本計畫僅接受與產品及網站服務相關的安全性問題回報。未涵蓋在此計畫範圍的安全性問題回報將不予以獎金;然而,我們將視情況接受非本計畫範圍以內,但嚴重性高的安全性問題回報。

獎金

回報安全性問題時,請提供充足資訊以讓我們能夠重現您所回報的問題。獎金金額將視所回報問題之嚴重性及產品類別而定。

您必須符合下列所有條件,才有資格獲得獎金:

  1. 您是第一位回報特定安全性問題的研究人員。
  2. 您回報的安全性問題經確認為可驗證、可重現且符合獎勵資格的問題。
  3. 您遵守本計畫的所有條款和規定。

獎金將會於您所回報的安全性問題經 Synology 確認揭露後匯款至您的銀行帳戶,此流程須至少 90 天。

一則良好的安全性問題回報應包含下列資訊,以減少所需的處理時間:

  1. 提供清楚的文字描述,並逐步說明如何重現安全性問題。
  2. 說明安全性問題如何影響 Synology 的產品或網站服務,包含其版本與平台。
  3. 說明所回報之安全性問題的潛在危害性。

安全弱點研究與回報

若發現安全性問題,請聯絡我們:bounty@synology.com。回報安全弱點時,請使用我們提供的 PGP 金鑰以加密資訊。Synology Security Team 將於三日內回覆您,並會依據問題的嚴重性盡快修正問題。您所回報的問題經確認符合獎勵資格後,您的名字將列在本公司官方網站的安全性諮詢頁面上,以表揚您的貢獻。此流程須至少 90 天,獎金將於流程完成後匯款至您的銀行帳戶。

回報安全性問題時,請提供詳細的概念性驗證 (Proof of Concept;簡稱 PoC),並請確認所回報的安全性問題可被重現。請盡量提供簡潔的資訊;舉例來說,一則簡短的 PoC 連結之資訊價值高於一部解釋 SSRF 問題之影響的影片。當您研究和回報安全弱點時,請注意下列事項:

本公司有權隨時更改或取消本計畫及其政策,恕不另行通知。

常見問題

我該如何回報安全性問題?

請提供詳細的概念驗證 (Proof of Concept;簡稱 PoC) 並確認您所回報的安全弱點可被重現;此外,請使用我們提供的 PGP 金鑰加密服務進行回報,且不得將相關資訊透露給任何第三方組織。


誰負責決定我所回報的安全弱點是否符合獎勵資格?

所有弱點回報皆經由本公司資深軟體開發人員組成的 Synology Security Team 審查及評估。


若在安全弱點被修正前就將弱點公開,會有什麼後果呢?

我們致力於立即回覆您所回報的安全弱點,並在合理的時間範圍內修正問題。在您公開安全弱點的資訊前,請事先通知我們。若未遵守此準則,您便會喪失獲獎資格。


若在過時的軟體如 Apache 或 Nginx 發現安全性問題,我是否能獲得獎金呢?

請指出軟體的安全性問題並解釋為何該問題會危害軟體使用。忽略這類資訊的回報通常不會予以獎金。


我可以要求不要把名字列在群暉科技的安全性諮詢頁面上嗎?

可以。您可以要求不要將您的資訊列在我們的安全性諮詢頁面上。但是,若您符合獲獎資格且有意願領取獎金,我們仍會需要您的連絡資訊,以將獎金匯款給您。


若將安全弱點回報給安全性問題組織,是否依然符合獲獎資格呢?

若不是以修正問題為目的,卻私下將安全性問題透露給第三方組織,實有違本計畫之精神。因此,這類的回報將不符合獲獎資格。


若多位研究人員回報相同的安全弱點,獎金將頒發給誰呢?

