December 2024 Summaries

As we approach the end of 2024, leaders in the cybersecurity industry are looking ahead to 2025 and sharing their predictions. The year is expected to see a continued focus on hardware and IoT security as vulnerabilities and exploits on perimeter devices continue to be a major concern. Additionally, AI is predicted to play a significant role in 2025, with its use cases evolving from hype to real-world applications that will address AI as both a tool, target, and threat. Third-party and supply chain risk are also expected to rise in prominence, with vulnerabilities within the supply chain having a ripple effect on businesses. Furthermore, red teaming is anticipated to become increasingly important for continuous exposure management and providing real-time feedback to organizations on evolving threat actor tactics, techniques, and procedures.

Gapsville is a town plagued by a severe cybersecurity skills gap, which has led to widespread talent shortages and limitations in security solutions. The town's mayor encourages visitors to experience their way of life, but the issue at hand is not one of advice or solutions, but rather a fundamental reality that must be accepted. However, a group of rogue residents, known as The Debunk Diaries, are questioning this narrative, suggesting that the cybersecurity talent gap may be overstated and that access to skilled professionals is just an issue of finding them.

Hackers around the world have shared their unique and functional "battlestations" to celebrate the holiday season, showcasing their personal setups for hunting bugs. These battlestations range from office spaces to remote hacking views, with various features such as custom keyboard colors, giant screens, laptops stickers, puppy pictures, and even a Bugcrowd keyboard. The submissions highlight the creativity and individuality of hackers, with some sharing their favorite swag items like laptop stickers or neon signs. The holiday countdown has been a fun way for hackers to share their setups and connect with each other, and it's clear that many are excited to see what 2025 brings in terms of battlestation upgrades.

Ninad Mishra is a full-time hacker who has developed a unique perspective on ethical hacking and device exploration through persistent knowledge pursuit and navigation of challenges. He began his relationship with technology early, showing curiosity about how things work, and eventually started learning and trying out different things, including hacking forums. Despite facing skepticism from family members, he pursued his passion for cybersecurity and hacking, initially learning web development while maintaining interest in hacking. Ninad now specializes in network security and web application testing, working full-time as a hacker and senior security consultant for Bugcrowd, and has gained recognition through professional achievements such as finding zero-days on Oracle services and reporting vulnerabilities to the Indian government. He is also exploring areas beyond web applications, including hardware hacking and artificial intelligence, and aims to expand his skill set and continue learning with goals including learning about Web3, hardware hacking, and AI.

Generative AI is revolutionizing the way cybercrime gangs operate by amplifying their ability to scale and target attacks, making traditional methods seem outdated in comparison. Cybercrime gangs are leveraging generative AI to gather information on targets through reconnaissance, generate personalized content for social engineering attacks, create sophisticated malware, and develop exploits. The use of deepfakes, voice cloning, and phishing attacks is becoming increasingly common, posing significant challenges for enterprises to defend against these threats. To combat this, a layered defensive approach that incorporates multiple controls and verification methods across technological, procedural, and human factors is essential, with the adoption of the NIST framework being a minimum requirement. Additionally, incorporating crowdsourced security solutions offers an additional game-changing advantage in staying ahead of sophisticated threats.

Ax Framework is a solution for creating and managing botnets, allowing users to centrally create and manage 100+ cloud devices in minutes, distribute workloads among them, and receive rapid, reliable results. The framework provides a convenient way to automate tasks on remote machines, reducing the time spent on manual configuration and management. It includes over 100 built-in modules for security tools that can be executed across instances in parallel, as well as support for creating custom modules. Users can create fleets of instances, manage multiple instances, and use Ax scan to utilize modules to assign equal portions of workload among them. With Ax Framework, users can work smarter, not harder, by eliminating time-wasting tasks and focusing on finding bugs.

The Cybersecurity and Infrastructure Security Agency (CISA) has partnered with Bugcrowd and EnDyna to operate a Vulnerability Disclosure Program (VDP) Platform, which helps Federal Civilian Executive Branch (FCEB) agencies identify and address security vulnerabilities in their infrastructure. The platform's usage grew dramatically in 2023, with over 7,000 vulnerabilities reported across 50+ federal agencies—a 132% increase from 2022. CISA released an annual report analyzing trends and impact across participating agencies. Key takeaways include expanded platform adoption, increased vulnerability detection, accelerated remediation efforts, demonstrated cost savings, growing global research community, and elevating security maturity. The VDP Platform's success shows the potential of crowdsourced security initiatives in strengthening federal cybersecurity.

In this write-up, the author shares two account takeover vulnerabilities they presented during Bug Bounty Argentina Village at Ekoparty 2024. The first vulnerability involves manipulating a 16-digit code for non-brute force account takeovers using OAuth and Facebook registration on www.vulnerable.com. The author discovered that the authentication method only required a valid oauthId, which led to potential brute force attacks. They later found an XSS vulnerability and used it to obtain the FB token but not the userID. The second vulnerability involves exploiting a password update endpoint using UUIDs assigned to users in different workspaces. The author discovered that by inviting a victim's email address to their workspace, they could obtain the victim's UUID and use it to change the victim's password after locking their account with six failed login attempts. This allowed the attacker to take over the victim's account. The author thanks Bugcrowd for supporting them and sponsoring their talk and acknowledges Link Clark for valuing their input.