Bug bounty horror stories

Transcript

okay so um I thought it would be fun to uh talk about some Buck Bounty horror stories because usually what you see on Twitter is GNA be like your stories about hey I M made a million bucks holy this Buck buuny thing is really cool uh but something uh you hear less about is all the cases where it goes wrong although a lot of examples that I have today are actually uh probably going to be somewhat familiar uh so there's going to be some spooky stories let me and it doesn't work okay so this is the first one it's a nice old one this is not the way you do a bug report

um so this is the fa wallet uh someone uh was able to take over ownership and delete the contract self-destructed uh uh and uh they actually did so on mainnet and then reported the bug through a GitHub issue uh I forget how many millions were locked because of this uh but yeah this kind of it's kind of scary if you wake up see a getup issue hey I accidentally break your system um for the rest of the stories I'm going to try to not call anybody out for multiple reasons in some cases like it's hard to know know the full story uh and also like some of the ones are probably

in the room so you know uh not to make it too spicy um it everything should kind of be prefixed with this back B bug bounties are great but you know um things happen uh let's go to the next one uh oh okay so this one happened not too long ago it's kind of buggy let me just move here this one happened not too long ago uh kind of large exchange uh Kraken you might know it um there's a security company that found a bug and to test the bug they stole I think more

than $3 million and reported it only uh a couple days weeks after I'm not sure about the details there but uh yeah that's got to be scary too cuz as a as a uh exchange operator suddenly a bunch of money is gone and you don't know if it's like real hackers or not uh so this is kind of like a a Lessons Learned for uh White hats maybe don't just steal money and maybe you should report the bug first another horror story this is around a year ago uh protocol uh was uh hacked 55 million was

gone it's actually in November if anybody can guess which one it was no okay it was skyers swop and this is one of the most hilarious like whad negotiations in my opinion uh because the guy had well like first was like okay I'm tired my demands will come tomorrow uh so I hope he slept well and then uh the day after uh they got these demands and he basically wanted the whole company um I don't believe they complied but yeah so I'm not sure if there's a Lessons Learned here but yeah I thought it was a fun horror story

because that's kind of crazy like you get hacked the hacker responds there sometimes these negotiations actually work but then yeah you get this U demand um this is a actually a super interesting story I think um it's a story I think happened one and a half years ago uh uh someone found a bug in uh that was out of scope for a major protocol that's operated by a DA uh and their Buck Bounty I believe was managed by uh like this this separate company they because it was out of scope they weren't able to uh like spend too much money on this bounty so they agreed

with the white hat that the whad would suggest like an extra payout on the Dows Forum uh when it was proposed to pay out the base Bounty now this didn't go too well um and it's kind of a signal that buck Bounties in Dows are kind of difficult to do so Buck Bounty discussions can be hard regardless of whether it's in a DA or not but if a dow gets involved it's and it ends up even harder so in this case the Dow participants didn't have any information about the bug at all and the conversation kind of went into a

direction where there was name calling like the the the Bounty Hunter was called greedy uh and eventually some people even suggested like lowering the Bounty that was already agreed to um and I feel like the main like takeaway here is that is two things like make sure everything is set up well before someone reports a bounty so that you don't need to fall back on this kind of system where someone has to go to your forums where it's super difficult to agree on anything and the second thing is communicating with white hands is a PR problem like you need to be aware of your image around this because yeah

derailing discussions on the public forum doesn't look good um okay so this one is even uh a little bit older um it was this white head found a bug reported it but the protocol didn't really respond within uh a day I believe so they were like ah I really got to get this money save and they tried a whad hack now we all know this that this can go really well but in this case it went wrong cuz they were F uh and uh some money was lost uh and I think here it's really important if you

want to be doing or execute a white attack it's really important to be aligned with the team somehow so either you've communicated with them or in the best case scenario it's them executing the white attack not you you just helping uh and you kind of only do this in the last case scenario uh or um for example the situations covered by the what at Safe Harbor agreement okay and this is another fun one that came up this year this is Bounty platform um that uh was blockchain enabled and uh let me see

uh they put the titles of vulnerability reports in their severity on chain um which is not great cuz that kind of reveals a lot of information about vulnerabilities in systems that have a lot of impact um as learned don't do this um Beyond these I wanted to point out that there is a lot of untold stories uh for both sides of the equations for bounty hunters and projects so what H bounty hunters encounter a lot of the time is unnecessarily unnecessary delays because protocols might not care too much about

paying out when they already fixed the bug you also have the the fix and ghost happens a lot fortunately platforms like immuni can take action like uh kicking people off a platform uh but yeah it doesn't always work and my my favorite one this happened to me once is um the security budget was tied so they didn't have money to pay out the book Bounty uh great reason uh this is an example just I picked it from Twitter from a couple like last week uh where someone uh like reported B and then like a week after you go hey guys have you had a time to look at this and then okay we had time

to look at it and then it just takes long um a lot of a time uh convers firstly there's also lots of problems for protocols that you're probably not aware of uh there's like this fire hose of people that just want to make money uh by doing little work so there's this thing called back bounties it's kind of insane people just report seemingly random things hey you're not following the best practice and then saying can I please as the money um and as a protocol like you have to deal with this in it's such a Time sync and of course like the llm revolution uh people

uh and the problem here is llms can make really good sounding reports that are actually bogus in the end so it's like there's a lot of time drain from the project perspective and unfortunately in the communications between legitimate bounty hunters and projects it can sometimes lead to some friction because the pro like protocols can be so used to grifters that they kind of go into this the conversation in a semi adversarial manner or expecting the the white head to be somewhat adversarial um and this is kind of unfortunate of course like uh people get banned if they do back bounties or if

they use uh llms but it's also something to be aware of like it's good to know from both sides um that everybody's kind of used to people uh doing things and and making the process that much harder that we can all like maybe be nice to each other uh anyways uh I I kind of like Buck bound still even though all these things happen uh so I wanted to end with the statement that bug mounties are great um that's it for me uh is the next verion okay uh let me quickly see uh oh thank you