獎金將發給第一位發現本公司先前未知的安全性問題的研究人員。

致謝

特別感謝所有安全性相關的研究人員與組織的協助。

  • Simon Effenberg (https://www.linkedin.com/in/simon-effenberg)
  • Niraj Mahajan (https://www.linkedin.com/in/niraj1mahajan)
  • Ayush Pandey (https://www.linkedin.com/in/ayush-pandey-148797175)
  • Sivanesh kumar D (https://twitter.com/sivanesh_hacker?s=09)
  • Touhid Shaikh (https://securityium.com/)
  • N Krishna Chaitanya (https://www.linkedin.com/in/n-krishna-chaitanya-27926aba/)
  • Ayush Mangal (https://www.linkedin.com/in/ayush-mangal-48a168110)
  • Tameem Khalid (https://www.linkedin.com/in/tameem-khalid-641a4b192/)
  • ddaa of TrapaSecurity (https://twitter.com/0xddaa)
  • Praveen Kumar
  • Oscar Spierings (https://polyform.dev)
  • Chanyoung So (https://www.linkedin.com/in/chanyoung-so-62551b115/)
  • swings of Chaitin Security Research Lab
  • Hasibul Hasan Rifat (https://twitter.com/rifatsec)
  • Lanni
  • Yeshwanth (https://www.linkedin.com/in/yeshwanth-b-4a560b202)
  • Darshan Sunil jogi (https://www.linkedin.com/in/darshan-jogi-9450431b6/)
  • Chanyoung So (https://www.linkedin.com/in/chanyoung-so-62551b115/)
  • Lanni
  • Swapnil Patil (https://www.linkedin.com/in/swapnil-patil-874223195)
  • Vladislav Akimenko (Digital Security) (https://dsec.ru)
  • Muhammad Junaid Abdullah (https://twitter.com/an0n_j)
  • Claudio Bozzato of Cisco Talos (https://talosintelligence.com/vulnerability_reports/)
  • Jose Hares (https://es.linkedin.com/in/jose-hares-arrieta-b419233b)
  • Aditya Soni (https://www.linkedin.com/in/adtyasoni)
  • Mansoor Amjad (https://twitter.com/TheOutcastCoder)
  • Thomas Fady (https://www.linkedin.com/in/thomas-fady)
  • James Smith (Bridewell Consulting) (https://bridewellconsulting.com)
  • Kinshuk Kumar (https://www.linkedin.com/in/kinshuk-kumar-4833551a1/)
  • Amit Kumar (https://www.linkedin.com/in/amit-kumar-9853731a4)
  • Mehedi Hasan Remon (twitter.com/remonsec)
  • Joshua Olson (www.linkedin.com/in/joshua-olson-cysa)
  • Vaibhav Rajeshwar Atkale(https://twitter.com/atkale_vaibhav)
  • Mohammed Eldawody (www.fb.com/eldawody0)
  • YoKo Kho (https://twitter.com/YoKoAcc)
  • Satyajit Das (https://www.linkedin.com/in/mrsatyajitdas)
  • Tinu Tomy (https://twitter.com/tinurock007)
  • Aniket Bhutani (https://www.linkedin.com/in/aniket-bhutani-6ba979192/)
  • Anurag Muley (https://www.linkedin.com/in/ianuragmuley/)
  • Howard Ching (https://www.linkedin.com/in/howard-ching-rhul/)
  • Janmejaya Swain (https://www.linkedin.com/in/janmejayaswainofficial)
  • Ahmad Firmansyah (https://twitter.com/AhmdddFsyaaah)
  • Agrah Jain (www.linkedin.com/in/agrahjain)
  • Shivam Kamboj Dattana (https://www.linkedin.com/in/sechunt3r/)
  • Pratik Vinod Yadav (https://twitter.com/PratikY9967)
  • Akshaykumar Kokitkar (https://mobile.twitter.com/cyber_agent2)
  • Shesha Sai C (https://www.linkedin.com/in/shesha-sai-c-18585b125)
  • Yash Agarwal (https://www.linkedin.com/in/yash-agarwal-17464715b)
  • Jan KOPEC (https://twitter.com/blogresponder)
  • Denis Burtanović
  • Hasibul Hasan Shawon -[Sec Miner's Bangladesh]
  • R Atik Islam (https://www.facebook.com/atik.islam.14661)
  • Jose Israel Nadal Vidal (https://twitter.com/perito_inf)
  • Thomas Grünert (https://de.linkedin.com/in/thomas-gr%C3%BCnert-250905168)
