’s reported decision not to pay out for several significant zero-days was one of three Bug Bounty disclosures with unexpected twists we spotted in the media recently.

The quartet of iOS bugs were apparently linked to a zero-click exploit allegedly used to spy on employees of the company reporting the vulnerabilities, as well as diplomats from a particular country.

The plot thickens when that country turns out to be Russia and the reporter of the bugs is 

, Kaspersky said Apple cited “the dedicated policy” with no further explanation for not paying out for the firm's Bug Bounty submission. 

The head of research at Kaspersky, whose antivirus software has been 

 amid US-Russia geopolitical tensions, said the company would have donated the rewards to charity.

This, by the way, is our inaugural monthly roundup of offensive security insights curated for CISOs, security teams and security-conscious devs (this was first published on our 

Another interesting Bug Bounty disclosure – but with no geopolitical dimension this time – is a ‘vulnerability’ in 

 for which the tech giant paid a reward, but then decided did not quite meet the threshold qualifying it as a vulnerability after all.

The issue “allows an attacker to bypass firewall rules based on Azure Service Tags by forging requests from trusted services”, 

, Tenable said Microsoft initially developed a “comprehensive fix”, but later decided the issue centred on the “inherent risk in using Service Tags as a single mechanism for vetting secure network traffic” and was best resolved with an 

The third, and most bizarre, disclosure saw Web3 security outfit 

after the cryptocurrency exchange’s CSO 

 an unnamed “security researcher” of extortion, and said it was “coordinating with law enforcement agencies” over the issue.

After unmasking itself as the reporter of a related vulnerability to Kraken’s Bug Bounty Program, Certik insisted its researchers had acted as good-faith white hats and 

 of events that left Kraken (named after a mythical giant octopus) apparently unhappy about Certik's conduct.

In other Bug Bounty news of note, Firefox developer 

 program focusing on large language models (LLMs) and other deep learning technologies. And 

 in capture-the-flag competitions and Bug Bounty Programs and how the Chinese government could leverage their endeavours.

did not foresee the backlash to a new AI feature that 

 of your PC in order to create an instantly searchable database of everything you’ve ever done on your computer.

 from the launch of its Copilot+ PCs – it will now only be rolled out for devs and techies to play with as part of its Windows Insiders Program. It’s a serious misstep by Microsoft, which has mostly outflanked its rivals in the LLM arms race since it unleashed ChatGPT in 2022.

On the vulnerability front, a security flaw in the 

 file transfer tool is worth paying attention to after its severity was 

elevated from ‘high’ to ‘critical’

MOVEit developer Progress Software is urging customers to patch CVE-2024-5806 after a “newly identified vulnerability in a third-party component used in MOVEit Transfer elevates the risk of the original issue”. 

 attackers to exfiltrate, delete or change data on the MOVEit Transfer server. The bug has surfaced 12 months after a previous MOVEit vulnerability was blamed for a 

National Institute of Standards and Technology (NIST)

 has revealed a potential solution to a CVE backlog in processing new vulnerability reports. NIST said it has hired an external vendor to help process soaring numbers of vulnerabilities added to the National Vulnerability Database (NVD), 

 has marshalled arguments in favour, as well as exploring the possible risks, of 

amid the ballooning responsibilities of the role. Jon Oltsik, analyst emeritus with Enterprise Strategy Group, suggested that one executive could work the board, regulators and insurers and must be “fluent in the language of the business and translate that into cyber risk”.

Another could oversee the increasingly complex technology side – most notably the rapid adoption of AI. “Having someone who really understands all of that technology and can put the right controls in place with guidance from the business, is a different type of role,” Oltsik told CSO Online.

One of the UK’s worst-ever cyber-attacks

One of the worst-ever cyber-attacks against a UK organisation saw massive disruption to 

 and publication to the darknet of a huge trance of sensitive personal data.

The attack on NHS pathology provider Synnovis disrupted more than 3,000 appointments at hospitals and medical practices using its services.

