1
00:00:03,090 --> 00:00:06,859
[Music]

2
00:00:06,859 --> 00:00:08,960
thank you

3
00:00:08,960 --> 00:00:12,390
thank you very much

4
00:00:12,390 --> 00:00:16,859
[Applause]

5
00:00:16,859 --> 00:00:20,580
um so this actually talked was

6
00:00:20,580 --> 00:00:22,800
about a bug we found like I do bug

7
00:00:22,800 --> 00:00:26,939
Bounty a lot when I don't do my regular

8
00:00:26,939 --> 00:00:28,140
job

9
00:00:28,140 --> 00:00:31,439
and I had lots of conflicts and thoughts

10
00:00:31,439 --> 00:00:34,500
about what what should I do when I

11
00:00:34,500 --> 00:00:36,660
report stuff especially in federal party

12
00:00:36,660 --> 00:00:39,780
vendors because Federal body vendors you

13
00:00:39,780 --> 00:00:42,540
have much more totally now and it's a

14
00:00:42,540 --> 00:00:44,040
big problem of the world like everybody

15
00:00:44,040 --> 00:00:47,460
is using so much AFL parties and I will

16
00:00:47,460 --> 00:00:49,320
just like start my talk

17
00:00:49,320 --> 00:00:52,440
but about me

18
00:00:52,440 --> 00:00:54,719
so I'm building an abstract Marketplace

19
00:00:54,719 --> 00:00:56,579
currently at a company called cyto

20
00:00:56,579 --> 00:00:59,160
security this we connect to all the

21
00:00:59,160 --> 00:01:01,440
supply chains and this is why I'm doing

22
00:01:01,440 --> 00:01:03,239
so much bug Bounty and I'm trying to

23
00:01:03,239 --> 00:01:04,260
understand

24
00:01:04,260 --> 00:01:07,740
all of the different vectors of the

25
00:01:07,740 --> 00:01:10,140
whole supply chain but I do also bug

26
00:01:10,140 --> 00:01:13,560
Bounty so I was in the h1702 last week

27
00:01:13,560 --> 00:01:16,439
here in Vegas and I was in the bug bash

28
00:01:16,439 --> 00:01:18,720
event so I'm already two weeks in Vegas

29
00:01:18,720 --> 00:01:22,020
I don't know nothing I'm it's hard for

30
00:01:22,020 --> 00:01:24,900
me I do some security research so I

31
00:01:24,900 --> 00:01:27,659
created some cve bugs I'm a developer

32
00:01:27,659 --> 00:01:30,420
I'm a problem maker and a solver so

33
00:01:30,420 --> 00:01:32,159
usually what I do in the company I just

34
00:01:32,159 --> 00:01:34,439
like make problems for everybody and

35
00:01:34,439 --> 00:01:36,780
then help them solve them back

36
00:01:36,780 --> 00:01:39,960
so and I do Paladin work so I just like

37
00:01:39,960 --> 00:01:42,479
create an auger for every cyber security

38
00:01:42,479 --> 00:01:44,880
stuff over here

39
00:01:44,880 --> 00:01:48,659
and one day while I was hunting

40
00:01:48,659 --> 00:01:51,240
in the Ambassador World Cup that was a

41
00:01:51,240 --> 00:01:53,700
few months ago there was a Ambassador

42
00:01:53,700 --> 00:01:56,759
World Cup lots of com lots of countries

43
00:01:56,759 --> 00:01:59,340
participated in this event and we were

44
00:01:59,340 --> 00:02:01,380
able we were supposed to hack together

45
00:02:01,380 --> 00:02:03,020
as a country

46
00:02:03,020 --> 00:02:06,960
to all the getting points did us a

47
00:02:06,960 --> 00:02:09,538
pretty cool event and I met some good

48
00:02:09,538 --> 00:02:12,000
people over there over here and we

49
00:02:12,000 --> 00:02:15,300
hacked some stuff and we just like went

50
00:02:15,300 --> 00:02:18,120
over but then I don't know some of you

51
00:02:18,120 --> 00:02:20,959
from the bug Bounty world no way

52
00:02:20,959 --> 00:02:24,480
and we we together we found a bug

53
00:02:24,480 --> 00:02:28,260
uh we created a CV for it and I would

54
00:02:28,260 --> 00:02:30,840
talk a bit about this bug but before

55
00:02:30,840 --> 00:02:33,239
that there was a previous bug oh you

56
00:02:33,239 --> 00:02:35,160
can't see it here so

57
00:02:35,160 --> 00:02:37,260
oh [ __ ] you can't see it over here also

58
00:02:37,260 --> 00:02:41,400
so the tldr of this is

59
00:02:41,400 --> 00:02:43,680
we found a bug in uh

60
00:02:43,680 --> 00:02:46,640
place called a plug-in called Elemento

61
00:02:46,640 --> 00:02:49,140
the elemental plugin was installed in

62
00:02:49,140 --> 00:02:51,540
about at that time I think it was like 8

63
00:02:51,540 --> 00:02:54,420
million or more nine nine to ten million

64
00:02:54,420 --> 00:02:57,239
depends who who counts uh websites

65
00:02:57,239 --> 00:03:00,660
around the world and this plug is like a

66
00:03:00,660 --> 00:03:02,640
side building website so you can create

67
00:03:02,640 --> 00:03:05,459
your own site like Wix or other kinds of

68
00:03:05,459 --> 00:03:08,280
solutions and you you have different

69
00:03:08,280 --> 00:03:11,159
capabilities so over there and that bug

70
00:03:11,159 --> 00:03:13,860
specifically you had a lightbox settings

71
00:03:13,860 --> 00:03:17,280
that you can send a base64 code

72
00:03:17,280 --> 00:03:20,340
and this base64 will go eventually in

73
00:03:20,340 --> 00:03:22,980
the JavaScript and execute some stuff

74
00:03:22,980 --> 00:03:25,620
and someone found out that you can just

75
00:03:25,620 --> 00:03:29,340
like added HTML and this sets on secure

76
00:03:29,340 --> 00:03:31,739
HTML into the code and this creates like

77
00:03:31,739 --> 00:03:35,340
a Dom based corset scripting attack on

78
00:03:35,340 --> 00:03:37,680
in the suburb so we scanned a lot of

79
00:03:37,680 --> 00:03:39,840
websites and one of our targets had this