  • Matteo Bussani (https://www.linkedin.com/in/matteo-bussani-77b595198/)
  • Bing-Jhong Jheng (https://github.com/st424204/ctf_practice)
  • Swapnil Patil (https://www.linkedin.com/in/swapnil-patil-874223195)
  • Prakash Kumar Parthasarathy (https://www.linkedin.com/in/prakashofficial)
  • Kitab Ahmed (www.ahmed.science)
  • Ahmad Firmansyah (https://twitter.com/AhmdddFsyaaah)
  • Tiziano Di Vincenzo (https://www.linkedin.com/in/tiziano-d-3324a345/)
  • Pratik Vinod Yadav (https://www.linkedin.com/in/pratik-yadav-117463149)
  • Diwakar Kumar (https://www.linkedin.com/in/diwakar-kumar-5b3843114/)
  • Rushi Gayakwad
  • Yash Ahmed Quashim (https://www.facebook.com/abir.beingviper)
  • Swapnil Kothawade (https://twitter.com/Swapnil_Kotha?s=09)
  • Ankit Kumar (https://www.linkedin.com/in/ankit-kumar-42a644166/)
  • Aman Rai (https://www.linkedin.com/in/aman-rai-737a19146)
  • Rushikesh Gaikwad (https://www.linkedin.com/in/rushikesh-gaikwad-407163171)
  • Rupesh Tanaji Kokare (https://www.linkedin.com/in/rupesh-kokare-b63a78145/)
  • Sumit Jain (https://twitter.com/sumit_cfe)
  • Qian Chen of Qihoo 360 Nirvan Team
  • Vishal Vachheta (https://www.linkedin.com/in/vishal-vachheta-a30863122)
  • Zhong Zhaochen
  • Tomasz Grabowski
  • Nightwatch Cybersecurity Research (https://wwws.nightwatchcybersecurity.com)
  • Safwat Refaat (https://twitter.com/Caesar302)
  • Agent22 (https://securelayer7.net/)
  • Hsiao-Yung Chen
  • Rich Mirch (https://blog.mirch.io)
  • Ronak Nahar (https://www.linkedin.com/in/naharronak/)
  • Noman Shaikh (https://twitter.com/nomanAli181)
  • David Deller (https://horizon-nigh.org)
  • Mehedi Hasan (SecMiners BD) (https://www.facebook.com/polapan.1337)
  • Touhid M Shaikh (https://touhidshaikh.com)
  • Abhishek Gaikwad
  • Kitabuddin Ahmed
  • Noman Shaikh (https://twitter.com/nomanAli181)
  • Ajit Sharma (https://www.linkedin.com/in/ajit-sharma-90483655)
  • Agung Saputra Ch Lages (https://twitter.com/lagesgeges)
  • Dan Thomsen (www.thomsen.fo)
  • Erik de Jong (https://eriknl.github.io)
  • Sphinx 1,2 (https://www.facebook.com/Sphinx01.10/)
  • AHMED ELSADAT (https://www.linkedin.com/in/ahmed-elsadat-138755133/)
  • Hasibul Hasan (SecMiner)
  • Mohammed Eldawody (www.fb.com/eldawody0)
  • Chris Schneider
  • Abdullah Fares Muhanna (https://www.facebook.com/AbedullahFares)
  • Nick Blyumberg (https://www.linkedin.com/in/nickblyumberg/)
  • Axel Peters
  • Muhammad Junaid Abdullah (https://twitter.com/an0n_j)
  • Kyle Green
  • Thomas Fady (https://www.linkedin.com/in/thomas-fady)
  • Dankel Ahmed (https://hackerone.com/kitab)
  • ShuangYY
  • HackTrack Security
  • Muhammed Ashmil K K (Kavuthukandiyil)
  • Muhammad Junaid Abdullah (https://twitter.com/snoviboy)
  • Kishan kumar (https://facebook.com/noobieboy007)
  • Lays (http://l4ys.tw)
  • Ashish Kumar (https://www.facebook.com/buggyashish)
  • Lakshay Gupta (http://linkedin.com/in/lakshay-gupta-44102a143)
  • Meng-Huan Yu (https://www.linkedin.com/in/cebrusfs/)
  • Ifrah Iman (http://www.ifrahiman.com)
  • Mohammed Israil (https://www.facebook.com/VillageLad, https://www.linkedin.com/in/mohammed-israil-221656128)
  • Taien Wang (https://www.linkedin.com/in/taienwang/)
  • Emad Shanab (@Alra3ees) (https://twitter.com/Alra3ees?s=09)
  • குகன் ராஜா (Havoc Guhan) (https://fb.com/havocgwen)
