Press Releases
31 vulnerabilities remediated in second Government Bug Bounty Programme
1 October 2019
GovTech launches Vulnerability Disclosure Programme to further strengthen ecosystem collaboration.
1 The Government Technology Agency (GovTech) and Cyber Security Agency of Singapore (CSA) have successfully concluded the second Government Bug Bounty Programme (BBP). This second BBP was conducted from 8 to 28 July 2019. Its findings were released at the sidelines of the Singapore International Cyber Week 2019.
2 The BBP is part of the Government’s ongoing efforts to build a secure and resilient Smart Nation. It complements the conventional methods of vulnerability assessment and penetration testing, enabling the government to benchmark its defences against the global and local community of researchers and white hats. The inaugural BBP was conducted from 27 December 2018 to 16 January 2019.
3 The second edition of BBP covered nine Internet-facing government ICT systems and digital services with high user touchpoints: SingPass and MyInfo (GovTech); OneMap website and mobile (Singapore Land Authority); MASNET and MAS corporate website (Monetary Authority of Singapore); Parents Gateway (Ministry of Education); and SGWorkPass mobile and Check Work Pass Status e-Service (Ministry of Manpower).
Key highlights of the second Government BBP
Of the 31 validated vulnerabilities, four were considered “high severity” and the remaining 27 were “medium/low severity”. All vulnerabilities have been remediated.
290 local and overseas cybersecurity researchers and white hats participated.
70 participants were Singaporeans, of which 30 participated in the first Government BBP.
Total bounty paid out was US$25,950.
Seven out of the top 10 awarded bounty participants were Singaporeans.
The top white hat hacker is a Singaporean (24-year-old NSF with the moniker of “spaceraccoon”). He found nine vulnerabilities, and was awarded US$8,500 in bounty.
4 As the two BBPs have succeeded in helping us discover vulnerabilities that would otherwise be undetected, the Government will conduct the third BBP in November 2019 to cover more government ICT systems and digital services. We hope to continue this effective engagement of the cybersecurity community and industry to strengthen the security posture of our ICT systems and digital services.
Launch of Vulnerability Disclosure Programme
The BBP is time bound and limited to a fixed set of systems and services. To complement this, GovTech has also launched a Vulnerability Disclosure Programme (VDP) on 1 October 2019. The VDP invites members of the public to identify and report the discovery of vulnerabilities found in all government internet-facing web-based and mobile applications. More information on VDP can be found in the attached factsheet.
ISSUED BY THE GOVERNMENT TECHNOLOGY AGENCY OF SINGAPORE AND THE CYBER SECURITY AGENCY OF SINGAPORE
About Government Technology Agency
The Government Technology Agency of Singapore (GovTech) is the lead agency driving Singapore’s Smart Nation initiative and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government’s capabilities in Data Science & Artificial Intelligence, Application Development, Sensors & IoT, Digital Infrastructure, and Cybersecurity.
GovTech supports public agencies to manage enterprise IT operations and develop new digital products for citizens and businesses. GovTech is the public sector lead for cybersecurity, and oversees key government ICT infrastructure, as well as regulates ICT procurement, data protection and security in the public sector. GovTech is a Statutory Board under the Smart Nation and Digital Government Group (SNDGG) in the Prime Minister’s Office.
For more information, please visit