Emil Hørning

bad at hacking

[Emil Hørning @0xlimE]

ADD ME ON BLUESKY RIGHT NOW

https://t.co/BNdKbX93M6
#Bluesky

[Emil Hørning @0xlimE]

MY FRIEND SAYS BLUESKY IS THE NEWEST SO GO THERE NOW HEHE

[Emil Hørning @0xlimE]

@hakluke I sent you a dm :-)

[Emil Hørning @0xlimE]

What would you do with unlimited free package shipping?

Recently had to actually ship a package to myself to get a bug triaged lol. Found a way to generate valid shipping labels without paying.

[Emil Hørning @0xlimE]

Yesterday I held a talk at AAU on bug bounty hunting and how to get started. During the talk I realized that I only recalled seeing 1 other active bug bounty hunter from Denmark.
Pls help me figure out who the active danish bug bounty hunters are, there must be some out there!🥰

[Nagli @galnagli]

The damage of VDP programs and their Incentivization is far greater than giving some hunters "points" for farming none-bugs that they can later boast on their CV's, I believe it might actually ruin Bug Bounty platforms in the near future, Let's explore the facts 📜

So VDP's, as most people refer to "See something, Say something" type of programs, have gone out of control on most bug bounty platforms, the only one who took significant step against the phenomena is @Bugcrowd about ~2 years ago, completely dropping VDP points and truly making them live to their actual purpose.

@Hacker0x01 said at 2021 that they will be pushing to that direction, without anything meaningful so far.

So, why is it so bad?

1. "Worsening experience for Bug Bounty Hunters and Paid Bug Bounty Programs"

IMO, this is the most concerning aspect of VDP's and when platforms double-down on them - major platform resources are invested in triaging, communicating and managing VDP "Points Only" programs.

In 2024 alone, there were between ~3,500 to 5,000 VALID VDP submissions on @HackerOne (Had to do an estimate by looking at the top VDP programs).

With the signal/noise ratio on these public programs, and by looking on top VDP programs "last 90 days reports" statistics, we can see that there were around ~15,000 to 20,000 submissions to VDP programs in 2024, those are being handled by the same Triage teams and same queues that Bug Bounty Programs who pay money to researchers are, thats probably more or if not the same amount of total submissions to all paid BBP programs on the platform, which are ~x5/x6 in numbers.

This leads to:

A. Significant Triage Burn-Out, Triage teams go through hundreds of invalid reports, or hundreds of same-issue submissions that are being triaged individually, exhausting the triage experience on paid bug bounty programs, in which the reports usually are more complex and require better in-depth overview.

B. Absurd triage times - critical reports to CLEAR / BBP programs who are not being looked for over a week, programs miss out on their critical bugs while they are exploitable, hunters miss out on their bugs being paid.

C. Almost none-existing communications on submissions, enormous triage queues and VDP overheads leads to the fact that its super challenging and hard to get a feedback on existing submitted reports, or having a dialogue with triage teams, the situation today is usually leaving a comment and "praying" triage member will respond.

D. Mediations are completely dead - the significant number of submissions, often from new-comers could lead to mediation requests on none issues, the same queue today exists for paid programs mediations and points only programs, again - affecting the portion of researchers who actually contribute the most value to platforms, finding valid vulnerabilities on paid programs.

2. "Free Labor" / "Can only find bugs on VDPs"

The most obvious thing that comes to mind is the fact that people "work" for free helping multi-billion companies bolster their security, VDP's can be great training ground for new-comers, but the reality today is that >90% of the people who report to VDP programs do so solely to boost their reputation and platform standings because its easier to find bugs there, the programs don't care if you spam ~200 reports on same XSS on same Endpoint and you fake out parameters, and so on.

Think about it - if you managed to find XSS on a VDP via redirect_uri on login page, you most certainly could have found it on a BBP, but you missed it because you were focused on the VDP while the BBP introduced the issue.

Today, there are ~200 VDPs on @Hacker0x01

133 VDPs on @Bugcrowd (I do like that they have completely separated view on the platform)

3. Leaderboards are not trust-worthy

#BugBounty is well gamified space, we all push ourselves the extra-mile to do well and beat our colleagues in the rankings, however VDP's made the state of public leaderboards so unstable and not trust-worthy that they are not even taken into context when determining "top hackers" for events invites, or so on.

Within Q2 (Apr 1st to Apr 16th) we have 8 VDP-Only Hunters on HackerOne's Top 100 leaderboard, including the #1 hacker in the world.

While on the actual leaderboard you do gain some advantage if you hunt on BBPs, as you get some spare change of reputation points when you are awarded a bounty, the sub-leaderboards as "Highest Critical Reputation" do not distinguish between VDPs and BBPs at at all, it's straight 7 reputation points for any triaged High / Crit, whether a free one / one that got $200k bounty.