80
00:03:39,840 --> 00:03:43,260
this affected bug but we couldn't find

81
00:03:43,260 --> 00:03:45,120
it didn't it it was passion it wasn't

82
00:03:45,120 --> 00:03:48,599
affected so we just like went full into

83
00:03:48,599 --> 00:03:50,519
it and start getting the code and

84
00:03:50,519 --> 00:03:52,980
started to see like can we bypass this

85
00:03:52,980 --> 00:03:54,000
protection

86
00:03:54,000 --> 00:03:57,000
so when you see over here in the

87
00:03:57,000 --> 00:03:59,940
previous one the HTML content had this

88
00:03:59,940 --> 00:04:03,180
e.html e is the payload that we will

89
00:04:03,180 --> 00:04:05,940
send we were sending and the HTML just

90
00:04:05,940 --> 00:04:08,340
like got into the set HTML content and

91
00:04:08,340 --> 00:04:10,200
they fixed it

92
00:04:10,200 --> 00:04:12,780
afterwards they fixed it and they just

93
00:04:12,780 --> 00:04:14,879
deleted the HTML so you can't set it

94
00:04:14,879 --> 00:04:15,720
anymore

95
00:04:15,720 --> 00:04:17,639
but then we saw those different like

96
00:04:17,639 --> 00:04:20,339
type types so you have video you have

97
00:04:20,339 --> 00:04:22,560
image you have slideshow and we went

98
00:04:22,560 --> 00:04:24,240
over all of these types and wanted to

99
00:04:24,240 --> 00:04:26,940
look at the different areas so for such

100
00:04:26,940 --> 00:04:28,460
video

101
00:04:28,460 --> 00:04:31,560
for instance this was the function and

102
00:04:31,560 --> 00:04:33,120
anybody can see what's the problem here

103
00:04:33,120 --> 00:04:36,080
like five seconds

104
00:04:37,280 --> 00:04:40,500
this is like the code itself and if you

105
00:04:40,500 --> 00:04:42,720
can see over in

106
00:04:42,720 --> 00:04:46,440
the N tsjquery you see the t is jQuery

107
00:04:46,440 --> 00:04:48,720
it's the Gunning stuff and then if the E

108
00:04:48,720 --> 00:04:50,580
video type is hosted

109
00:04:50,580 --> 00:04:53,520
then it goes into a different case and

110
00:04:53,520 --> 00:04:56,040
it creates like a video parameter with n

111
00:04:56,040 --> 00:05:01,680
now n is the extension of the data of a

112
00:05:01,680 --> 00:05:03,540
source URL autoplay and the video

113
00:05:03,540 --> 00:05:05,940
programs so whatever we put into video

114
00:05:05,940 --> 00:05:07,979
programs will be converted into our

115
00:05:07,979 --> 00:05:10,820
attribute into the video

116
00:05:10,820 --> 00:05:12,900
HTML content

117
00:05:12,900 --> 00:05:16,080
so this is actually the bug and then if

118
00:05:16,080 --> 00:05:19,199
you if we continue and we just created

119
00:05:19,199 --> 00:05:22,560
this Arrow we have uh on Arrow so the

120
00:05:22,560 --> 00:05:25,500
video cannot load and then an arrow runs

121
00:05:25,500 --> 00:05:27,660
our payload inside and this is again

122
00:05:27,660 --> 00:05:30,300
base64 encoding and adding it into the

123
00:05:30,300 --> 00:05:32,580
lightbox settings and then when we run

124
00:05:32,580 --> 00:05:35,759
it we are able to execute code in a down

125
00:05:35,759 --> 00:05:38,160
base scenario Dom based means that the

126
00:05:38,160 --> 00:05:39,360
server doesn't

127
00:05:39,360 --> 00:05:41,820
seed anything like if you attack someone

128
00:05:41,820 --> 00:05:45,300
it's silent no logs no nothing nobody

129
00:05:45,300 --> 00:05:47,699
knows about it it's the most fun bugs

130
00:05:47,699 --> 00:05:50,460
and the most hard bugs for forensics and

131
00:05:50,460 --> 00:05:52,380
instant response to understand what

132
00:05:52,380 --> 00:05:54,560
happened

133
00:05:54,600 --> 00:05:56,720
um

134
00:05:56,880 --> 00:05:59,400
so a bit of a POC

135
00:05:59,400 --> 00:06:01,740
and the demo and actually the bug Bounty

136
00:06:01,740 --> 00:06:05,280
they asked us to do a full impact VLC so

137
00:06:05,280 --> 00:06:09,300
we created a payload that this is like a

138
00:06:09,300 --> 00:06:12,840
a normal admin user that is has access

139
00:06:12,840 --> 00:06:16,919
to a test page and indicate like a page

140
00:06:16,919 --> 00:06:20,220
free and when you see over here just

141
00:06:20,220 --> 00:06:22,620
like created a new user so you create

142
00:06:22,620 --> 00:06:25,199
like a hacker one user and this is

143
00:06:25,199 --> 00:06:27,360
actually what we did in the payload we

144
00:06:27,360 --> 00:06:30,560
asked for the nuns to get like access to

145
00:06:30,560 --> 00:06:33,900
the csrf token and with the csrf token

146
00:06:33,900 --> 00:06:35,900
we submit again

147
00:06:35,900 --> 00:06:38,639
request to Wordpress to create a new

148
00:06:38,639 --> 00:06:40,979
user and then when someone clicks this

149
00:06:40,979 --> 00:06:44,039
link he just like a new admin user pops

150
00:06:44,039 --> 00:06:46,680
up inside the system and we can access

151
00:06:46,680 --> 00:06:47,759
it

152
00:06:47,759 --> 00:06:49,860
so I think this was the POC and we

153
00:06:49,860 --> 00:06:52,220
showed it

154
00:06:52,560 --> 00:06:54,560
no

155
00:06:54,560 --> 00:06:57,539
uh a bit about like down base and like

156
00:06:57,539 --> 00:07:00,300
why I love them they're scary I I told

157
00:07:00,300 --> 00:07:01,979
you a bit about like how effective they

158
00:07:01,979 --> 00:07:02,500
are and

159
00:07:02,500 --> 00:07:04,100
[Music]

