April 2024 Summaries

The topic of election cybersecurity has gained renewed attention in recent years due to a deepening distrust in election integrity in North America. Despite significant investment and progress in securing election systems, vulnerabilities and hacking concerns continue to be a pressing issue. The author has been working with the Bugcrowd team to build bridges between security researchers and voting technology providers, aiming to expose critical vulnerabilities before threat actors can exploit them. A recent pilot event, the Election Security Research Forum (ESRF), marked a significant milestone in this effort, demonstrating the feasibility of collaboration between hackers and election technology providers under principles of Coordinated Vulnerability Disclosure (CVD). The ESRF fostered increased trust and collaboration between these groups, laying the groundwork for future engagements and modernizing the certification process for election technology.

At the end of 2022, OpenAI released ChatGPT to the public, changing the world with its accessibility to powerful Generative AI tooling. The GenAI race has renewed public fear around AI, prompting calls for regulation to prevent misuse and ensure safety and security. However, regulating something new and not fully developed poses challenges. There is a need for "do no harm" guidelines to prevent predatory uses of AI, such as phone scams and deepfakes, while also considering the potential for governmental abuse of power. Accountability and transparency are crucial in building trust in AI systems, including mandating explanations of AI decisions and disclosing underlying algorithms. Data privacy is essential, with clear guidelines on the use of personal data for training AI models. Safety and security concerns arise from AI's potential to introduce new vulnerabilities, particularly in critical services like healthcare and government. The landscape of regulation today includes efforts by governments and tech companies to create standards and guidelines for AI development and deployment. Despite the need for regulation, there are potential pitfalls, such as stifling innovation and creating unintended consequences. A nuanced approach that balances regulation with innovation is necessary, and collaboration between governments, companies, and the public is essential in creating a future with transparent, ethical, and helpful AI.

You have been pwned

The crowdsourced security market is evolving to stay ahead of new challenges and attack surfaces, offering organizations a proactive solution to tackle their cybersecurity challenges. The Bugcrowd Platform combines human ingenuity and AI-powered technology to provide a modern approach to crowdsourced security that works proactively. Its SaaS platform built for multiple use cases enables organizations to tackle various cybersecurity challenges simultaneously. Crowd management is another key aspect, with proprietary technologies like CrowdMatch AI that source and activate the right hackers for the job, boosting engagement and critical findings by 102%. Engineered triage at scale provides rapid intake, validation, and prioritization of vulnerabilities, even during global incidents. Security program management offers flexibility, reduced administration time, and richer reporting, while customer success and satisfaction are top priorities, with a focus on long-term partnerships and personalized support.

The Total Economic Impact (TEI) study commissioned by Bugcrowd in April 2024 examines the potential return on investment (ROI) of deploying Managed Bug Bounty. The study provides organizations a framework to evaluate the financial impact of Bugcrowd's Managed Bug Bounty, highlighting benefits such as a 268% ROI and $1.43M net present value over three years, improved security operations efficiency, reduced risk of material breaches, and lower cybersecurity insurance premium costs. Additionally, the study found unquantified benefits including shorter time to remediation, improved relationships between developers and security teams, improved reputation, and effective vendor support. The results are based on a composite organization's experiences, gathered through interviews with four representatives and surveys of 39 decision-makers.

The Bugcrowd Platform has introduced AI Bias Assessments, a new offering to help enterprises and government agencies adopt Large Language Model (LLM) applications safely and productively. This service uses private engagements on the platform to activate trusted hackers to identify data bias flaws in LLM applications, with rewards for successful demonstrations of impact. The assessment is applicable across various industries, but particularly important in the public sector due to the US Government's mandate for AI safety guidelines, including data bias detection by March 2024. Data bias can occur in LLM applications due to stereotypes, misrepresentations, and prejudices in training data, leading to unintended behavior that can add risk and unpredictability to adoption. The Bugcrowd Platform's AI Bias Assessments use a reward-for-results approach with validated triage and prioritization by the platform's engineered service, offering clearer line of sight to ROI for customers like Tesla, T-Mobile, and CISA. This service has been successful in uncovering high-impact vulnerabilities, including those for LLaMA, Bloom, and private models, and is being leveraged by government agencies such as the US Department of Defense's Chief Digital and AI Office (CDAO) to define and manage AI Bias Bounty programs.