The Qilin ransomware gang, which is suspected of being Russia-based, has claimed responsibility. 

 that a sample of data it saw included patient names, dates of birth, NHS numbers and descriptions of blood tests. Security experts have expressed concern that the stolen data gives cybercrooks ammunition to extort affected patients.

Another large-scale attack against the healthcare sector, this time in the US, could potentially involve the theft of highly sensitive personal data of 

Pennsylvania-based healthcare provider Geisinger 

 a November breach on Microsoft-owned speech recognition firm Nuance Communications after it failed to revoke corporate file access from an employee who had been sacked.

A problem with open source vulnerabilities?

 in relation to vulnerability disclosure in an article about 

Common Misconceptions about CVEs, NVD, KEV Catalog, and EPSS

Security researcher Kyle Kelly wrote: “Many security tools use the NVD as their sole source of security advisories”, yet “open-source maintainers frequently publish security advisories on alternative platforms like the GitHub Advisory Database”. He added: “This is not good if you care about open-source vulnerabilities.”

In positive news for open source security, applications are open to 

, which helps critical and under-resourced open source projects prevent and patch vulnerabilities through reducing technical debt, secure code audits and Bug Bounty. The impressive initiative is operated by the Sovereign Tech Fund, which runs four public programs through YesWeHack: for 

We’ve also seen useful articles on best practices from reputable sources on 

 (a podcast interview with GitHub CISO Mike Hanley) and on the 

, with tips and useful resources for implementation.

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

invited participants to exploit a path traversal (CWE-22) vulnerability

and read a file containing the challenge flag.

We are delighted to announce the winners of Dojo Challenge #33 below.

Want to create your own monthly Dojo challenge? Send us a message on Twitter!

 feeds to be notified of upcoming challenges.

Read on to find out how one of the winners managed to solve the challenge.

We asked you to produce a qualified report explaining the logic allowing exploitation, as set out by the challenge. 

To ensure contestants actually solved the challenge themselves rather than copy-pasting the answer from elsewhere.

To determine contestants' ability to properly describe a vulnerability and its vectors within a professionally redacted report. This gives us invaluable hints on your unique talent as a bug hunter.

We want to thank everyone who participated and reported to the Dojo challenge. Many other high quality reports were submitted alongside those of the three winners. 😉

Below is the best write-up overall. Thanks again for all your submissions and thanks for playing!

 occurs when an application uses external data (e.g., user input) to identify a file or directory located under a restricted root directory, but does not properly control the elements entered by users, resulting in the interpretation of the resolution of a path name to a location external to the restricted root directory.

In other words, exploiting this vulnerability allows an attacker to read files 

 the current directory. This could lead to sensitive files being read.

Firstly, an application whose source code was accessible was identified. The purpose of this application was to enable users to display files within an HTML page via a form in which the file name was entered.

The first step in exploiting this application was to analyze the 

The following lines provide an initial source of important information. The application's current directory is set to 

. This means that the files included in the application should be in this directory:

The section of code following the first 5 lines configures a Jinja2 environment for template rendering, using the 

 directory as the template source, with an initial template named 

. This means that it is probably via this file that the contents of the other included files will be displayed:

The next part of the code indicates a function named 

. This function returns a variable of type 

, and takes as parameter a variable with name 

, corresponding to the file name specified by the user:

This function acts as an initial check on the data sent by the user:

 converts all uppercase letters within the variable f to lowercase. For example, "ExampLe" will become "example".

Thereafter, various checks are made via conditions:

if f.startswith("/") or f.startswith("file:///")

 variable begins with "/" or "file:///". If so, the function returns 

elif (“127” in f) or (“localhost” in f)

 is a second check to detect whether the 

 variable contains the strings “127” or “localhost”. This blocks the possibility of including files using a local address such as 127.0.0.1. If either of these two patterns is detected, the function also returns 

Finally, if all conditions are not met, i.e. if the 

 variable does not begin with “/” or “file:///” and does not contain “127” or “localhost”, then the function returns 

The following code then forms the core of the application, enabling the reading of local files specified by the user:

The first line of this block of code instantiates a variable named 

3 nested conditions instructions are then implemented:

 is strictly positive. If this condition is not met, the default file displayed is 

 directory, as indicated by the following lines in the code block :

The welcome.txt file is therefore located in 

.