160
00:07:04,100 --> 00:07:07,139
no not none much people look for them

161
00:07:07,139 --> 00:07:08,759
because it's looking at JavaScript and

162
00:07:08,759 --> 00:07:10,860
looking at minified code and it's very

163
00:07:10,860 --> 00:07:12,780
hard to understand you need to know code

164
00:07:12,780 --> 00:07:15,360
and to go and look at all the different

165
00:07:15,360 --> 00:07:17,960
flows inside them but once you get them

166
00:07:17,960 --> 00:07:21,000
you actually the client is sending a

167
00:07:21,000 --> 00:07:23,160
request to the server and then it

168
00:07:23,160 --> 00:07:25,860
attacks himself so there is no the

169
00:07:25,860 --> 00:07:28,380
server doesn't know that like if I would

170
00:07:28,380 --> 00:07:31,259
want to tell some client of us to

171
00:07:31,259 --> 00:07:33,720
protect himself of it he doesn't have

172
00:07:33,720 --> 00:07:35,880
any way to protect himself like there's

173
00:07:35,880 --> 00:07:38,819
no love that you can put in and this is

174
00:07:38,819 --> 00:07:42,240
a pretty interesting to see okay and

175
00:07:42,240 --> 00:07:44,160
just like we scanned the whole internet

176
00:07:44,160 --> 00:07:46,080
and we saw like eight million websites

177
00:07:46,080 --> 00:07:48,360
so from different versions as you can

178
00:07:48,360 --> 00:07:51,180
see here lots of versions of

179
00:07:51,180 --> 00:07:54,000
old versions like so you have like this

180
00:07:54,000 --> 00:07:55,979
whole range of vulnerable so we

181
00:07:55,979 --> 00:07:58,199
submitted we submitted it to a few bugs

182
00:07:58,199 --> 00:08:00,479
actually and they told us no it's a

183
00:08:00,479 --> 00:08:02,400
duplicate because we didn't fix the bug

184
00:08:02,400 --> 00:08:07,500
from last year so it was like funny uh I

185
00:08:07,500 --> 00:08:09,840
don't know why but we have so much stuff

186
00:08:09,840 --> 00:08:12,060
over there if you can go scanning and

187
00:08:12,060 --> 00:08:15,060
you find a new Target then just add me

188
00:08:15,060 --> 00:08:17,160
as like a one percent collaboration or

189
00:08:17,160 --> 00:08:19,139
something but

190
00:08:19,139 --> 00:08:22,560
um so my my biggest question was now we

191
00:08:22,560 --> 00:08:24,000
found this problem

192
00:08:24,000 --> 00:08:26,220
what can we do about it like what's the

193
00:08:26,220 --> 00:08:28,319
best way to approach it like if you've

194
00:08:28,319 --> 00:08:31,740
seen the don't look up like can I come

195
00:08:31,740 --> 00:08:33,839
saying to the world like no this is a

196
00:08:33,839 --> 00:08:36,000
problem you have to do it now you have

197
00:08:36,000 --> 00:08:38,580
to fix everything and what is the best

198
00:08:38,580 --> 00:08:41,219
scenario of fixing stuff

199
00:08:41,219 --> 00:08:44,700
so now this is not a log for Jay it's

200
00:08:44,700 --> 00:08:46,440
not a shell shock maybe one day I will

201
00:08:46,440 --> 00:08:48,480
find a log for JN that would be fun for

202
00:08:48,480 --> 00:08:51,540
me but for now I'm imagining like what

203
00:08:51,540 --> 00:08:54,420
will happen if this was a CB system and

204
00:08:54,420 --> 00:08:57,660
uh how to play log 4J shell shock

205
00:08:57,660 --> 00:09:00,540
whatever problem you found you've heard

206
00:09:00,540 --> 00:09:03,720
about in the past that gave us 10 or

207
00:09:03,720 --> 00:09:05,160
even a nine

208
00:09:05,160 --> 00:09:06,959
and now the question is like what should

209
00:09:06,959 --> 00:09:09,600
I do should I go to the money side I

210
00:09:09,600 --> 00:09:11,640
want to get as many much money money

211
00:09:11,640 --> 00:09:14,160
from much money from this possibly

212
00:09:14,160 --> 00:09:17,820
without going into the illegal area like

213
00:09:17,820 --> 00:09:20,100
you're going only legal do I want like

214
00:09:20,100 --> 00:09:21,959
to create a CV and let everybody know

215
00:09:21,959 --> 00:09:23,580
about it do I want like the recognition

216
00:09:23,580 --> 00:09:27,300
of how what's I did a good job here this

217
00:09:27,300 --> 00:09:29,279
is my recognition everybody know about

218
00:09:29,279 --> 00:09:32,399
me I'm cool I know I played with it for

219
00:09:32,399 --> 00:09:35,339
five hours and found it so I don't know

220
00:09:35,339 --> 00:09:37,980
how good is it but then

221
00:09:37,980 --> 00:09:39,899
I talked with some random dude over the

222
00:09:39,899 --> 00:09:41,880
last week and he told me this is a new

223
00:09:41,880 --> 00:09:43,560
slide I just put it on release it and

224
00:09:43,560 --> 00:09:45,899
paste them in and see what it does I

225
00:09:45,899 --> 00:09:47,760
think like this is a I don't know if

226
00:09:47,760 --> 00:09:50,700
it's a good idea or not but it happens

227
00:09:50,700 --> 00:09:53,760
so like luck 4J was something like that

228
00:09:53,760 --> 00:09:57,720
like there was a the Alibaba was in a

229
00:09:57,720 --> 00:09:59,220
fight with the government and then they

230
00:09:59,220 --> 00:10:01,260
just like released it and everybody we

231
00:10:01,260 --> 00:10:03,839
oh who panicked from log4j over here

232
00:10:03,839 --> 00:10:07,080
like who did knights

233
00:10:07,080 --> 00:10:09,000
so yeah we have a lot of people over

234
00:10:09,000 --> 00:10:11,399
