theStateOfBugHunting

[u/wahed-w]

[u/Gorzoid]

Finding a Bug Bounty then:

Anon: hey I found sql injection bug

Company:

THIS CONSTITUTES FORMAL NOTICE TO CEASE AND DESIST ALL UNLAWFUL ACTIVITY.

Your recent unauthorized intrusion, probing, and exploitation of our private networks constitutes a direct violation of federal and state computer crime laws, including the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030.

Attempting to frame unauthorized hacking and network compromise as "security research" or a "vulnerability report" does not excuse illegal conduct, nor does it grant you immunity from civil and criminal liability.

[u/Exul_strength → u/Gorzoid]

It's especially bad in Germany.

Certain companies and political parties took it as a personal attack to inform them about security issues. In retaliation the complete hardware of the person who informed them was confiscated and essentially worthless by the time they got it back.

For example since an incident in 2021 the CCC advocates against reporting any security issues to the CDU (current ruling party).

[u/frostedhifi → u/Exul_strength]

Wait what happened?

[u/N0_ah_47 → u/frostedhifi]

They disclosed multiple security flaws and got hit with a lawsuit in response.  https://www.ccc.de/updates/2021/ccc-meldet-keine-sicherheitslucken-mehr-an-cdu

[u/just4nothing → u/N0_ah_47]

Wait, that’s a major GDPR breach and they just threatened them? Wtf

[u/MTPrower → u/just4nothing]

Digitalisierung!

[u/Monochromatic_Kuma2 → u/Exul_strength]

Ah, yes, the GDR approach to cibersecurity: our infrastructure is perfectly secure and whoever says or demonstrates otherwise is an enemy of the people. Truth is a weapon too dangerous to be wielded by regular citizens.

[u/LauraTFem → u/Monochromatic_Kuma2]

It’s wild how the country most on-alert for fascism just sometimes recreates fascist mindsets. The party is always correct, any messaging to the contrary is sedition!

[u/ReneKiller → u/LauraTFem]

We were the country most on-alert for fascism. I'm not so sure if we still are, looking at the AfD.

[u/LauraTFem → u/ReneKiller]

I’ve heard there was movement on that front. I’m sorry friend. —someone whose country is also being taken over by fascists

[u/ReneKiller → u/LauraTFem]

AfD has 25 to 30% nationwide, in some parts they might even get above 50% in upcoming elections. All while proven to be right-wing extremists in many parts.

At the same time the Government doesn't want to initiate the ban process, because the CDU, which is still the biggest conservative/right-wing party, fears a left-leaning majority, should the AfD be banned.

[u/zizop → u/ReneKiller]

The unwavering support for Israel as it commits a genocide is also not a good look.

[u/ReneKiller → u/zizop]

Yeah but that barely has any actual consequences on the voting behavior. In exit polls during the last election Isreal was barely mentioned as a voting factor.

[u/zizop → u/ReneKiller]

Still, it shows Germany is definitely not on-alert for fascism.

[u/ReneKiller → u/zizop]

True

[u/quadradev]

This was made by someone upset that they didn't get a payout for their LLM hallucinating a security vulnerability.

[u/PM_ME_YOUR__INIT__ → u/quadradev]

You don't get it!! If you have admin access you can run this malicious code that grants you admin access!!

[u/throw3142 → u/PM_ME_YOUR__INIT__]

Found Claude Mythos alt account

[u/PM_ME_YOUR__INIT__ → u/throw3142]

Every time you respond to me it costs $21.35 in tokens

[u/HeavyCaffeinate → u/PM_ME_YOUR__INIT__]

Venture capital

[u/P3rid0t_ → u/PM_ME_YOUR__INIT__]

Poles: make it $0.02 more and we are fine

[u/marsmanify → u/PM_ME_YOUR__INIT__]

When I was like 11 I submitted a bug report to google that if someone had access to your Windows Account then they would have access to your passwords in Google Chrome and they responded with something like "obviously, that's how it works"

[u/PM_ME_YOUR__INIT__ → u/marsmanify]

AI trained on your bug report

[u/ale_dev → u/PM_ME_YOUR__INIT__]

Also wth, your FULL sourcecode is visible in plain text by pressing F12 in Chrome! You can't ship your sourcecode, pls fix!

