February 2025 Summaries

The shipping industry is increasingly vulnerable to cyber threats, including ransomware attacks, GPS spoofing, and supply chain disruptions. The intersection of IT and operational technology (OT) in modern shipping makes it a lucrative target for cybercriminals and state-sponsored actors. Key vulnerabilities exist in e-navigation systems, industrial control systems, and port management platforms, which can lead to navigation issues, operational downtime, and even environmental disasters. The shift towards digital-first shipping operations has introduced significant cybersecurity risks, including the use of IoT-enabled sensors and remote fleet management via cloud-based platforms. AI-driven threat detection is playing a growing role in maritime cybersecurity, enabling real-time monitoring of shipboard systems for anomalies. Zero trust architecture is being adopted to enforce strict access controls and continuous verification for all onboard systems. The industry must shift from reacting to attacks to proactively preventing them, with a combination of cutting-edge AI defenses, zero trust security principles, and robust collaboration across the industry.

Hacking Large Language Models (LLMs) to steal crown jewels shiny rocks involves understanding the vulnerabilities of these AI applications, particularly prompt injection, deserialization, and model inversion attacks. LLMs are susceptible to various attack vectors, including indirect prompt injection, prototype pollution, and SQL injection. Hackers can exploit these weaknesses to manipulate LLMs, extract sensitive data, or even inject malicious code into the system. The article highlights the importance of staying ahead in this rapidly evolving field by embracing ethical hacking programs and proactively testing LLM applications for vulnerabilities. As defenders, it is crucial to think like an attacker and poke, prod, and stress-test these models to uncover their weaknesses before malicious actors do.

The article provides a comprehensive guide to hacking wireless networks, including how to crack wifi passwords, use tools like Aircrack-ng and Bettercap, and perform ARP spoofing attacks. The author starts by explaining the basics of wireless networking, including network interfaces, WiFi networks, and Network Address Translation (NAT). They then provide step-by-step instructions on how to hack a wireless network using Aircrack-ng, including how to use monitor mode, scan for nearby access points, and perform a dictionary attack. The article also covers more advanced topics, such as injection attacks and the Bettercap web UI, which provides a user-friendly interface for operating the tool. Throughout the guide, the author emphasizes the importance of using these techniques responsibly and only against networks you own or have explicit permission to hack.

The Bugcrowd-sponsored UMass Amherst Cybersecurity Club CPTC team successfully completed the Collegiate Pentesting Competition, finding vulnerabilities in a mock social media company's networks and presenting a 90+ page report. The competition was won by UMass Amherst, one of the top 12 universities globally to reach the Global Finals. The team gained valuable lessons on communication, networking, and report writing skills, as well as understanding that these skills are just as important as technical skills in cybersecurity. They also learned about the importance of practicing these skills both during competitions and in real-world scenarios. The team exploited a local file read vulnerability to gain access to sensitive data in the company's PostgreSQL container. To prevent similar attacks, it is recommended to prevent local files from being accessed, not to put credentials or sensitive information in environment variables, and to limit access to the PostgreSQL port. Additionally, the team compromised an entire domain through Kerberoasting and Constrained Delegation attacks, demonstrating the danger of security misconfigurations in Active Directory networks. To mitigate these attacks, it is recommended to ensure long and complex passwords for service accounts, rotate them every 30 days, enable AES Kerberos encryption, use Group Managed Service Accounts, and utilize Resource-Based Constrained Delegation.