here that did lights and days and like I

235
00:10:11,399 --> 00:10:14,220
don't think it's the best way to

236
00:10:14,220 --> 00:10:16,920
release something like this but I don't

237
00:10:16,920 --> 00:10:19,980
know what's what is the best way so this

238
00:10:19,980 --> 00:10:22,820
is like a bit of my thought process but

239
00:10:22,820 --> 00:10:25,680
what I'm thinking is the best is to

240
00:10:25,680 --> 00:10:27,779
notify the fact that event

241
00:10:27,779 --> 00:10:31,260
first wait for a response and fix

242
00:10:31,260 --> 00:10:32,640
and then

243
00:10:32,640 --> 00:10:35,700
it can take few weeks or months and then

244
00:10:35,700 --> 00:10:38,519
start like a submit a CV disclosed

245
00:10:38,519 --> 00:10:41,399
privately to affected users

246
00:10:41,399 --> 00:10:44,279
and at the end release the CV and let

247
00:10:44,279 --> 00:10:47,519
everybody handle that they don't know

248
00:10:47,519 --> 00:10:49,800
about it it's a good way this is a

249
00:10:49,800 --> 00:10:51,959
responsible disclosure way

250
00:10:51,959 --> 00:10:54,540
I have some problems with it because I

251
00:10:54,540 --> 00:10:57,660
wasn't attacking the vendor itself I was

252
00:10:57,660 --> 00:11:01,260
attacking a Target so now the question

253
00:11:01,260 --> 00:11:03,779
is like should I tell the target of the

254
00:11:03,779 --> 00:11:05,640
event of focus like who who should I

255
00:11:05,640 --> 00:11:08,880
tell first about this because I

256
00:11:08,880 --> 00:11:11,640
um when I'm attacking a Target I'm he is

257
00:11:11,640 --> 00:11:14,339
my customer like I'm pretty much NDA

258
00:11:14,339 --> 00:11:16,860
with him I'm hacking on his Target and

259
00:11:16,860 --> 00:11:19,560
if I find something I am obliged to tell

260
00:11:19,560 --> 00:11:20,700
him first

261
00:11:20,700 --> 00:11:24,300
so I have this vendor and the Target so

262
00:11:24,300 --> 00:11:26,160
I don't know what it does so maybe I I

263
00:11:26,160 --> 00:11:28,380
will first tell the Target and the

264
00:11:28,380 --> 00:11:30,540
vendor at the same time

265
00:11:30,540 --> 00:11:33,779
oh I'm looking at that but then I have

266
00:11:33,779 --> 00:11:36,000
other targets so I have a whole list of

267
00:11:36,000 --> 00:11:39,019
many domains and I found this like

268
00:11:39,019 --> 00:11:42,000
Elementor xss and I have now a list of

269
00:11:42,000 --> 00:11:44,160
200 targets I just searched in my

270
00:11:44,160 --> 00:11:46,800
database no I don't have a database I

271
00:11:46,800 --> 00:11:49,620
need to do one but I can search in my

272
00:11:49,620 --> 00:11:51,240
database of all the targets and see how

273
00:11:51,240 --> 00:11:54,060
I with these targets have Elementor

274
00:11:54,060 --> 00:11:56,100
let's see if they can if they are

275
00:11:56,100 --> 00:11:57,839
available to this bug and then start

276
00:11:57,839 --> 00:12:00,300
disclosing to them because I'm in all of

277
00:12:00,300 --> 00:12:02,100
these types of public and private

278
00:12:02,100 --> 00:12:04,500
programs I feel like I need to tell them

279
00:12:04,500 --> 00:12:07,500
also first because they hired me to tell

280
00:12:07,500 --> 00:12:10,920
them about this as a Bug Hunter so now

281
00:12:10,920 --> 00:12:13,680
I'm telling like a lot of customers and

282
00:12:13,680 --> 00:12:15,959
their teams and their teams are also

283
00:12:15,959 --> 00:12:18,480
doing security research by day and Bug

284
00:12:18,480 --> 00:12:20,279
Bounty by night and they can start

285
00:12:20,279 --> 00:12:23,339
taking my stuff and now it's not a

286
00:12:23,339 --> 00:12:24,860
secret anymore

287
00:12:24,860 --> 00:12:28,380
so it's uh like do I have a do I have a

288
00:12:28,380 --> 00:12:30,600
mutual ndi with them like they are not

289
00:12:30,600 --> 00:12:33,060
allowed to use my tactics I don't know

290
00:12:33,060 --> 00:12:35,519
like this is stuff that I'll

291
00:12:35,519 --> 00:12:37,920
really Advance inside bug Bounty but we

292
00:12:37,920 --> 00:12:40,620
didn't solve them properly yet

293
00:12:40,620 --> 00:12:41,399
um

294
00:12:41,399 --> 00:12:44,100
I expect the company sometimes to pay

295
00:12:44,100 --> 00:12:47,220
for me for third party disclosures now

296
00:12:47,220 --> 00:12:49,139
when I ask a lot of people and I don't

297
00:12:49,139 --> 00:12:51,480
know I can ask over here because you're

298
00:12:51,480 --> 00:12:53,760
a fun crowd who thinks you should pay

299
00:12:53,760 --> 00:12:55,260
for third party

300
00:12:55,260 --> 00:12:57,660
event disclosures if I tell you

301
00:12:57,660 --> 00:12:59,100
something you have a problem but in a

302
00:12:59,100 --> 00:13:01,079
third party who thinks I should pay for

303
00:13:01,079 --> 00:13:02,100
it

304
00:13:02,100 --> 00:13:04,680
by hand so I have like

305
00:13:04,680 --> 00:13:06,779
yeah a little like yeah Brian doesn't

306
00:13:06,779 --> 00:13:10,820
agree yeah it depends on it

307
00:13:12,420 --> 00:13:15,180
yeah so sometimes they integrate away if

308
00:13:15,180 --> 00:13:18,000
if it's like kindly knitted inside and

309
00:13:18,000 --> 00:13:19,800
it's uh

310
00:13:19,800 --> 00:13:23,040
it's uh if it's in it inside then you

311
00:13:23,040 --> 00:13:26,220
they should pay but then I we so we

312
