NAB's Responsible Disclosure Program

Thank you for participating in NAB’s Responsible Disclosure Program. The responsible disclosure of security vulnerabilities helps us ensure the security and privacy of NAB and our customers.

We continually strive to keep protecting our customers and colleagues through operational resilience while getting things done faster and delivering sustainable outcomes for our customer, colleagues, and the community. Working with Bugcrowd and security researchers fits in with our goals and strategy. After all, a more secure infrastructure means a more secure place for our customers to do their banking.

Reporting:

• To make a disclosure you'll need to first Sign up with Bugcrowd https://bugcrowd.com/user/sign_up or login to your existing account.
• Please be aware NAB may not correspond with you directly, disclose remediation steps or timeframes.
• No monetary disbursements for findings will be provided on this program.

Ratings:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher – along with the opportunity to appeal and make a case for a higher priority.

Guidelines: 

Targets on this program are from our Production environment, hence all testing needs to be performed in a production safe manner and all the following instructions should be strictly adhered to. If you have any questions around something being production safe or not please err on the side of caution and reach out to support@bugcrowd.com with any questions.

• If you discover other credentials during recon and testing, Do NOT use them for additional testing
• Do NOT pursue post-exploitation or pivot from the vulnerable target into other parts of the network unless explicitly approved by NAB to do so especially in the following situations:
  • The exploit will result in a permanent change to the target system and may impact the experience of other users (i.e. Stored Cross-Site Scripting)
  • The exploit has a high likelihood of impacting the availability of a service
  • The exploitation may result in sensitive NAB data (i.e. customer or financial information) being leaked
• Scanning Activity Guidelines: to reduce the likelihood of production outages
  • For any enumeration activities, scanners should be limited to a maximum of 6 requests/second
  • Recursive DNS enumeration should be minimized
  • NAB will not accept generic vulnerability scan results, as these are likely to be duplicated.
  • Any scanning or brute force attempts on Submission Forms is considered Out-Of-Scope and should not be attempted. You may reach out for approval to do manual testing.
• Follow the AWS pentesting guidelines where applicable: https://aws.amazon.com/security/penetration-testing/