The new year inspires a renewed sense of excitement about the challenges and opportunities ahead, both personally and societally, but blockchain technologies are still in their early days and novel use cases for these technologies are being explored every day. With so much money moving through today's cryptocurrency markets, any exploitation of vulnerabilities can result in devastating losses—not only for individual users but also for the networks, exchanges, and companies facilitating these transactions. Despite the industry's substantial investments in cybersecurity, news headlines continue to announce massive cryptocurrency hacks at an alarmingly frequent rate. For hackers, such tangible risks and high stakes translate into lucrative bug bounty opportunities. Encryption is one of the foundational security mechanisms in blockchain technology, protecting data integrity, securing communications, and ensuring the authenticity of transactions; however, when blockchain developers rely on weak cryptographic algorithms or insufficient key lengths, they introduce severe vulnerabilities that can be exploited by attackers. Common issues associated with broken encryption schemes include using weak cryptographic algorithms, such as MD5, SHA-1, and DES, which have been proven to be susceptible to brute force attack and collision attacks; insufficient key lengths, which subject otherwise secure algorithms to compromises via brute-force attacks. The use of short cryptographic keys is an expected result of computational advances over time and does not necessarily implicate any underlying weakness in the cryptographic algorithm itself. For example, it used to be commonplace to use 2048-bit Rivest RSA keys, but with the advancement of application-specific integrated circuit (ASIC) hardware, best practices now call for 4096-bit RSA keys. One notable example of the dangers of using weak cryptographic algorithms is the SHA-1 hash collision attack, which occurs when two different inputs produce the same hash value. This vulnerability was proven by researchers from Google and CWI Amsterdam in 2017, where they successfully generated two different files that produced the same SHA-1 hash. Cryptographers had actually been raising the alarm for a few years that SHA-1 was showing signs of weakening against collision attacks. Nevertheless, SHA-1 was widely used for digital signatures, cryptographic hashing, and integrity checks within blockchain implementations. The SHA-1 hash collision vulnerability could theoretically allow an attacker to specially craft a transaction with which the digital signature collides with another transaction, thereby allowing the attacker to manipulate transactions or impersonate other users. Cryptographic validation is a fundamental security measure in blockchain systems, ensuring that transactions, digital signatures, and cryptographic proofs remain tamper-proof and verifiable. However, when cryptographic validation is insufficient or improperly implemented, attackers can exploit weaknesses to forge transactions, bypass authentication mechanisms, or manipulate consensus mechanisms, among other attacks. Common issues associated with insufficient cryptographic validation include improper signature verification, which allows unauthorized transactions due to flawed verification logic; weak multi-signature implementations, which fail to properly enforce multiparty authorization; lack of message authentication, which enables data tampering in network communications; bypassing integrity checks, which allows malicious data to pass as legitimate due to weak validation methods; and incorrect cryptographic proof verification, which enables double-spending or fraudulent claims in zero-knowledge proof (ZKP) and smart contract applications. One notable example of a significant cryptographic validation failure was the Binance Bridge hack of October 2022, which resulted in the loss of $570 million worth of Binance Coin (BNB) tokens due to improper cryptographic validation. The Binance Bridge is a cross-chain protocol that enables the movement of assets between different blockchains. This vulnerability stemmed from a failure of the Binance Bridge protocol to properly verify the Merkle proof of transactions, which effectively allowed attackers to mint unauthorized wrapped tokens. Side-channel attacks exploit unintended information leakage from hardware or software implementations rather than target cryptographic algorithms directly. Blockchain technologies present some unique opportunities for side-channel attacks, such as hardware cryptocurrency wallets, blockchain nodes, and blockchain integrations in small footprint hardware components. At a high level, we can use side-channel attacks to extract private keys, manipulate transactions, or undermine privacy mechanisms. Most side-channel attacks targeting blockchain technologies will resemble similar attacks against other cryptographic implementations, with a few notable exceptions: electromagnetic radiation-based attacks, which use radio frequency (RF) emissions to extract private keys from hardware wallets; timing analysis-based attacks, which combine partial knowledge of inputs with measurements of execution times to recover secret keys. The Trezor One power analysis attack is one of the most intriguing examples of a side-channel attack in the blockchain sphere, demonstrating that attackers can use power analysis to determine the PIN for unlocking a Trezor hardware cryptocurrency wallet. Faulty randomness in smart contracts presents another security risk, as randomness (i.e., entropy) is a critical component in blockchain applications, particularly for lotteries, decentralized apps (dApps), airdrops, and randomized reward distributions. When smart contracts rely on insecure or predictable randomness, attackers can manipulate the outcomes of cryptographic operations to their advantage, leading to significant financial and systemic risks. Common sources of faulty randomness in smart contracts include previous block traits, which are subject to manipulation by miners; on-chain pseudorandom number generators (PRNGs), which use weak algorithms or insufficient key lengths; and off-chain entropy sources, such as untrustworthy or predictable values collected from a centralized API. The Moonbirds NFT randomization attack in 2022 demonstrates how faulty randomness can be exploited to secure rare NFTs. Replay attacks are an age-old vulnerability, compromising everything from network protocols to web applications over the years. In many historical cases, it was necessary to establish some kind of person-in-the-middle position before a replay attack could be carried out. However, the public nature of blockchains presents unique attack vectors for today's hackers. Replay attacks in blockchain technologies occur when a valid transaction from one blockchain network is captured and maliciously rebroadcasted on another network, allowing an attacker to duplicate transactions or perform unauthorized operations. Such attacks are particularly relevant when a blockchain has a hard fork or integrates multichain transactions and/or interoperability protocols. Cross-chain bridge vulnerabilities offer significant opportunities for hackers, with many contributing to the theft of over $2 billion in cryptocurrency in 2022. Common cross-chain bridge vulnerabilities include weak validation mechanisms, flawed smart contracts, oracle manipulation, private key leaks, reentrancy and logic flaws, and lack of message authentication. The Nomad Bridge exploit in August 2022 highlights the risks associated with these vulnerabilities, as attackers drained over $190 million from the Nomad Bridge due to a failure of the protocol's proxy contract to properly verify transactions. In conclusion, blockchain technologies present many lucrative opportunities for hackers, and understanding the risks associated with encryption, cryptographic validation, side-channel attacks, faulty randomness in smart contracts, replay attacks, and cross-chain bridge vulnerabilities is essential for developing effective security measures.