00:13:26,220 --> 00:13:27,660
started submitting to these targets and

313
00:13:27,660 --> 00:13:30,720
targets did start to pay and this is we

314
00:13:30,720 --> 00:13:32,459
asked them I asked them afterwards why

315
00:13:32,459 --> 00:13:34,079
why are you paying for it and they're

316
00:13:34,079 --> 00:13:35,519
saying this is good threat intelligence

317
00:13:35,519 --> 00:13:38,220
for me because I'm paying for threat

318
00:13:38,220 --> 00:13:40,079
intelligence I know there's a CV there's

319
00:13:40,079 --> 00:13:42,240
a zero day but I don't want to start

320
00:13:42,240 --> 00:13:44,279
panicking like all the world will be

321
00:13:44,279 --> 00:13:46,800
when the CV will hit the fan and

322
00:13:46,800 --> 00:13:49,200
everything will be go wild so I want to

323
00:13:49,200 --> 00:13:51,240
sleep safe at night and I'm willing to

324
00:13:51,240 --> 00:13:53,660
pay for

325
00:13:53,660 --> 00:13:55,200
disclosures

326
00:13:55,200 --> 00:13:57,180
I don't know if it will be full amount

327
00:13:57,180 --> 00:14:00,060
or how much but they are willing to pay

328
00:14:00,060 --> 00:14:02,399
for it and they're willing to handle it

329
00:14:02,399 --> 00:14:05,279
properly and maybe they can add rough

330
00:14:05,279 --> 00:14:08,339
mitigations maybe they can add a fixing

331
00:14:08,339 --> 00:14:10,079
it pressure the vendor itself and

332
00:14:10,079 --> 00:14:11,579
telling them privately because they have

333
00:14:11,579 --> 00:14:14,220
a SLA with them so

334
00:14:14,220 --> 00:14:17,399
we are in a bit of a

335
00:14:17,399 --> 00:14:19,800
disagreement or agreement not all

336
00:14:19,800 --> 00:14:21,720
companies are the same and it's very

337
00:14:21,720 --> 00:14:25,019
hard to know which companies are do want

338
00:14:25,019 --> 00:14:28,200
to pay and which companies won't but you

339
00:14:28,200 --> 00:14:30,300
can submit and test it and they see and

340
00:14:30,300 --> 00:14:33,120
start learning on yourself but then I

341
00:14:33,120 --> 00:14:36,240
think they should pay just like uh I I

342
00:14:36,240 --> 00:14:39,000
believe that there is a value in telling

343
00:14:39,000 --> 00:14:41,459
someone even if that he cannot fix it

344
00:14:41,459 --> 00:14:46,279
directly but the ecosystem can be fixed

345
00:14:46,320 --> 00:14:49,320
um other questions I found is like I

346
00:14:49,320 --> 00:14:50,699
talked about it before but is it a

347
00:14:50,699 --> 00:14:53,399
secret when I'm telling someone and he

348
00:14:53,399 --> 00:14:55,740
now he tells the vendor he does his

349
00:14:55,740 --> 00:14:59,040
third party gray I.T supplier that I

350
00:14:59,040 --> 00:15:00,660
don't trust

351
00:15:00,660 --> 00:15:01,560
um

352
00:15:01,560 --> 00:15:04,260
it goes leaks out so the secret is

353
00:15:04,260 --> 00:15:06,480
harming me if I'm starting to telling

354
00:15:06,480 --> 00:15:08,940
people and this is why the best thing is

355
00:15:08,940 --> 00:15:11,820
to do it all at once like rake it up

356
00:15:11,820 --> 00:15:14,160
find all the targets and just submit it

357
00:15:14,160 --> 00:15:16,440
to everybody and make the CV as fast as

358
00:15:16,440 --> 00:15:18,660
possible sometimes it takes months and

359
00:15:18,660 --> 00:15:21,240
then we have a problem like the CV came

360
00:15:21,240 --> 00:15:23,959
after four months I was quiet about it

361
00:15:23,959 --> 00:15:27,480
because the vendor just took his time to

362
00:15:27,480 --> 00:15:29,519
notify everybody and understand and he

363
00:15:29,519 --> 00:15:31,800
didn't it's his first time he created

364
00:15:31,800 --> 00:15:35,220
like a CV by himself La CV was just like

365
00:15:35,220 --> 00:15:39,480
without them their knowledge so

366
00:15:39,480 --> 00:15:41,940
um when when this can leak then

367
00:15:41,940 --> 00:15:44,579
attackers can start using it bug hunters

368
00:15:44,579 --> 00:15:47,100
will start searching it so they are

369
00:15:47,100 --> 00:15:49,139
taking actually if I did the research

370
00:15:49,139 --> 00:15:51,180
now this research was small but if I did

371
00:15:51,180 --> 00:15:54,000
a very big research and I put lots of

372
00:15:54,000 --> 00:15:56,639
hours on it and then I it gets leaked

373
00:15:56,639 --> 00:15:58,800
and lots of people start using it and

374
00:15:58,800 --> 00:16:02,279
getting their own nuclei templates and

375
00:16:02,279 --> 00:16:05,220
uh just like scanning and finding it it

376
00:16:05,220 --> 00:16:07,560
it's stealing for me money from one

377
00:16:07,560 --> 00:16:10,320
sense of a not really stating but it's

378
00:16:10,320 --> 00:16:14,279
uh taking my profits as a Bug Hunter but

379
00:16:14,279 --> 00:16:16,019
then security teams were just like start

380
00:16:16,019 --> 00:16:18,540
running around in circles when it does

381
00:16:18,540 --> 00:16:20,639
hit the fan and everybody will like no

382
00:16:20,639 --> 00:16:23,459
log4j is coming what can we do can we

383
00:16:23,459 --> 00:16:26,040
start like mapping every single thing in

384
00:16:26,040 --> 00:16:30,060
our company in the it's a mess and we

385
00:16:30,060 --> 00:16:31,560
don't want stuff to leak

386
00:16:31,560 --> 00:16:33,360
and so I started like thinking about

387
00:16:33,360 --> 00:16:36,060
