fidentity

Active

Fidentity Bug Bounty Public Requires: ID verification

Fidenty offers a new service that allows documents to be digitally signed after identification.

Procedure

You go through a QES process (passport and selfie) and sign a document.
The signing and identification are secured using WebAuthn.
After that you can sign documents with WebAuthn again and again, without identification.
An example of an attack would be someone taking over someone else's identification and signing documents with it.
The Certificate is stored in the browser so after the first verification one can sign documents with verification with the same browser

fidentity helps you to digitize the identification of customers either on site or on line. Without the hassle of an app or additional hardware, ID documents can be scanned with a mobile phone. Liveness verified selfies and digital signatures are available. Artificial intelligence prevents fraud and ensures compliance. An automatic decision is available in real time to control the next step in the onboarding process.

Assets in Scope

CHF 2,500

Max Bounty

Scope

The following services and applications may be tested. All other targets and third party services not listed here are not in scope.

Especially MAIL, Wordpress and other 3rd party software not in scope.

In Scope

Web Verification process API

API-Doku: https://demo.fidentity.ch/docs
API clientId / clientSecret: (check credentials section)

Quickstart Process:

Get Token with POST https://demo.fidentity.ch/api/v1/authenticate
Create Process with POST https://demo.fidentity.ch/api/v1/fidentity with sample data:

{
    "customer": {},
    "customer": {},
    "documentUris": [],
    "extId": "{{$guid}}",
    "noValidation": true,
    "processSteps": [{"type": "DocumentRegistration", "subtype": "main"}, {"type": "Selfie"}],
    "systemUrls": []
}

Take processUrl from response and start Identification in Browser

API key: intended use The API key is provided only so you can create processes and test the resulting end-user flow. It represents a trusted customer integration: in production, only our customers hold API keys, and they control the parameters they send.

Use the API key to:

Create processes with valid, realistic parameters
Obtain process links and test everything an end user or unauthenticated attacker can reach from there

Out of scope:

Findings that depend on malicious or invalid input passed via the API key (e.g. harmful redirect URLs, manipulated callback parameters), since a customer would only harm themselves or their own users
Load or abuse testing of the process creation endpoint

Reports based on out-of-scope use will be closed as not applicable. Repeated misuse may lead to the API key being revoked.

Web https://demo.fidentity.ch/dashboard

Dashboard for the verifiaction api (no demo accounts provided)

Web https://simplesign.fidentity.ch

Sign contracts with passports or id cards

Testing Rules

In participating in the program, ethical hackers agree not to use methods that would adversely affect the tested applications or their users. These include:

In addition to the prohibited hacking methods listed above, Friendly Hackers are required to immediately discontinue vulnerability scanning if they determine that their conduct will result in a significant degradation (negative impact on regular users or on the operations team) of the Platform's or Service's operations.

Social engineering
Spamming
Phishing
Denial-of-service attacks or other brute force attacks
Physical attacks

Qualified Vulnerabilities

Typical Examples

Any design or implementation problem can be reported that is reproducible and affects security.

Cross Site Request Forgery (CSRF)
Cross Site Scripting (XSS)
Insecure Direct Object Reference
Remote Code Execution (RCE) - Injection Flaws
Information Leakage an Improper Error Handling
Unauthorized access to properties or accounts
Data/information leaks
Possibility of data/information exfiltration
Backdoors that can be actively exploited
Potential for unauthorized system use
Misconfigurations

Non-Qualified

The following vulnerabilities and forms of documentation are generally not wanted and will be rejected:

Attacks that require physical access to a user's device or network
Forms with missing CSRF tokens (unless the criticality exceeds CVSS level 5)
Self-XSS
The use of a library known to be vulnerable or publicly known to be broken (unless there is active evidence of exploitability)
Reports from automated tools or scans without explanatory documentation
Social engineering targeting individuals or entities of the organisation
Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks
Bots, spam, bulk registration
Submission of best practices that do not directly result in an exploitable vulnerability (e.g., certificate pinning, missing security headers)
Use of vulnerable and "weak" cipher suites/ciphers
Missing Rate limiting without further security impact

Bounty Table

Severity	CVSS Range	Reward Range
Critical	9.0 – 10.0	CHF 1,500 – 2,500
High	7.0 – 8.9	CHF 800 – 1,500
Medium	4.0 – 6.9	CHF 300 – 800
Low	0.1 – 3.9	CHF 100 – 300

How It Works

Request access to this private bug bounty program
Start looking for vulnerabilities, respecting the definitions in this program (scope, rules, ...).
Report found vulnerabilities and support the platform and the customer in verifying them.
Get paid for confirmed, new vulnerabilities.

Additional information

Rules

fidentity operate various services (platforms, services). But only services from explicitly listed domains / URLs are in the scope of the Bug Bounty Program. All other domains or explicitly listed services are therefore not eligible for reward and do not fall under the Legal Safe Harbor Agreement.

By participating in this Bug Bounty Program, Friendly Hackers undertake to document information about any vulnerability found exclusively via the platform's designated reporting form and not in any other places. They also agree to keep the found vulnerability secret for 90 days after reporting it on the platform. Finally, they undertake to upload to the platform any data from customers that they have obtained as part of a bug bounty program and to delete any local copies afterwards and not to distribute them further.

User Agent

important: If your run tests append '-bugbounty-gobugfree'' to the User-Agent string

Cost control

The program is suspended when the set cost limit is reached.

Legal Safe Harbor

The organisation gives their approval for Friendly Hackers to use hacking methods based on the specified bug bounty program. Due to this consent, the criminal liability criterion of unauthorized obtaining/unauthorized use and thus the criminal liability of the Friendly Hackers with regard to the criminal offenses in Art. 143 Swiss Criminal Code (Unauthorised obtaining of data) and Art. 143bis Swiss Criminal Code (Unauthorised access to a data processing system) does not apply.