If the condition is met, a filter set up by the 

 loop detects the presence of the string “../” in the 

 variable. As long as this string is present, all occurrences of “../” in 

 will be replaced by an empty string. This reduces the risk of including files. For example, “../../../secret.txt” would become “secret.txt”.

Then, the second condition uses the previously analyzed function, 

 variable as argument. This condition is used to validate that this variable respects all the prerequisites previously mentioned in the analysis of this function. If all conditions are met, the function returns 

. If this is the case, the application will try to parse the name of the 

 variable using a regular expression.

If this second nested condition is not met, the 

. This value will then be displayed within the application.

The third and final nested condition provides additional control over the 

 variable, via a regular expréssion. The regular expression in question is: 

 variable by detecting the presence of alphabetic characters at the beginning of the value (whether upper or lower case). It then checks for the presence of “://”.

If the regular expression is satisfied, the application will attempt to read the file. On the other hand, if the regular expression is not satisfied, the file read will be “files/**filename”. If the application is unable to read the file, the error message displayed will be “File not found”.

Finally, the last part of the code is as follows:

This code adds a condition to check whether the string “

Finally, the last line of code displays the contents of the read file, or various error messages if all conditions are not met.

To exploit the application, the aim here is to attempt to read a file external to the authorized directory path.

To do this, the first check to be satisfied is the absence of “/” or “file:///” at the beginning of the input. As this condition is too permissive, the use of the 

 wrapper is authorized. This will enable us to read a file.

Secondly, the application checks for the presence of “127” and “localhost”. Fortunately for us, it's possible to bypass these protective measures by using a 

 representation of the 127.1 address (equivalent to localhost): 

Here, there's no need to use “../”. Any file can then be read. Here, a secret is present in 

 tries to be included: a blacklist is set up and replaces the string "flag" with "_AV_", which doesn't satisfy the last condition of the code:

To bypass this protection, character encoding can be used. This would result in a final load of :

It is now possible to include and read any file.

Here, the file /tmp/secrets/flag.txt will be displayed via the following payload:

The secret is FLAG{Y0u_C4n_Acc33ss_F1l3s_Th1s_w4y?!}.

When analyzing the code, we noticed that the template used was "index.tpl" located in "/tmp/app/templates/".

Here, if we try to include this file, the code will be displayed:

It's possible to notice that a file is included via the 

 placeholder. This is how the contents of the file are displayed.

An attacker with the ability to exploit this vulnerability could perform the following actions:

: if a web application is vulnerable to file inclusion or path traversal, the attacker could gain access to sensitive files such as configuration files, database files or password files. This could enable the attacker to compromise the security of the application or server.

: if a web application handles personal or sensitive data, a file inclusion or path traversal vulnerability could enable the attacker to access this data and use it for malicious purposes, such as identity theft or fraud.

Finally, in the worst case scenario, it would be possible to include remote files containing malicious code, which would be executed by the application, leading to its compromise.

To remedy this vulnerability, various control measures could be implemented:

: it is necessary to configure sufficient rights on files so that the application cannot access them. This can be done through read, write and execute rights.

: instead of authorizing access to all files on the system, it is preferable to define a whitelist of authorized files, and only authorize access to these files.

: it is recommended to implement more controls on user input. This could involve detecting the presence of wrappers, if this is not necessary. Last but not least, character encoding controls should also be tightened.

Of course, these controls will have to be analyzed beforehand to avoid impacting the application's operation.

https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion

https://cwe.mitre.org/data/definitions/22.html

https://portswigger.net/web-security/file-path-traversal

Dojo challenge #33 winners!

As EU member states scramble to transpose NIS 2 into national law, affected organisations are doubtless accelerating their compliance efforts as the transposition deadline (17 October) approaches.

