Deutsche Post Fronts Bug Hunt Stunt

[TrueBlueTerrier]

http://epostalnews.com/2010/09/06/deuts ... unt-stunt/" onclick="window.open(this.href);return false;

A month and a half after the launch of its new E-Postbrief hybrid electronic/postal secure mail service that had SAP promising to integrate it into its HR software and Allianz promising to use it with customers, Deutsche Post has invited white hat hackers to find faults in the new service.

The oddly worded English language version of the announcement said:

“The contest’s goal is to find vulnerabilities in the E-Postbrief web application. To achieve best customer protection, Deutsche Post will not work against, but pro-actively with the security community.

“The results of your team will contribute to the disruptive and sustainable transformation of postal communication.”

That second bit probably lost something in the translation, but why die Hölle did they make a point of reassuring us in the first bit that that Deutsche Post indeed “will not work against…the security community.” Who would have assumed otherwise?

Styled like a sports contest that runs through the end of the year, the “Security Cup” program will pay an undisclosed number of qualified teams €3,000 ($3,870) each to try to find bugs in the application, system and network software used in the E-Postbrief service. And it will pay them for any bugs they find: €5,000 ($6,450) for any major bug and €1,000 ($1,290) for any “normal” bug. Contest rules stipulate that participating teams are barred from disclosing their findings to anybody but the contest committee and from doing anything with any user data they gain access.

Deutsche Post has assembled a jury with a decidedly non-commercial tilt consisting of four people it calls “honorable members of the IT security community” – Jennifer Granick of the Electronic Frontier Foundation; open source developer Harald Welte of gpl-violations.org; David Evans, a University of Virginia professor and Professor Thorsten Holz with the German Honeynet Project, Ruhr-Uni Bochum

The contest will culminate in December with an awards ceremony and an announcement of the bugs that were found and patched.