May 2025 Summaries

iOS testing is a complex process due to the proprietary nature of the platform and the lack of publicly available documentation. A jailbroken iOS device with the necessary tools, including Cydia and OpenSSH, is required for testing. The XNU kernel, which is based on FreeBSD and OSFMK, provides a familiar environment for developers with *NIX experience. However, this familiarity comes at the cost of complexity, and many parts of the system are not open source. iOS testing involves understanding the system paths, including the App Store application directory, data directories, and shared data directories. The process also requires knowledge of iPhone application packages (IPAs) and app bundles, as well as decryption techniques using tools like frida-ios-dump. SSL pinning is a common roadblock in iOS testing, but it can be defeated using tools like ssl-kill-switch2. Syslog checking and binary analysis are also crucial aspects of iOS testing, with IDA Pro being the recommended tool for reverse engineering iOS apps. The guide provides a basic understanding of iOS testing and creates a working test environment, but readers are advised to dive deeper into the platform and its many complexities.

Ruikai "Patrick" Peng, a 15-year-old, has already made a significant impact in the cybersecurity world with his impressive portfolio of discovered vulnerabilities and blog following over 20k monthly readers. He specializes in machine learning (ML) security, binary exploitation, and ML security automation, often referred to as the "low levels." Ruikai has uncovered remote code execution vulnerabilities in major ML frameworks, including TensorFlow, Transformers, and Llama.cpp, as well as government systems, Google, Microsoft, and Evernote. He has also been accepted as a speaker at Black Hat USA, making him the youngest presenter in the event's history. Beyond his technical achievements, Ruikai has diverse interests in theater, music, sports, and photography, and emphasizes the importance of simplicity, intellectual curiosity, and adaptability in his work. With a flexible outlook guided by clear principles, he aims to make a significant impact in the world through his passion for cybersecurity.

Alx's career in cybersecurity began with a fascination with programming languages, which led him to contribute to vulnerability tracking systems and later transition into software development. He eventually landed in the mobile security field, where he has gained a unique perspective on vulnerabilities often overlooked by vendors. Alx believes AI will transform the industry but also create new opportunities for complex failures. His approach to penetration testing emphasizes mapping attack surfaces, conducting assessments, and providing remediation advice. To maintain balance, Alx prioritizes self-care, physical activities, and a supportive network of family and fellow hackers. He advises aspiring hackers to focus on specialized skills, trust their intuition, and remain open to uncertainty in the ever-evolving cybersecurity landscape.

As a hacker, you're likely motivated by a desire to make the internet safer and more secure. You'll be drawn to bugs like cross-site scripting vulnerabilities or SSRFs because they offer a challenge and reward. Your hacking style will depend on your zodiac sign, with each sign offering unique traits and characteristics that can influence your approach. For example, as a Scorpio, you may be secretive about your methods but trust your gut when it comes to finding weak spots in systems. On the other hand, as a Sagittarius, you're driven by curiosity and a desire for novelty, often seeking out emerging fields like AI security or Web3. Your passion for hacking is fueled by the joy of solving complex puzzles and continuously learning new skills. With your unique traits and characteristics, you'll fit in perfectly on the Bugcrowd Platform, where you can collaborate with other hackers, learn from them, and contribute to making the internet a safer place.

The Cybersecurity and Infrastructure Security Agency (CISA) plays a vital role in global cybersecurity efforts, providing threat intelligence, advisories, and standards for international responses. However, recent funding cuts have raised concerns about its stability and the potential impact on global cybersecurity resilience. The Common Vulnerabilities and Exposures (CVE) database, which relies on CISA's capabilities, is also vulnerable to fragmentation if it loses stability or authority. In response, the CVE Foundation was established to provide more stable, international, and community-driven oversight, while the European Union has launched the European Vulnerability Database (euVD) to reduce dependence on the US-controlled CVE database. The global cybersecurity community is urging for a more robust, globally resilient solution to address these concerns, ensuring that critical cybersecurity infrastructure remains resilient and protected from political volatility and inconsistent funding.

Katie Paxton-Fear, also known as InsiderPhd, is a cybersecurity expert with an educational impact in the field. She transitioned from a frustrated software developer to a respected expert after realizing her passion for PhD studies and pursuing higher education. Katie's journey highlights the importance of community, mentorship, and balance in achieving success. She emphasizes the need for diversity in the industry, encourages content creators to focus on quality over quantity, and shares her own experiences as a woman in cybersecurity. With her unique approach to hacking, teaching, and content creation, Katie inspires others with her authenticity and passion.