Bugcrowd conducts quarterly Hacker Experience Surveys to gather feedback from its hacker community, providing insights that help the platform understand what's working and what's not. The surveys are designed to be quick and easy to complete, with a maximum of 10 questions, and offer financial incentives to encourage participation. The collected data is analyzed to identify trends, patterns, and key takeaways, which inform the development of improvements to the platform. The survey process is transparent and collaborative, involving multiple teams across Bugcrowd, and feedback is shared publicly through a quarterly blog post. Hackers can participate by staying active on the platform, completing surveys, and connecting with the Bugcrowd team.

Nuclei is an open-source scanning engine that can be used to detect security vulnerabilities, misconfigurations, and exposed services across web applications, infrastructure, cloud environments, and networks. It requires Go version 1.21 or higher to install and can be installed using the `go install -v` command. Nuclei templates are structured in YAML Ain't Markup Language (YAML) and provide a human-readable syntax for defining requests and parsing responses. The tool provides a Domain Specific Language (DSL) for writing complex expressions, making it powerful and easy to read. Templates can be used to systematically replicate discoveries across targets en masse. Nuclei has an active community of hackers and regular maintenance, ensuring that templates stay up-to-date with the latest exploits and attack vectors. The tool allows users to view available templates, filter output, select specific templates, and generate Markdown reports. It also provides out-of-band testing capabilities through integration with ProjectDiscovery's Interactsh tool. Users can create custom templates using YAML and DSL syntax, allowing them to harness the full potential of Nuclei. With its extensibility and customizable nature, Nuclei is a valuable asset for bug bounty hunters and security professionals.

The Cyber Conspiracy Modernization Act is a new legislation introduced by Senators Mike Rounds and Kirsten Gillibrand, aiming to increase penalties under the Computer Fraud and Abuse Act (CFAA) and add a specific penalty for conspiracy to commit computer crime. The CFAA, first created in 1986, has been amended several times, including in 2008, but its broad language has raised concerns about prosecutorial discretion and the impact on good faith hackers. A recent Supreme Court case, Van Buren v. United States, ruled that the CFAA doesn't prohibit using authorized access for unauthorized purposes, giving precedent for hackers and security researchers to use their access without fear of retribution. The new Act's broadening of "conspiracy" as an aspect of the law is concerning, creating a chilling effect on security researchers who form a vital part of the internet's defensive cybersecurity workforce. To help protect good faith hackers, it is recommended that individuals contact their senators and express concerns about the bill, advocating for carve-outs for good faith security research into the CFAA.

Bugcrowd has released VRT 1.15, a vulnerability rating taxonomy update that strengthens blockchain, crypto, and zero-knowledge security against emerging threats. The new version includes classifications for decentralized applications, smart contracts, blockchain infrastructure, and zero-knowledge implementations, providing greater precision in addressing security risks unique to decentralized ecosystems. Hackers and organizations need this standardized framework to classify vulnerabilities effectively, ensuring a proactive approach to securing digital assets and protocols. The update helps streamline the identification, reporting, and remediation of security flaws in dApps and infrastructure, covering issues such as insecure data storage, improper authorization, DeFi security threats, marketplace security risks, protocol-specific misconfigurations, smart contract misconfigurations, and zero-knowledge security misconfigurations.

The European Union's Cyber Resilience Act (CRA) aims to improve the security of digital products and services across the EU by setting cybersecurity standards for connected devices and software. Manufacturers, developers, and distributors are responsible for ensuring their products meet these standards, which includes secure design and development, timely updates, and security assessments before launch. The CRA applies to a wide range of products, including hardware, software, and components, and has significant global impact as companies that want to sell digital products in the EU market must comply with its standards. The regulation also imposes penalties for non-compliance, with fines reaching up to €15 million or 2.5% of the global annual turnover, whichever is higher. The CRA promotes a proactive approach to security, ensuring that companies prioritize cybersecurity throughout the product lifecycle and that consumers are better protected against cyber threats.

