How Vntrip tackles customer data privacy challenge

Reading Time: 4 minutes

Explore how Vntrip secured customer data for hundreds of thousands of users by switching to crowdsourced bug bounty with CyStack’s WhiteHub platform.

Our client

Data has become a defining power of the digital economy. A huge competitive advantage goes to companies that fully harness their customer data, but that same value makes them a prime target for cyberattacks aiming to steal or destroy that data, especially technology firms. This is a risk that businesses in the field must take seriously.
Vntrip is a large online travel enterprise in Vietnam, providing hotel and flight booking across website, mobile, and partner channels. By the end of 2018, Vntrip had more than 500,000 users and over 10,000 hotel partners nationwide, with thousands of booking transactions and travel tickets every day. Vntrip’s biggest challenge was to secure customer data completely and to maintain system availability in the face of cyber threats.

Challenges

Vntrip’s applications and systems were updated continuously, with new features and promotions shipping almost every week. As a result, new bugs and vulnerabilities could appear that developers were unable to detect. A must-do task was to scrutinise and re-patch critical vulnerabilities as quickly as possible, because those bugs were great opportunities for hackers.

Vntrip originally relied on an in-house pentester team alongside an external Penetration Testing service to test its APIs, web, and mobile applications, with results and reports delivered every month. However, the reports did not bring as much value as expected. From the second report onward, most results showed little difference, and no truly critical vulnerabilities were found despite relentless updates to the APIs and software. In practice, the real cost Vntrip paid reached up to 50 million VND for a single bug.

Solution

The chosen solution was a Managed Bug Bounty program on WhiteHub, applying the Crowdsourced Security model to strengthen the security of Vntrip’s products.

Test object: Vntrip website (*.vntrip.vn), iOS app, and Android app.

Instead of depending on a single vendor, WhiteHub leverages the power of hundreds of security experts to find and report vulnerabilities at a much faster pace. By drawing on the diversity of skills and knowledge within a security community, the program could jointly solve a difficult security challenge for the enterprise.

• Public bug bounty: Launched publicly on WhiteHub in January 2019, open to the global researcher community.
• Full product scope: The program covered all of the company’s core products, the website and both mobile apps.
• Fast, continuous discovery: Many experts test in parallel, reducing review time and accelerating vulnerability discovery.
• Pay for results: Bounties are paid per valid vulnerability by severity, aligning cost directly with security value.

Result

Only two days after the program went live, the first vulnerabilities were detected by experts and reported directly to Vntrip for quick remediation. On 23 January 2019, the program marked an important milestone in Vntrip’s data security when a highly critical vulnerability, a potential threat that could have leaked information for a large number of customers and Vntrip membership cards, was promptly fixed.

After almost two months of running the Bug Bounty program on WhiteHub, a total of 78 vulnerabilities were found and re-patched, 25 of them rated Critical. The total budget Vntrip paid was only 92 million VND. With the Crowdsourced Security method, Vntrip paid less than 3 million VND to uncover a single critical vulnerability, a dramatic reduction compared with its previous approach.

Vntrip quickly recognised the advantages of crowdsourced security over traditional methods, especially for technology companies. The company has since integrated WhiteHub directly into its Software Development Life Cycle (SDLC), so that whenever a new application update is released, security issues are found and resolved promptly.

“During the whole time of using WhiteHub, we have been supported by an enthusiastic and friendly team.”

Mr. Nguyen Hong Thai
CTO at Vntrip

About Bug Bounty Program

A bug bounty program is a type of crowdsourced security that incentivizes individuals or groups, known as “ethical hackers”, to identify and report security vulnerabilities in a company’s software or systems. Companies offer rewards, such as monetary compensation, swags, or recognition, to ethical hackers who can find and report these vulnerabilities.
The purpose of a bug bounty program is to identify and address security vulnerabilities in a timely and efficient manner, while also providing a safe and secure environment for ethical hackers to report vulnerabilities. It helps organizations improve their security posture and reduce the risk of cyber-attacks and data breaches. It can also be used to test the security of a wide range of systems and applications, including web applications, mobile apps, and IoT devices.

One of the places that regularly opens bug bounty programs is WhiteHub, the first and largest community security platform in Vietnam developed by the CyStack team. WhiteHub supports businesses in launching their bug bounty programs to efficiently find vulnerabilities, with the participation of more than 3000 security experts. For more information, please visit: https://whitehub.net/

About CyStack

CyStack is a cybersecurity company based in Vietnam since 2017. We offer comprehensive solutions, including testing, security consulting, and managed services. With 200+ businesses and 20,000+ users around the world, we are recognized as a trusted partner for organizations and a strong leading firm in cybersecurity research and development.
For more information, please visit: https://cystack.net/