The Bug Bounty Engagement Simulator is a powerful new modeling tool that helps security teams analyze, plan, and make data-driven decisions for their Managed Bug Bounty (MBB) engagements. Powered by AI and built on insights from thousands of real-world customer engagements, the simulator delivers actionable estimates of submission volume and reward spend, enabling teams to confidently plan, predict, and optimize their next MBB engagement. The tool replaces guesswork with clarity, providing clear budget forecasting, flexible scenario planning, and streamlined handoff to launch, making it easier for teams to align budgets and secure stakeholder approval. With its depth of context and transparency, the simulator surfaces insights that generic ROI calculators cannot, allowing teams to refine their strategy until they've found the best balance of cost, coverage, and risk tolerance. The tool is now available in the Bugcrowd Platform at no extra cost to customers planning new MBB engagements.

Sendbird, an award-winning communication platform used by popular mobile apps, launched a managed bug bounty engagement with Bugcrowd two years ago. The program has rewarded over $53,000 to ethical hackers and found over 500 vulnerabilities, including RBAC issues, web vulnerabilities like XSS and CSRF, and potential user confidentiality compromises. Sendbird's public bug bounty program plays a crucial role in safeguarding their systems, and the company values the hacker community, aiming to establish lasting relationships with them. The collaboration with Bugcrowd has reduced operational burden, allowing Sendbird's security team to focus on enhancements. Sendbird prioritizes the hacker experience, issuing payouts within five days for valid reports, which has led to a steady stream of submissions.

The text discusses the concept of "Automated AI Red Teaming at Scale" using a tool called DSPy, which is designed to help developers and security researchers test and improve the robustness of language models. The author, Ads Dawson, shares their experience with DSPy and provides an example workflow that demonstrates how to use the tool to create adversarial inputs for a target model. The goal of this process is to identify vulnerabilities in the model's decision boundaries and improve its overall performance. The text also touches on the importance of prompt engineering and the need for more structured evaluation methods in AI development. Throughout the article, Ads emphasizes the potential of DSPy as a tool for promoting responsible AI development and ensuring that language models are secure against adversarial attacks.

AI has advanced significantly, with chatbots like ChatGPT that can engage in casual conversations and provide responses that may feel too familiar or even jarring. To understand AI, one must first consider what makes humans intelligent, including acquiring knowledge through experience, applying logic and reasoning, adapting behaviors to changing circumstances, making choices based on available information, perceiving and understanding the world, generating novel ideas, and artistic expressions. At its core, an AI model is an input/output system that uses algorithms and large amounts of data to accomplish constant thinking, often using machine learning, deep learning, natural language processing, computer vision, or other techniques to analyze and understand data. Foundation models serve as base models for specific tasks, while generative AI can create original text, images, videos, and media in response to prompts. Agentic AI systems pursue goals through a series of actions, often with minimal human intervention. Testing AI accuracy involves benchmarking against standards, such as Humanity's Last Exam, which has achieved scores of up to 20.3% so far.

Five years ago, ClassDojo launched a Managed Bug Bounty engagement with Bugcrowd. The program has rewarded almost $100K to ethical hackers and found almost 200 vulnerabilities. ClassDojo uses the expertise of ethical hackers to stay ahead of potential threats and reinforce their commitment to data privacy and safety. The partnership with Bugcrowd has been invaluable, providing fresh perspectives on potential vulnerabilities and a structured approach to triaging and validating reports. As a result, ClassDojo has improved its overall approach to developing its product, identifying patterns that enable the company to holistically address bug classes within its code base. The engagement has also provided strategic insights into how to improve development practices and application security. The program's success is measured by its ability to proactively identify vulnerabilities before malicious actors can take advantage of them, allowing ClassDojo to stay ahead of potential threats and reinforce its commitment to data privacy and safety.

With over four years of experience as a hacker and Senior Solutions Architect at Bugcrowd, the author aims to share trade secrets that keep hackers engaged. They've reviewed hundreds of engagements, observing good, bad, and confusing strategies. To combat this issue, they started a series guiding customers through choosing the right engagement type, writing a brief, and retaining hackers. The guide outlines 10 core values to help create a successful engagement that attracts and retains top hackers. It emphasizes respecting everyone's time, eliminating ambiguity, designing for flow, providing a personal touch, rich context, knowing the audience, structuring rewards thoughtfully, celebrating success, keeping it engaging, and maintaining and evolving the engagement. The guide is designed for those launching or running a bug bounty engagement, aiming to create a balance of valuing hackers, providing enticing scope and rewards, and consistently engaging with Bugcrowd to stay relevant.

As a leader in crowdsourced security, Bugcrowd is committed to building a secure digital world by following the principles outlined in CISA's "Secure by Design" Pledge. The company has made significant progress in advancing and reinforcing these principles across its operations and offerings. Bugcrowd has demonstrated compliance with seven key goals, including eliminating default passwords, implementing multi-factor authentication, reducing entire classes of vulnerabilities, comprehensive security patch management, a public vulnerability disclosure policy, Common Vulnerabilities and Exposures (CVE) adoption, and maintaining evidence of intrusions. By signing the Pledge, Bugcrowd is doubling down on its ethos and investing in safe and secure collaborations with its customers and the Crowd.