MFA security has become a significant concern as organizations implement it universally, forcing attackers to develop methods that exploit implementation gaps or human behavior rather than cracking authentication protocols directly. The shift to remote working and the widespread adoption of MFA have expanded the attack surface, with tools like Modlishka and Evilginx making it easier for less sophisticated attackers to launch advanced attacks. To prevent MFA bypass, organizations need to take a multi-pronged approach that combines technology, processes, and people, including strengthening conditional access policies, advancing MFA solutions, enhancing privilege management, and monitoring and responding to potential threats. Strengthening device and endpoint security, adopting proactive strategies such as zero-trust approaches, and encouraging partnership with the hacker community through vulnerability disclosure programs can also help organizations stay ahead of this complex topic.

The European Union's AI Act is a regulatory framework designed to ensure the safe, ethical, and transparent use of artificial intelligence across its member states. It aims to balance innovation with the protection of fundamental rights and public safety, introducing six key features: risk classification, prohibited practices, transparency and accountability, AI governance, penalties, and support for innovation. The Act prohibits certain AI applications deemed harmful or manipulative, requires transparency in automated decision-making, and establishes a European Artificial Intelligence Board to monitor implementation. Penalties for non-compliance can reach up to 6% of a company's global annual turnover, while regulatory sandboxes provide a testing ground for innovative AI solutions. The EU AI Act entered into force on August 1, 2024, with various key dates and recommended ISO frameworks for compliance. Its implications include influencing global AI regulations, protecting consumers' rights, and fostering trust and safety in the European market.

** Meet Nerdwell, a father and full-time professional who is also an expert hacker. He started his career in IT straight out of high school and has since specialized in various fields including cybersecurity, networking, firewalls, VPNs, application development, and hardware hacking. Nerdwell's approach to hacking combines both the "making" and "breaking" perspectives, and he believes that individuals who build systems also have insight into their weaknesses and vulnerabilities. He is a strong advocate for bug bounty hunting and has been incredibly successful on platforms like Bugcrowd. Nerdwell's journey has not only helped him financially but also personally, as it has given him a sense of purpose and allowed him to provide for his children after a difficult divorce. Currently, he focuses on staying up-to-date with the latest security threats, including insecure deserialization, and sees significant potential in AI's role in cybersecurity. Nerdwell encourages new hackers to dive in and start getting their hands dirty, emphasizes the importance of professionalism on platforms, and recommends using tools like IDA Pro for hardware hacking. He also aims to incorporate automation into his workflows to prevent burnout and enhance his productivity.

We've experienced record-breaking growth and innovation at Bugcrowd over the last year. The company has acquired Informer, a leading provider of attack surface management and continuous penetration testing, enhancing its platforms to bring best-of-breed asset discovery and monitoring for multiple use cases. Bugcrowd secured two major strategic funding rounds totaling $152 million, unveiled a new billboard in Times Square, and introduced AI Penetration Testing and AI Bias Assessments products. The company has doubled down on securing potential vulnerabilities in the AI attack surface, with work with customers like the US DoD's CDAO becoming a crucial proving ground for AI detection. Bugcrowd has also seen massive growth as a company, with over 75% growth in its penetration testing business and onboarded over 300 new customers. The hacker community is thriving on the platform, with nearly 2000 engagements live in 2024, increased payouts, and epic bug bashes. The company has built on its momentum with key leadership promotions and strategic hires, extended its benefits to support long-term learning and career progression, and hired 161 employees in a new office in Brighton, UK. Bugcrowd is committed to building a culture of acceptance, inclusivity, and equal opportunity, empowering partners and continuing to push the boundaries of innovation and breaking through limitations. In 2025, the company plans to launch offensive security testing, a full UI/UX refresh of its platform, and more attack surface management embedded throughout the platform.

Point-in-time penetration testing is a traditional approach where security assessments are conducted within defined parameters over several weeks. It delivers focused and comprehensive security checks, but may leave changes untested for months between assessments, leaving vulnerabilities open to attacks. On the other hand, continuous testing approaches detect and test new assets as soon as they appear in an environment, closing the window of exploitability and providing ongoing coverage without large gaps. Organizations can benefit from combining point-in-time and continuous testing to ensure complete coverage across their infrastructure. Both methods serve valuable roles in security programs, but determining which one is right for your organization depends on factors such as the need for compliance requirements, budget, and the pace of change within your environment.