There may be much work to do. After all, there were recent 

 of French organisations being underinformed about their new obligations.

NIS 2 aims to elevate and harmonise cyber-resilience across the bloc more effectively than its predecessor directive. Among other notable additions, national cybersecurity strategies and cybersecurity risk-management rules for “essential” or “important” entities must incorporate supply chain security and coordinated vulnerability disclosure (CVD) policies.

Belgium, the only member state to fully transpose NIS 2, has also mandated that qualifying entities publish a CVD policy. While this goes beyond what NIS 2 demands, perhaps some other member states will follow suit for reasons we’ll explain later.

NIS 2 should be of interest outside the EU too. Like the General Data Protection Regulation (GDPR), this landmark legislation may well inspire copycat regulations outside the bloc (it’s worth noting too that the UK is still updating its own NIS regulation post-Brexit).

This NIS 2 summary outlines the directive's key points, as well as the benefits of 

Continuous Threat Exposure Management (CTEM)

 for cost-effectively achieving compliance. 

 is the second iteration of the NIS (Network and Information Security) Directive, which broke ground as the first EU-wide cybersecurity rules when they came into force in 2016.

, the successor legislation is intended to achieve “a high common level of security of network and information systems across the Union”. It aims to do so by obliging:

Member states to adopt national cybersecurity strategies and designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity and computer security incident response teams (CSIRTs)

Member states to give organisations tools, mechanisms and encouragement to share information on vulnerabilities, threat actors and so on

Organisations providing “essential” or “important” services to implement cybersecurity risk-management measures and promptly report “significant” security incidents

Member states to supervise and enforce compliance

The legislation sets out minimum requirements designed to achieve these goals that national laws will have to at least match, if not exceed.

The NIS 2 Directive entered into force in January 2023, from which point member states had 21 months to transpose its requirements into national law. The deadline of 17 October is now only four months away, with all but two countries (Croatia and Belgium) yet to transpose at the time of writing.

Regarding the obligations of in-scope entities, some requirements will apparently enter into force immediately, while others will be subject to a grace period.

Qualifying organisations must self-assess whether they fall within the scope of NIS2 and notify the relevant state regulator that they fall within NIS 2’s scope by 17 April 2025 (for some entities the deadline is 17 January). 

Why the original NIS Directive was superseded

 to be failing to embed sufficient and consistent cyber resilience across the EU and its critical sectors, create a common understanding between states about the threat landscape, or create a joint crisis response capacity. 

Among other measures, NIS 2 sets out to remedy these shortcomings by applying to a wider range of sectors, introducing incident reporting deadlines and strengthening information-sharing measures. It also introduces minimum financial penalties for violations and makes “management bodies” liable for infringements.

Vulnerabilities and supply chains to the fore

 post-2016 meant NIS 2 was drafted in a much-changed threat landscape to its predecessor.

While the word “vulnerability” appeared only once in the first NIS (and then only in relation to the obligations of CSIRTs), the term “coordinated vulnerability disclosure” appears 11 times in the NIS 2 Directive. Both member states and essential/important entities have obligations around vulnerability management or disclosure. The directive prescribes the creation of a European vulnerability database.

The first NIS was drafted before the game-changing 

 in 2020, which resulted in the downstream compromise of 18,000 customers (including government agencies). Whereas the first iteration did not even feature the term “supply chain”, NIS 2 mandates state-level risk assessments and entity-level measures on supply chain security.

The NIS 2 Directive broadens the scope of critical sectors and divides them into “essential” and “important” entities.

Four new sectors are added to the essential (or “high criticality”) tier, with space, waste water, ICT service management and public administration joining energy, transport, banking, financial market infrastructure, health, drinking water and digital infrastructure (which now also includes trust, cloud and other additional services).

The important category is populated by postal and courier services, waste management, chemicals, food, manufacturing, research and digital service providers, which span online marketplaces, search engines and social networks.

