Threema is a Swiss instant messenger that was built from the ground up with security and data privacy in mind.
For one thing, state-of-the-art end-to-end encryption prevents anyone other than the intended recipient (including the service provider) from reading the messages users exchange. For another thing, it is not required to provide any personal information (such as a phone number or email address) to use Threema. In other words, the service can be used completely anonymously. Finally, Threema adheres to the Privacy by Design principles, which is to say that only as little metadata as possible is generated, and it is only stored for the shortest amount of time possible.
The service provider hosts its own servers in Switzerland.
In participating in the program, ethical hackers agree not to use methods that would adversely affect the tested applications or their users. These methods include:
- Social engineering
- Denial-of-service attacks or other brute force attacks
- Physical attacks
In addition to the prohibited hacking methods listed above, Friendly Hackers are required to immediately discontinue vulnerability scanning if they determine that their conduct will result in a significant degradation (negative impact on regular users or on the operations team) of the Platform’s or Service’s operations.
Any design or implementation problem can be reported that is reproducible and affects security.
- Cross Site Request Forgery (CSRF)
- Cross Site Scripting (XSS)
- Insecure Direct Object Reference
- Remote Code Execution (RCE) - Injection Flaws
- Information Leakage an Improper Error Handling
- Unauthorized access to properties or accounts
- Data/information leaks
- Possibility of data/information exfiltration
- Backdoors that can be actively exploited
- Potential for unauthorized system use
The classification is verified using the Common Vulnerability Scoring System (CVSS, see first.org).
- Low: 0.1 – 3.9
- Medium: 4.0 – 6.9
- High: 7.0 – 8.9
- Critical: 9.0 - 10
The program is suspended when the set cost limit is reached.
The following services and applications may be tested. All other targets and third party services not listed here are not in scope.
Directory Server / ID Service
Work Cockpit & Backend
Broadcast Cockpit & Backend
Gateway Cockpit & Backend
- Start looking for vulnerabilities, respecting the definitions in this program (scope, rules, ...).
- Report found vulnerabilities and support the platform and the customer in verifying them.
- Get paid for confirmed, new vulnerabilities.
The organization gives its approval for Friendly Hackers to use hacking methods based on the specified bug bounty program. Due to this consent, the criminal liability criterion of unauthorized use and thus the criminal liability of the Friendly Hackers with regard to the elements of crime in Art. 143 StGB (unauthorized data acquisition) and Art. 143bis StGB (unauthorized intrusion into a data processing system) does not apply.
CHF 2'000 - 10'000
CHF 1'000 - 2'000
CHF 200 - 1'000
CHF 50 - 200