  • Yasser Gersy (https://twitter.com/yassergersy)
  • Ismail Tasdelen (https://www.linkedin.com/in/ismailtasdelen)
  • Thomas Fady (https://www.linkedin.com/in/thomas-fady)
  • Oliver Kramer (https://www.linkedin.com/in/oliver-kramer-670206b5)
  • 1N3@CrowdShield (https://crowdshield.com)
  • louys, Xie Wei (解炜), Li Yanlong (李衍龙)
  • Zuo Chaoshun (https://www.linkedin.com/in/chaoshun-zuo-5b9559111/)
  • Ali Razzaq (https://twitter.com/AliRazzaq_)
  • 丁諭祺(Yu-Chi Ding) from DEVCORE CHROOT
  • Alex Weber (www.broot.ca)
  • Alex Bastrakov (https://twitter.com/kazan71p)
  • Mehidia Tania (https://www.beetles.io)
  • freetsubasa (https://twitter.com/freetsubasa)
  • Łukasz Rutkowski (http://www.forit.pl/)
  • Maximilian Tews (www.linkedin.com/in/maximilian-tews)
  • Bryan Galao (https://www.facebook.com/xbryan.galao)
  • Jim Zhou (vip-cloud.cn)
  • Chun Han Hsiao
  • Nightwatch Cybersecurity Research (https://wwws.nightwatchcybersecurity.com)
  • Olivier Bédard
  • Mohamed Eldawody (https://www.facebook.com/Eldawody0)
  • Jose Hares (https://es.linkedin.com/in/jose-hares-arrieta-b419233b)
  • 郑吉宏通过 GeekPwn 平台提交
  • Independent Security Evaluators (ISE) labs
  • Independent security researcher, MengHuan Yu, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
  • B.Dhiyaneshwaran (https://www.linkedin.com/in/dhiyaneshwaran-b-27947a131/)
  • Freiwillige Feuerwehr Rohrbach (www.ff-rohrbach.de)
  • Uriya Yavnieli from VDOO (https://vdoo.com)
  • Jung Chan Hyeok
  • Zhong Zhaochen (http://asnine.com)
  • Honc 章哲瑜 (https://www.facebook.com/you.toshoot)
  • Sumit Jain
  • Ketankumar B. Godhani (https://twitter.com/KBGodhani)
  • karthickumar (Ramanathapuram)
  • Alireza Azimzadeh Milani
  • Taien Wang (https://www.facebook.com/taien.tw)
  • Frédéric Crozat (http://blog.crozat.net/)
  • Muhammad Hassaan Khan (https://www.facebook.com/Profile.Hassaan)
  • SSD/Kacper Szurek
  • Alexander Drabek (https://www.2-sec.com/)
  • RAVELA PRAMOD KUMAR (https://mobile.twitter.com/PramodRavela)
  • Kushal Arvind Shah of Fortinet’s FortiGuard Labs
  • Alvin Poon (https://alvinpoon.myportfolio.com/)
  • C.shahidyan, C.Akilan, K.Sai Aswanth
  • BambooFox (https://bamboofox.github.io/)
  • Sajibe Kanti (https://twitter.com/sajibekantibd)
  • Huy Kha (linkedin.com/in/huykha)
  • Pal Patel (https://www.linkedin.com/in/pal434/)
  • Pethuraj M (https://www.linkedin.com/in/pethu/)
  • Ali Ashber (https://www.facebook.com/aliashber7)
  • Muzammil Abbas Kayani (@muzammilabbas2 )
  • Tayyab Qadir (facebook.com/tqMr.EditOr)
  • Babar Khan Akhunzada (www.SecurityWall.co)
  • Mahad Ahmed (https://octadev.com.pk)
  • JD Duh (blog.johndoe.tw, www.linkedin.com/in/JD-Duh)
  • Mubassir Kamdar (http://www.mubassirkamdar.com)
  • Daniel Díez Tainta (https://twitter.com/danilabs)
  • Tushar Rawool (twitter.com/tkrawool)
  • Thrivikram Gujarathi (https://www.linkedin.com/in/thrivikram-gujarathi-certified-ethical-hacker-bug-bounty-hunter-53074796)
  • Ashish Kunwar (twitter: @D0rkerDevil)
  • Steven Hampton (Twitter: @Keritzy, https://stevenh.neocities.org/)
  • Peter Bennink (https://www.linkedin.com/in/peter-bennink/)
  • Thomas Fady (https://www.linkedin.com/in/thomas-fady/)
  • Roopak Voleti (https://m.facebook.com/sairoopak.voleti)