Cale

23. Founder / Hacker @ObvaneGroup prev Triager @Hacker0x01 Sec Eng @Intruder_io Pentest @WeAreOnSecurity

[Nate @nnwakelam]

I can't stress it enough when I say I would rather commit ritualistic japanese suicide and die a warriors death than sit around training bug bounty platforms to automate me out of the pipeline with my bug reports

[Mitchell Amador @MitchellAmador]

@CaleAnderson02 How much enthusiasm do you think there would be on the H1 side? We can herd the cats in crypto to make something happen, but I'm wondering if there would be real interest.

As far as I've seen, only Immunefi has had the will to strengthen the SR's hand and treatment at scale.

[Cale @CaleAnderson02]

@MitchellAmador There’s a solid group of current / ex h1 triagers that would jump at the opportunity to handle this. Will dm and can make some intros 🫡

[Cale @CaleAnderson02]

Alright,

A few thoughts on the triage discussion.

Everyone is talking about AI slop, but I think it’s exposing a bigger issue that’s existed for years.

Bug bounty still doesn’t have shared standards for triage or mediation.

The same report can receive completely different outcomes depending on the platform, customer, triager or mediator involved.

That was frustrating when report volume was manageable.

1/?

[Patrik Grobshäuser @ITSecurityguard]

Some exciting changes @Hacker0x01 are coming!

[Cale @CaleAnderson02]

Personally I’d love to see two open standards emerge.

A triage standard maintained by HackerOne since they have the strongest technical team out of any platform (I’m biased here)

A mediation standard maintained by Immunefi since they seem to handle it the best

Not owned by them. Maintained by them. And adopted by every platform

Put both in public GitHub repositories. Let hackers, customers and platforms propose changes, discuss them publicly and vote on them.

If AI is going to increase report volume by 10x or 100x, the least we can do is make sure that we have clear consistent standards across every platform

The goal should be to make bug bounty more consistent, transparent and scalable before AI forces the issue for everyone.

3/3

[Cale @CaleAnderson02]

We have CVEs.
We have CWEs.
We have CVSS.

We don’t have an equivalent standard for how reports are triaged, how duplicates are handled, how impact is assessed, how mediation works or what happens when there is a dispute.

Instead every platform and customer has their own interpretation of the rules.

2/3

[Cale @CaleAnderson02]

@jobertabma @MitchellAmador

[Patrik Grobshäuser @ITSecurityguard]

Stop blaming AI slop for what bug bounty platforms did to themselves.

👇 wrote down some thoughts about the state of triage

https://t.co/0dq1I61YGd

[VXUG Giveaways @vxgiveaways]

$1,000 Hack The Box Labs Giveaway

10 winners | $100 giftcard each

To enter: follow @vxgiveaways and @ObvaneGroup, then comment below sharing why you'd like to win

Winners picked in a week

[Obvane @ObvaneGroup]

We Googled a shipping label file format.
Less than an hour later, we had domain credentials.

New research from Obvane on .nlbl weaponization and an overlooked enterprise attack surface.

https://t.co/IL2IP9vgL4

[Obvane @ObvaneGroup]

Russian Market reads less like a forum and more like a storefront with felonies.

Obvane looks inside one of the largest criminal marketplaces online and the economy that formed around it.

https://t.co/ozyEBOZWZ4

[Wiz @wiz_io]

🤖 65% of Forbes AI 50 companies leaked secrets on GitHub. @sshaybbc revealed how AI speed without security = leaks waiting to happen.
Full Wiz Research report 👉
https://t.co/kmamDrkIo3

[vx-underground @vxunderground]

Reverse engineering tip

If you're not sure something is ransomware, run it as Admin on your computer

If your documents are no longer accessible and your wallpaper has changed, then it is probably ransomware

[Raaz @solostalking]

don't leave babe, I'll find new IOCs next

[Florian Roth ⚡️ @cyb3rops]

The predictable fallout of weaponizing unreported vulnerabilities

https://t.co/bte3wiEvkf

[ZachXBT @zachxbt]

@Steam You clowns allow malware on your platform that has resulted in $150K+ stolen from victims (fake game has been available to download for more than a month)

[zseano @zseano]

wow... great finds. good writeup, worth a read! :) and if you've ever been to burgerking drivethru, AI is analyzing your convos ;D https://t.co/5KPuLFMml8