Penetration testing is a decades-old technique that has evolved over time, from its origins in the 1960s as a response to concerns about data interception on emerging computer networks, to its current status as a regulated industry with mandatory requirements for certification and compliance. The practice of employing ethical hackers to identify vulnerabilities in cyber defenses has remained fundamentally the same, but the way testing is done and the environment in which it takes place have changed significantly. Regulatory schemes and government approvals are now necessary for pentesting service providers, offering essential assurance to customers that the services they're paying for are both ethical and reliable. To address the growing complexity of cybersecurity challenges, Bugcrowd has introduced enhancements to its Penetration Testing as a Service (PTaaS) in Singapore, providing a crowdsourced solution with reduced management overhead for pen tests, cutting configuration time from days to hours.

The Vulnerability Rating Taxonomy (VRT) has been updated to include new vulnerabilities in the "Insecure OS/Firmware" category, a new category for "Physical Security issues", and several other modifications. The updates focus on hardware vulnerabilities, including weaknesses in firmware updates, poorly configured disk encryption, and recovery of sensitive material from storage media. These additions are designed to help hackers hunt for specific vulnerabilities and create targeted Proof of Concepts (POCs), as well as assist users in designing scope and rewards that create the best outcomes. The VRT is a key component of Bugcrowd's platform, enabling customers like Dell, Xfinity, and iRobot to collaborate with hackers to secure their attack surface spanning hardware, firmware, and software.

Bugcrowd has introduced a new approach to organizing, managing, and participating in security programs called Bugcrowd Security Program Management. This new method addresses several long-standing issues with traditional programs, including program sprawl, inflexibility, and data isolation. With this new feature, customers can manage multiple types of programs and engagements more easily, reducing overhead and complexity. The platform also provides a richer, more customizable brief for hackers, making it easier to understand scope and targets, stickier participation, and better results. Additionally, Bugcrowd Security Program Management offers a clearer view of program maturity and ROI over time, allowing customers to make data-driven decisions. This new feature is available to all hackers and new customers, with phased rollout for existing customers.

The rapid evolution of AI technology poses significant security risks, including deepfakes and AI-powered phishing attacks, which can be difficult to detect and defend against. As AI becomes increasingly integrated into various systems, its potential vulnerabilities are expanding, making it crucial for organizations to develop a comprehensive AI security strategy. Current vulnerabilities include prompt injection, data biases, and zero-day attacks, and mitigations such as robust system prompts, internal testing, crowdsourced testing, and continuous vulnerability assessment are essential to protect against these risks. The growing use of open-source models also introduces new risks, including the potential for threat actors to exploit them. Governments around the world are starting to regulate AI development and deployment, with regulations such as the EU's AI Act and the US Executive Order 14110 aiming to ensure safe model development and rollout. To get started with AI security, organizations should identify current risks, set up initial defenses, and consider long-term robust defenses through red teaming, crowdsourced security, and continuous vulnerability assessment.

Bugcrowd's Code of Conduct aims to guide hackers towards ethical behavior, building trust, and contributing to a harmonious community. The platform has outlined its Platform Behavior Standards to help hackers understand unacceptable issues and behaviors, including measures taken for enforcement. Disruptive testing involves simulating real-world scenarios to identify vulnerabilities, while disruptive/aggressive behavior includes actions that cause harm or disrupt the program owner's environment. Disclosure threats involve threatening to disclose sensitive information unless demands are met, and unauthorized disclosure involves releasing confidential data without permission. Hacking with Bugcrowd is a safe experience when operating within the ethical framework designed to protect everyone involved.