different approaches so maybe notify the

388
00:16:36,060 --> 00:16:38,399
effective vendor notify the targets

389
00:16:38,399 --> 00:16:40,620
themselves at the same time like a

390
00:16:40,620 --> 00:16:43,019
bounty hunting wait for a fix this can

391
00:16:43,019 --> 00:16:45,120
take some time and work with the vendor

392
00:16:45,120 --> 00:16:48,120
and then submit and release the CV with

393
00:16:48,120 --> 00:16:51,839
them this can be it's less

394
00:16:51,839 --> 00:16:54,779
disclosure like the previous one but

395
00:16:54,779 --> 00:16:57,899
it's still a good way I think it it's a

396
00:16:57,899 --> 00:16:59,600
beneficial for the researcher

397
00:16:59,600 --> 00:17:02,639
companies need to start paying for fair

398
00:17:02,639 --> 00:17:05,459
intelligence this is a and they are

399
00:17:05,459 --> 00:17:07,740
doing it so this is good but small con

400
00:17:07,740 --> 00:17:10,859
small companies can't do it and this is

401
00:17:10,859 --> 00:17:12,540
a big question like how can we support

402
00:17:12,540 --> 00:17:14,339
also small companies not the big ones

403
00:17:14,339 --> 00:17:16,199
the big ones that can pay for you and

404
00:17:16,199 --> 00:17:18,119
it's okay but the Smart Ones they they

405
00:17:18,119 --> 00:17:20,760
don't have the budget to do with that

406
00:17:20,760 --> 00:17:22,919
so a company without a bug Bounty

407
00:17:22,919 --> 00:17:25,319
program doesn't doesn't know about

408
00:17:25,319 --> 00:17:27,240
anything of these stuff they are going

409
00:17:27,240 --> 00:17:28,919
to talk they will they will hear about

410
00:17:28,919 --> 00:17:31,260
it from the news like when everybody

411
00:17:31,260 --> 00:17:33,720
will be hacked or some kind of Slash dot

412
00:17:33,720 --> 00:17:35,760
or whatever you are looking at whatever

413
00:17:35,760 --> 00:17:37,679
news feed

414
00:17:37,679 --> 00:17:40,679
um I also cannot scan for everything

415
00:17:40,679 --> 00:17:43,380
alone I can scan I have my own list but

416
00:17:43,380 --> 00:17:45,000
I'm not invited to all the programs

417
00:17:45,000 --> 00:17:47,340
maybe someone can invite me to all bug

418
00:17:47,340 --> 00:17:48,960
Bounty programs and then it can be nice

419
00:17:48,960 --> 00:17:51,000
but I'm not invited to everything so I

420
00:17:51,000 --> 00:17:53,340
don't know who is a who can I scan who I

421
00:17:53,340 --> 00:17:54,320
can't

422
00:17:54,320 --> 00:17:58,500
and this is uh like companies do have

423
00:17:58,500 --> 00:18:00,539
different policies of accepting fellow

424
00:18:00,539 --> 00:18:03,299
party submissions so the

425
00:18:03,299 --> 00:18:06,059
I can just go for the money this is uh

426
00:18:06,059 --> 00:18:09,120
this is usually I see some people doing

427
00:18:09,120 --> 00:18:12,240
this at the end because they don't

428
00:18:12,240 --> 00:18:14,580
they're not enough in the industry and

429
00:18:14,580 --> 00:18:18,299
they they see it as a they actually do

430
00:18:18,299 --> 00:18:21,299
bug Bounty for full time and then this

431
00:18:21,299 --> 00:18:24,120
is actually impacted their income so if

432
00:18:24,120 --> 00:18:26,760
you want to do it full time and the

433
00:18:26,760 --> 00:18:28,620
money is very important for you because

434
00:18:28,620 --> 00:18:30,660
you're doing it full time then you need

435
00:18:30,660 --> 00:18:32,580
to notify the affected targets continue

436
00:18:32,580 --> 00:18:36,260
searching targets and maybe maybe these

437
00:18:36,260 --> 00:18:38,580
companies will contact event or

438
00:18:38,580 --> 00:18:41,220
eventually and the CV will come out but

439
00:18:41,220 --> 00:18:44,700
maybe not and I think like this is a

440
00:18:44,700 --> 00:18:47,700
it's a bad idea I don't think I would do

441
00:18:47,700 --> 00:18:49,679
that but I know lots of people are doing

442
00:18:49,679 --> 00:18:51,539
it in the community there's like

443
00:18:51,539 --> 00:18:55,320
different lines of what you can do and

444
00:18:55,320 --> 00:18:57,299
I'm not judging anybody it's just like

445
00:18:57,299 --> 00:18:59,640
this is a I'm pointing out the different

446
00:18:59,640 --> 00:19:03,299
tactics background it can happen that is

447
00:19:03,299 --> 00:19:05,340
there's no one correct path there's the

448
00:19:05,340 --> 00:19:08,039
yellow brick road but that's it my path

449
00:19:08,039 --> 00:19:10,620
but

450
00:19:10,620 --> 00:19:13,200
um I started seeing different like

451
00:19:13,200 --> 00:19:16,559
Ventures into internal bug Bounty that

452
00:19:16,559 --> 00:19:18,539
the internet bug Bounty is actually a

453
00:19:18,539 --> 00:19:21,900
foundation that pays for Bound for bugs

454
00:19:21,900 --> 00:19:24,299
that you can find on the internet

455
00:19:24,299 --> 00:19:27,840
now they don't pay if I find it and if I

456
00:19:27,840 --> 00:19:30,900
get paid from a different vendor so like

457
00:19:30,900 --> 00:19:34,020
for this specific for bug I think they

458
00:19:34,020 --> 00:19:36,059
would pay I don't know something like a

459
00:19:36,059 --> 00:19:38,220
let's say the average three thousand

460
00:19:38,220 --> 00:19:39,960
four thousand dollars

461
00:19:39,960 --> 00:19:42,780
on this bug but if I go in the previous

462
00:19:42,780 --> 00:19:45,059
