVSS standard

FAQ

Can I create a test account?

Yes and you are encouraged to do so! Please use your @intigriti.me email address for the account creation. More info can be found here: https://kb.intigriti.com/product-features/intigritime

What is this "Hall of fame"?

To thank you for reporting any security issue that is accepted by us, we offer the possibility to get added to the hall of fame hosted on our company website. .

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Overall stats
submissions received
190
average payout
N/A
accepted submissions
100
total payouts
N/A
Last 90 day response times
avg. time first response
< 2 days
avg. time to decide
< 2 weeks
avg. time to triage
< 2 days
Activity
12/6
logo
created a submission
12/6
VRT
changed the severity assessment
12/6
VRT
accepted a submission
12/6
VRT
accepted a submission
12/6
VRT
closed a submission
12/4
logo
created a submission
11/30
logo
created a submission
11/27
logo
created a submission
11/17
VRT
closed a submission
11/17
logo
created a submission