This means that in Q2 3 of the Top 5 Most Critical Hackers in the world are VDP-Only hackers, and ~20 out of the Top 100 on the 2024 Leaderboard.

Eventually, this leads to actually debating whether we should focus on VDPs to improve our rankings on platforms leaderboards.

4. "Same Scope VDP/BBP Scams"

The standardization of having public incentivized VDP accompanied to a private BBP is the worst thing you can do as a program.

A. Programs will tend to think that the "winning model" would be having main application in scope for private BBP, and have public VDP for all their "wildcards", that's a huge mistake if your company are actually looking in preventing their next breach, so many critical vulnerabilities that can cause to a complete incident in matter of minutes will remain unattended for weeks, no-one would bother to give you an actual time sensitive submission on a program without monetary rewards.

B. Sometimes, it's just straight up a scam - same scopes for both programs, researchers submit to VDP and lose on money.

Having an unincentivized responsible disclosure policy submission form on your website and a private BBP is more than okay, thats actually a perfect use-case, have your own set of researchers and accept in-coming reports as "see something - say something" from the crowd, I bet that if you'll find someone reporting super critical submission, It'll probably lead to a private program invite - unlike when having a "Points Reward" program on a platform already, that you feel the "award" was given already.

Solution 💡

Well, if you made it so far - there is a solution, and it's one that will make all parties happy.

The formula:

1. Remove VDP Points from platforms and Leaderboards.
2. VDP Contribution Recognition - Whenever a researcher submits a valid report to a VDP, display the company logo on his profile, and auto-generate a "Thank You" letter in which he could use in his CV.
3. Auto-Invite researchers who discover a valid bug on private BBP scope in a pubic VDP.
4. No Mediations on VDPs.
5. Sales pitches should specify that companies won't be getting time-sensitive issues on VDPs, pushing them to create BBPs.
6. Kill Private VDPs.

Going through the formula, VDP hunters will still receive valuable recognition for their VDP submissions, BBP hunters will enjoy a clean leaderboard who pushes for paid program submissions, Triage teams will go through way less overload, Mediations will start working again, Less VDP's => More BBP's because companies eventually want to be secured, more BBP's => More Money to platforms.

Disclaimer: everything I've wrote here is based on my thoughts and analysis.

Thoughts? Is there any advantage to any party for awarding points on VDP's? am I hallucinating?

#BugBounty

[Emil Hørning @0xlimE]

what I see every time someone sends me a collection.json file

[Emil Hørning @0xlimE]

@PikuHaku do it

[Emil Hørning @0xlimE]

@cognition_labs To clarify, they are signing up to our product thinking that its yours.

[Emil Hørning @0xlimE]

@cognition_labs Me and my cofounder are in this peculiar situation, that our DevOps tool; Devin (https://t.co/ivOendvVDI) is getting serious traction because of your launch (congratz btw).

We have tons of people signing up for our product and messaging us. Please reach out to us

[Emil Hørning @0xlimE]

Now if I were a java Object, my hashCode() method would just return 0, always putting me in the first bucket in HashMap. This is how hard I grind

[Emil Hørning @0xlimE]

@Cyberlandshold @jens_myrup @aalborg_uni Den her til @oxnan_

[Emil Hørning @0xlimE]

@Cyberlandshold @jens_myrup @aalborg_uni

[Emil Hørning @0xlimE]

The #RedTeamFit tip of the day, close your laptop and go outside.

[vx-underground @vxunderground]

The whole "Red Team Fit" thing on Twitter is a complete joke. Try "Malware Nerd Fit". Last night we traversed the entire planet 12 TIMES. We were Naruto running so fast this dumb app couldn't even calculate our rate of speed.

[Emil Hørning @0xlimE]

@vxunderground @Cyb3rB0r6 @HackingDave Lmao. Has anyone ever been far even as decided to use, even to do go hack more like? Bet not 😎

[Emil Hørning @0xlimE]

Thanks twitter, very cool!

[Emil Hørning @0xlimE]

@Cybersikkerhed @NCybersikkerhed @Jan0fficial Prøv lige at se hvor dårlig deres opsec er, kan du tro det @oxnan_ , ufatteligt hva

[Emil Hørning @0xlimE]

@Jan0fficial @Cybersikkerhed @Forsvarsmin Det kunne jo være Jan Poulsen, at det ikke var noget de havde så travlt med.

[Renwa @RenwaX23]

CTF Player vs Bug Bounty Hunter

[Emil Hørning @0xlimE]

@FrederikKulager bare et hurtigt spørgsmål.
HVORNÅR KOMMER DET NÆSTE ARSNIT AF SØLVFUGLEN HOLY SHIT ALTSÅ

tak 🥰