way just submit it to everybody I will

463
00:19:45,059 --> 00:19:47,880
get much more so it's not

464
00:19:47,880 --> 00:19:50,520
if I'm looking into the game and like uh

465
00:19:50,520 --> 00:19:54,240
what's the most effective for me

466
00:19:54,240 --> 00:19:56,220
to go to the Internet bug Bounty it's

467
00:19:56,220 --> 00:19:58,080
not that effective it's the last resort

468
00:19:58,080 --> 00:20:01,200
usually I think this should change and

469
00:20:01,200 --> 00:20:02,820
maybe they will have more budgets and

470
00:20:02,820 --> 00:20:04,980
more companies working together and

471
00:20:04,980 --> 00:20:08,820
giving better payouts for some for this

472
00:20:08,820 --> 00:20:10,799
kind of research you also have the Safe

473
00:20:10,799 --> 00:20:11,660
Harbor

474
00:20:11,660 --> 00:20:15,600
and you have disclosed IO that are

475
00:20:15,600 --> 00:20:17,640
trying to play with these areas and

476
00:20:17,640 --> 00:20:21,360
trying to look at different solutions

477
00:20:21,360 --> 00:20:24,179
um if I would look at the solutions but

478
00:20:24,179 --> 00:20:26,700
first like my adventure so I can go to

479
00:20:26,700 --> 00:20:30,179
only the vendor egg to contacting vendor

480
00:20:30,179 --> 00:20:33,299
only telling him it's his problem do

481
00:20:33,299 --> 00:20:36,059
whatever he want I can content uh in my

482
00:20:36,059 --> 00:20:38,299
Target in the window I can con contact

483
00:20:38,299 --> 00:20:41,880
multiple targets I can dump in and paste

484
00:20:41,880 --> 00:20:43,620
the bin just like see what happens I

485
00:20:43,620 --> 00:20:45,960
think it's the most funny thing I won't

486
00:20:45,960 --> 00:20:49,020
do it but I don't know hey this is maybe

487
00:20:49,020 --> 00:20:51,120
one day when I will be like 90 years old

488
00:20:51,120 --> 00:20:52,860
just like dump it in placement and see

489
00:20:52,860 --> 00:20:56,039
what happens uh I this will be my CVS

490
00:20:56,039 --> 00:20:56,840
assistant

491
00:20:56,840 --> 00:20:59,400
but for like the future and what I want

492
00:20:59,400 --> 00:21:01,200
like to look into and this is a big

493
00:21:01,200 --> 00:21:04,080
discussion that I would want to be proud

494
00:21:04,080 --> 00:21:05,940
of and understand is like

495
00:21:05,940 --> 00:21:08,940
program

496
00:21:09,419 --> 00:21:13,260
if I can create a CV and know that this

497
00:21:13,260 --> 00:21:15,720
CV is like a part of my research and

498
00:21:15,720 --> 00:21:18,960
everybody that uses my CV will give me

499
00:21:18,960 --> 00:21:20,820
like one percent

500
00:21:20,820 --> 00:21:23,039
of the bounty this can be cool for me I

501
00:21:23,039 --> 00:21:25,440
can I can live with that this is like a

502
00:21:25,440 --> 00:21:28,679
longer living like Revenue if it will be

503
00:21:28,679 --> 00:21:31,740
good then it will be good for us also I

504
00:21:31,740 --> 00:21:33,419
entered work Bounty for third parties

505
00:21:33,419 --> 00:21:35,400
what happens when I find a full party

506
00:21:35,400 --> 00:21:38,039
can I go to the Internet bug Bounty and

507
00:21:38,039 --> 00:21:39,900
tell them and

508
00:21:39,900 --> 00:21:42,720
maybe we need to like us uh kind of

509
00:21:42,720 --> 00:21:45,360
budget for this area

510
00:21:45,360 --> 00:21:47,100
I was talking also about Mutual

511
00:21:47,100 --> 00:21:48,840
disclosure agreements this is important

512
00:21:48,840 --> 00:21:53,220
because I when I submit a bug I'm NDA to

513
00:21:53,220 --> 00:21:56,460
them they're not ndi to me oh I don't

514
00:21:56,460 --> 00:21:58,740
know how much they are ndi to me when

515
00:21:58,740 --> 00:22:01,620
I'm telling them about this bug and this

516
00:22:01,620 --> 00:22:03,600
is a part of a when you go full bug

517
00:22:03,600 --> 00:22:04,860
Bounty it's

518
00:22:04,860 --> 00:22:06,419
it's a problem and you need to

519
00:22:06,419 --> 00:22:09,179
understand like the consequences of we

520
00:22:09,179 --> 00:22:11,820
had in hacker one I think a problem that

521
00:22:11,820 --> 00:22:14,400
one of the employees started using

522
00:22:14,400 --> 00:22:17,159
tactics and we have other areas that you

523
00:22:17,159 --> 00:22:19,679
can see when people start submitting new

524
00:22:19,679 --> 00:22:22,140
tactics then you see everybody following

525
00:22:22,140 --> 00:22:24,360
them and it's good it's good for our

526
00:22:24,360 --> 00:22:26,700
industry it's good for everybody to

527
00:22:26,700 --> 00:22:28,260
share as much as knowledge but we need

528
00:22:28,260 --> 00:22:31,620
to have a way how to create it in uh

529
00:22:31,620 --> 00:22:34,620
efficient way and a standardized way so

530
00:22:34,620 --> 00:22:37,320
we won't harm ourselves in this process

531
00:22:37,320 --> 00:22:39,600
so I don't have all the answers

532
00:22:39,600 --> 00:22:43,140
and I have lots of questions and this is

533
00:22:43,140 --> 00:22:45,539
the moment you can ask me anything you

534
00:22:45,539 --> 00:22:46,380
want

535
00:22:46,380 --> 00:22:49,320
whatever you want like I don't know

536
00:22:49,320 --> 00:22:52,460
if you have any questions

537
00:22:54,900 --> 00:22:57,960
Brian you you have a question

538
00:22:57,960 --> 00:23:00,500
no

539
00:23:02,280 --> 00:23:04,080
