Reporting vulnerabilities

Have you discovered a problem or a weakness in our internet services? Share it with our experts. We’d like to cooperate with you to solve these kinds of problems.

Responsible disclosure

Are you a security researcher who has discovered vulnerabilities in our systems? In that case, we’d like to cooperate with you to resolve these vulnerabilities before they are exploited.

Every day, Rabobank specialists focus on optimizing our systems and processes. As a result, our customers are better protected against abuse and we ensure optimal accessibility of our services. Of course, this doesn’t mean our systems are perfect and don’t have any potential vulnerabilities. That’s why we’d like to cooperate with information security experts who have identified a potential vulnerability in one of our systems.

In scope

We ask that you report all findings relating to the security of Rabobank services to us, preferably as soon as possible. This includes:

Remote Code Execution

Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF)

SQL Injection

Encryption vulnerabilities

Bypassing authentication or unauthorized access to data

Not in scope

Please do not contact this reporting desk with:

comments about the services provided by Rabobank

comments or questions about the accessibility of our services

reports of fraud or possible fraud

reports of possible fake or so-called phishing emails

reports of problems with ATMs (unless security-related)

reports of viruses and/or malware

You can report phishing emails directly by sending an email to: valse-email@rabobank.nl.

Exclusions

Rabobank does not provide a reward for trivial or non-exploitable bugs. Below are some examples of known vulnerabilities and accepted risks for which no reward is provided.

HTTP 404 codes/pages or other HTTP non-200 codes/pages.

Fingerprinting/version of banner disclosure on general/public services.

Publicly accessible files and folders with non-sensitive information, (e.g. robots.txt).

Clickjacking and related vulnerabilities. CSRF on forms that are available without a session (e.g. a contact form/login form).

Logout Cross-Site Request Forgery.

Presence of an ‘autocomplete’ or ‘save password’ functionality.

Lack of ‘Secure’ / ‘HTTP Only’ flags on non-sensitive cookies.

Weak CAPTCHA or CAPTCHA circumvention.

Brute force on the Forget Password Page and Account Lockout not being enforced.

OPTIONS Method is enabled.

Username / Email enumeration by brute force attempts: via Login error messages. ‘Forget Password’ error messages.

Lack of HTTP Security Headers such as: Strict-Transport-Security. X-Frame-Options. X-XSS-Protection. X-Content-Type-Options. Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP.

SSL configuration weaknesses: SSL attacks that cannot be exploited remotely. SSL ‘Forward Secrecy’ is not enabled. SSL is weak / insecure cipher suites.

Missing HTTP Public Key Pinning (HPKP).

SPF, DKIM, DMARC issues.

Host Header Injection.

Content Spoofing/Text Injection on 404 pages.

Reporting old software versions without a proof of concept or working exploit.

Information leakage in Metadata. >

Missing DNSSEC.

Expired or inactive domains (domain takeover).

Same Site Scripting / localhost DNS record.

More information

During your investigation you could be taking action that may breach the law. If these actions are performed in good faith and you respect the following rules, there is no reason whatsoever for Rabobank to report this to the authorities. We kindly ask you to respect the following rules and not to act irresponsibly.

Do not make the vulnerability public before we resolve it. Instead, talk to our experts and give them time to solve the problem.

Make sure that no harm is caused during yours and our investigation of the reported finding.

Do not use Social Engineering to gain access to Rabobank’s IT systems.

The investigation must not disrupt our (online) services under any circumstances.

The investigation may not result in the disclosure of bank and/or customer data in any way whatsoever.

There is no acceptable reason for leaving a backdoor in the system, not even to demonstrate the vulnerability. The installation of a backdoor compromises security even more. Do not alter or delete any data. If it is necessary to make a copy of the data in the system for the findings, limit it to what is necessary for the burden of proof.

Do not make any changes to the system’s configuration.

Limit system penetration to what is strictly necessary to find and demonstrate the vulnerability. If access has been obtained, we do not expect it to be shared with others in any way whatsoever.

Do not use brute force techniques to gain access to the systems.

Do not use techniques that affect the accessibility of our (online) services.

The above rules (the so-called Responsible Disclosure Regulation) were established in consultation with the National Cyber Security Centre.

Derogating international rules

Please note that laws and regulations for Responsible Disclosures also differ from one country to another. If you reside outside the Netherlands, our policy may not be fully applicable to you. Therefore, it’s possible that even if you have acted in accordance with the guidelines of Rabobank’s Responsible Disclosure Policy, legal action may be taken despite the fact that Rabobank has not reported the vulnerability.

Describe the vulnerability you discovered as clearly and in as much detail as possible, attaching the evidence. You can assume that the report will be read by technical security experts.

State at least the following:

What vulnerability you found.

The full URL where it was found.

The steps taken to find the vulnerability.

Objects (such as filters or input fields) that play a role.

Screen prints are appreciated.

Please not that we only accept reports in English.

Submit a report using the form

Send your report using the form via the following link. A team of security experts will investigate your report. Give them time to solve the problem. We will let you know our opinion of your report as soon as possible. We will also inform you of whether we will implement a solution and when we will do so.

Submit your report using the form

If you submit a report anonymously, you are not eligible for a reward. After receiving your report, a team of security experts will assess it and respond as quickly as possible. We kindly ask that you be patient and give them time to carry out a thorough investigation and to determine the right actions. We’ll get in touch as soon as more information becomes available. Please do not make the report public under any circumstances without consulting our experts.

Rabobank highly appreciates your efforts to help us keep our systems and processes secure. For this reason, in most cases, we will pay you a suitable monetary reward. The amount is determined by the related impact. We do not have to justify our decision and we reserve the right at all times to determine the reward and the amount entirely at our discretion.

A reward is not paid if:

Separate parties report the same vulnerability. In that case, the first party to submit a report receives a reward.

You live in a sanctioned country.

The vulnerability is already known to us.

There is abuse or violation of the rules.

In order to keep you informed and to be able to pay you a potential reward, we ask you to provide your contact details such as your name, email address, PGP Key and, in some cases, your telephone number. If the vulnerability is reported anonymously, we respect this.

The contact details will only be used to keep you informed about the above matters and will not be passed on to third parties without your explicit consent. However, this is not the case if we are required by law to report it or if we transfer the investigation of the reported vulnerability to an external party. In these cases, we make every effort to keep this information confidential and we remain responsible for it.

Products

Themes

Our Bank

Our impact

Help

Reporting vulnerabilities

Responsible disclosure

In scope

Not in scope

Exclusions

More information

Rules

Derogating international rules

Reporting a vulnerability

Submit a report using the form

Reward

Privacy

Further reading

Learn to recognize fraud

Report fraud

Prevent fraud

Secure business banking (Dutch)