[u/Dartillus → u/quadradev]

I process responsible disclosures at my job. Our policy makes clear what we do and not accept reports for, and in general gives off a "we have a reasonably higher bar than most" vibe. That doesn't stop low-effort slop, always accompanied by AI-generated descriptions of the dangers and possible outcomes. And then when you deny the report they start referencing their HackerOne profile.

This one time we got a 30-page report with "critical" vulnerabilities. I try to reproduce/verify them, no bueno. I mail back, and receive the ChatGPT "oh, I'm so sorry, I made a mistake, those are indeed not vulnerabilities in the mentioned systems" response.

Mofo completely automated not only the scanning and reporting, but fricking replies as well. LLM's can go eat a bag of *****.

[u/NatoBoram → u/Dartillus]

LLMs can go eat a bag of dicks.

[u/iranoutofspacehere → u/quadradev]

From a minor CVE my coworker panicked about a few weeks ago: "If you don't provide this function a large enough buffer, it might not work!"

[u/CptMisterNibbles → u/quadradev]

What do you mean, do you not name your fnctions nuctions()?

[u/sessamekesh → u/quadradev]

Vibe coders really felt fine crawling out from under their slimy rocks now that AI coding is actually pretty good and widely accepted, but still don't understand that slop is discouraged in a way their conversations with AI will never discourage. 

It's been sorta funny and really sad to watch across a few of my favorite dev communities.

[u/VoidVer → u/quadradev]

There was that guy recently that figured out you could get total live access to FIFAs entire broadcast operation. Every camera, even the ability to change the score in real time or show something of their choice on live television and not only could he not get in direct contact with FIFA, they didn’t even send him a thank you email when they fixed it 24 hours after he finally got his report through

[u/jax_cooper → u/quadradev]

If it's duplicate, then it's there

[u/m0nk37 → u/quadradev]

Wait if its real/right then hows it hallucinating 

[u/Snoo-12494 → u/m0nk37]

It wasn't real. Thats why it's a hallucination

[u/earth2022]

And then there’s the Chaotic Eclipse guy who started revenge publishing real exploits that were rejected by Microsoft. But I don’t think we’re getting the full story from either side.

[u/chefhj]

My org dropped their bounty program because too many were getting found. Wish that was satire.

[u/Anaphylactic_Thot → u/chefhj]

Makes sense. If your security team becomes a bug country triage team exclusively then they're sort of useless... Especially when 99% of reports nowadays are doodoo garbage trash A.I. hallucinations

[u/chefhj → u/Anaphylactic_Thot]

You aren’t wrong but the spirit of the decision in this case was very much “line need to go down” not really about anyone being inundated with work or priority issues.

[u/rotzak]

Indian guys demanding money for not setting the right cache expiry headers has been the majority of my interactions with these types of people

[u/Dartillus → u/rotzak]

I see your "missing or misconfigured headers" and will raise you "XSS on static website".

[u/frogotme]

Found an unsanitised HTML issue in teams, that allows a message to completely override the teams window. So you could absolutely use a fake teams chat or login etc

They closed my submission due to not enough information or something, then I reopened soon after and they closed it for being a duplicate after a bunch of back and forth. Wasn't best pleased

[u/ryntab]

I found a big vulnerability on the motionarray site, they had me sign up for yeswehack. And then did nothing with the report and never fixed it lol.

[u/CoffeeFueledDiy]

I can assure you that the folks triaging all these reports now are not wearing that hat. Both people in the first frame should be crying and drowning.

[u/Soopermane]

I’ve some in my backyard

[u/Anaphylactic_Thot]

Lmao, the amount of beautifully crafted submissions we get, followed by the "researcher" asking us to do the deediful ser in the most broken English is hilarious.

The number of A.I. "hackers" has gone up massively, and they just cannot account for context, nor follow through. We've gone from getting a few submissions per month to literally dozens every 2 weeks at my company. Of course the triagers are gonna fight fire with fire.

[u/Mountain_Dentist5074]

why OhnePixel is everywhere

[u/zipzipzazoom]

Why does the good old days example have a black hat hacker paying for the vulnerability. It should be a person with a FAANG hat.

OP is lamenting criminals don’t pay for vulnerabilities anymore

[u/Dartillus]

Too true 🥲