The NIS 2 regulation introduces, with certain exemptions, size and annual turnover parameters too (minimum 250/50 employees and €50m/€10m turnover for essential/important services). Member states have the discretion to make exceptions for high-risk entities that fall outside of these parameters.

Ireland’s National Cyber Security Centre has published a useful 

 (PDF) for understanding whether your organisation will be subject to NIS 2.

It has been estimated that around 100,000 companies in the EU will have to become NIS 2-compliant. YesWeHack qualifies as an ‘important’ entity and we have taken steps to comply.

NIS 2 essential and important entities must comply with risk-based security requirements arranged around six themes.

, management bodies must approve, oversee and be held liable for infringements of these NIS 2 controls. They must also undergo cybersecurity risk-management training and encourage their employees to regularly do likewise.

, meanwhile, “shall be based on an all-hazards approach” and cover a multitude of security areas, from cryptography to human resources security.

These measures should also tackle potential vulnerabilities in their supply chains, while entities should take into account 

coordinated security risk assessments of critical supply chains

Where entities use third-party ICT services, they may be required to use providers that are certified under pending 

European cybersecurity certification schemes

. Member states are also expected to encourage the use of ‘

’, as well as European and international cybersecurity 

reporting ‘significant’ security incidents

 and simplifies the criteria for reportable incidents since the previous conditions led to 

. CSIRTs or competent authorities must be sent an early warning within 24 hours, an incident notification within 72, an intermediate report (where applicable), a final report within a month of the incident notification, then (for ongoing incidents) a progress report. The CSIRT/competent authority should provide feedback, potentially with mitigation measures. Where appropriate, organisations should also notify and provide advice to affected users.

NIS 2 vulnerability management requirements

The risk-management measures qualifying entities must take should encompass “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure”.

National cybersecurity strategies, meanwhile, should generate a policy on “managing vulnerabilities, encompassing the promotion and facilitation of coordinated vulnerability disclosure”.

To this end, a network of national CSIRTs will mediate coordinated vulnerability disclosure where necessary; track and disseminate information and best practices around cyber threats, vulnerabilities and incidents; help NIS 2 sectors monitor their networks and information systems; and hunt for vulnerabilities through non-intrusive scanning of essential and important entities’ online assets.

In consultation with the Cooperation Group, ENISA (European Union Agency for Cybersecurity) is tasked with building and maintaining a European vulnerability database, and to this end has just 

. Entities, whether subject to NIS 2 or not, will be able to voluntarily disclose vulnerabilities in ICT products or services. ENISA’s chief cybersecurity and operational officer has 

 that such a database would itself present an intolerable security risk.

Incidentally, YesWeHack already provides a secure, straightforward and legally protective mechanism for reporting vulnerabilities in the form of 

 (free web browser plugin), should be consulted first in case the vendor has a dedicated Vulnerability Disclosure Programme (VDP).

Violations of NIS 2 could lead to fines of up to €7 million or 1.4% of total annual turnover for important entities, or up to €10 million euros or 2% of total annual turnover for essential entities (whichever is higher). Senior management can also be held liable for violations.

Belgium’s transposition doubles fines for repeat offenders (where the second offence occurs within three years of the first).

Organisations already compliant with ISO 27001 – which 

 – have a head start in the journey to compliance. While ISO 27001 compliance is not a prerequisite for NIS 2 compliance, the overlap between the two makes this ISO standard an excellent springboard.

 (PDF) estimated that compliance with a successor directive would typically require qualifying entities to increase cybersecurity spending by up to 22%. However, it also suggested that increased costs could be offset by costs averted through a reduction in security breaches.

Organisations keen to comply in a way that cost-effectively hardens their digital assets might be interested to hear a couple of relevant insights.

continuous threat exposure management (CTEM)

The YesWeHack Blog

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

Dojo challenge #33 winners!

Countdown to NIS 2 compliance: Key insights and implications for your SecOps strategy

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

YesWeHack raises 26 million euros to accelerate its growth and international expansion

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

Dojo challenge #32 winners!

UK PSTI Act: ‘World first’ IoT security rules offer reminder of VDP virtues

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us