there's a microphone so everybody can

540
00:23:04,080 --> 00:23:07,039
hear yeah

541
00:23:07,440 --> 00:23:09,120
you're gonna find the bug and you send

542
00:23:09,120 --> 00:23:11,580
it out to all of the integrator or the

543
00:23:11,580 --> 00:23:13,559
the supply chain you send it out to all

544
00:23:13,559 --> 00:23:16,080
the affected websites each one's paying

545
00:23:16,080 --> 00:23:18,360
you know across the board

546
00:23:18,360 --> 00:23:22,020
But ultimately it the fix of the code is

547
00:23:22,020 --> 00:23:24,480
is that that Supply the Elementor you

548
00:23:24,480 --> 00:23:27,780
know so yeah if they just paid what

549
00:23:27,780 --> 00:23:30,720
maybe it's worth is it then the same

550
00:23:30,720 --> 00:23:32,520
problem to go to everyone else to get

551
00:23:32,520 --> 00:23:34,320
maybe the smaller amounts of money from

552
00:23:34,320 --> 00:23:36,000
who's it's affecting but

553
00:23:36,000 --> 00:23:38,580
but if the you know Elementary is paying

554
00:23:38,580 --> 00:23:40,260
out a large sum you don't have to go

555
00:23:40,260 --> 00:23:41,820
through all that work and then you just

556
00:23:41,820 --> 00:23:43,260
move on to the next thing maybe I don't

557
00:23:43,260 --> 00:23:45,120
know yeah what are your thoughts yeah I

558
00:23:45,120 --> 00:23:47,400
think like it's a good solution but

559
00:23:47,400 --> 00:23:50,700
because we have lots of startups and

560
00:23:50,700 --> 00:23:52,500
lots of companies that don't have these

561
00:23:52,500 --> 00:23:54,299
budgets in bug bounty

562
00:23:54,299 --> 00:23:57,600
like Elemento doesn't have the budget of

563
00:23:57,600 --> 00:24:01,380
a big function 500 companies so we got

564
00:24:01,380 --> 00:24:03,360
paid more

565
00:24:03,360 --> 00:24:06,480
like specifically in bounties or in one

566
00:24:06,480 --> 00:24:08,760
bounty we got paid more bounty in other

567
00:24:08,760 --> 00:24:10,980
targets than the element of one I'm not

568
00:24:10,980 --> 00:24:12,179
saying something bad about the element

569
00:24:12,179 --> 00:24:14,159
of like bug Bounty it's great that you

570
00:24:14,159 --> 00:24:16,620
have it but it's

571
00:24:16,620 --> 00:24:19,640
you can't expect everybody to pay for

572
00:24:19,640 --> 00:24:22,200
the same because they have different

573
00:24:22,200 --> 00:24:24,900
budgets and different use cases

574
00:24:24,900 --> 00:24:27,419
so yeah

575
00:24:27,419 --> 00:24:31,320
yes okay so I have a question you uh you

576
00:24:31,320 --> 00:24:33,900
mentioned that you can I speak closer

577
00:24:33,900 --> 00:24:36,059
yeah okay so you mentioned that you

578
00:24:36,059 --> 00:24:38,340
almost scan like the whole internet to

579
00:24:38,340 --> 00:24:40,260
see like how many websites like were

580
00:24:40,260 --> 00:24:42,000
affected by the

581
00:24:42,000 --> 00:24:44,760
so which tool exactly did you use

582
00:24:44,760 --> 00:24:49,760
so we went with two tactics first of all

583
00:24:49,760 --> 00:24:54,179
a girl has like lists in ugly as a he's

584
00:24:54,179 --> 00:24:56,159
doing bug Bounty and Recon a lot so he

585
00:24:56,159 --> 00:24:59,400
has list of lots of domains that have a

586
00:24:59,400 --> 00:25:02,760
bug Bounty programs and we scan them but

587
00:25:02,760 --> 00:25:06,000
also I want to build with and bought a

588
00:25:06,000 --> 00:25:10,200
list for 100 and like it paid off just

589
00:25:10,200 --> 00:25:13,020
like you can get a list of everything so

590
00:25:13,020 --> 00:25:15,059
it was just like a like a big list of

591
00:25:15,059 --> 00:25:17,159
websites random you can get a built with

592
00:25:17,159 --> 00:25:20,039
like you say you can select a technology

593
00:25:20,039 --> 00:25:22,620
and just down by the whole list of all

594
00:25:22,620 --> 00:25:25,320
the domains that they have and then the

595
00:25:25,320 --> 00:25:28,320
game is to start trying to test which

596
00:25:28,320 --> 00:25:30,059
has a bug Bounty program which doesn't

597
00:25:30,059 --> 00:25:32,340
this is the hard part there's no

598
00:25:32,340 --> 00:25:34,260
standardized way to do it there's like

599
00:25:34,260 --> 00:25:36,419
other private programs but uh and

600
00:25:36,419 --> 00:25:38,039
matching and you don't know usually

601
00:25:38,039 --> 00:25:40,620
which company is behind the domain but

602
00:25:40,620 --> 00:25:43,140
this is the worst this took us the most

603
00:25:43,140 --> 00:25:45,960
time the research was like actually took

604
00:25:45,960 --> 00:25:48,360
us a few hours but then finding out who

605
00:25:48,360 --> 00:25:51,179
is vulnerable and can we submit to them

606
00:25:51,179 --> 00:25:54,779
do they have a VDP uh vlp do they have a

607
00:25:54,779 --> 00:25:57,840
bug Bounty program what kind where uh

608
00:25:57,840 --> 00:26:00,600
then like talking about dupes and

609
00:26:00,600 --> 00:26:02,940
communicating with the teams this is the

610
00:26:02,940 --> 00:26:04,080
most time

611
00:26:04,080 --> 00:26:06,020
that

612
00:26:06,020 --> 00:26:10,520
we we took our effort on

613
00:26:11,520 --> 00:26:13,860
any more questions

614
00:26:13,860 --> 00:26:16,890
that's it so thank you very much

615
00:26:16,890 --> 00:26:21,949
[Applause]

616
00:26:22,130 --> 00:26:25,189
[Music]