Our latest roundup of notable technical research kicks off with web security pioneer

 breaking new ground again with his latest Black Hat USA presentation.

The PortSwigger director of research begins his writeup for ‘

Listen to the whispers: web timing attacks that actually work

’ by urging his peers to start listening to the “timing oracles” pervading websites since they are “eager to divulge their innermost secrets”. His latest 

 promises to “unleash novel attack concepts to coax out server secrets including masked misconfigurations, blind data-structure injection, hidden routes to forbidden areas, and a vast expanse of invisible attack-surface”. 🔥 With hypothetically-sound web timing attack techniques all too often failing when applied to real-world scenarios, he illustrates each technique for exploiting this neglected side-channel “with multiple real-world case studies on diverse targets”. The researcher also provides “battle-tested open-source tools” and a CTF. 👏

, a researcher of comparable renown, has unearthed another vast attack surface linked to architectural problems with 

Exploiting Hidden Semantic Ambiguity in Apache HTTP Server

’, which also featured at Black Hat, Tsai revealed how he pioneered 20 ‘confusion attack’ techniques and found nine related vulnerabilities. 

 He has cited the biggest highlights as escaping from DocumentRoot to System Root, bypassing built-in ACL/Auth with just '?', and turning XSS into RCE with legacy code from 1996. 💪 He also warned that more types of confusion attacks will emerge “unless the Apache HTTP Server undergoes architectural improvements or provides better development standards”.

The PortSwigger team had a productive August, with two of Kettle’s colleagues also publishing impressive research. 

 into access control bypasses and even RCE, and provides a CTF for road-testing the skills duly acquired. 🔥 And in 

Gotta cache 'em all: bending the rules of web cache exploitation

’ (👏 great title), Martin Doyhenard explores how various HTTP servers and proxies behave when parsing specially crafted URLs, as well as RFC ambiguities that create path confusion. He also details novel techniques for abusing parser discrepancies to achieve arbitrary web cache poisoning and deception in numerous websites and CDN providers. 💪

 a series of ‘broken access control vulnerabilities’ on a 

that, they claim, enabled attackers to read other users’ messages, access attachments (photos and videos) from their chats, and update someone else’s profile info, among other misdeeds. 😲 In a six-month disclosure timeline, the vendor apparently said the vulnerabilities have now been addressed.

A vulnerability in FIDO devices that use the Infineon SLE78 security microcontroller allows attackers to extract Elliptic Curve Digital Signature Algorithm (ECDSA) secret keys and 

, the side channel attack requires extended physical access, specialized equipment, and advanced understanding of electronics and cryptography. Credit goes to NinjaLab's Thomas Roche, who previously devised a side-channel attack that enabled the 

A pair of writeups concerning security weaknesses in 

 to flag next. 🤖 First, Microsoft has seemingly 

remediated a vulnerability enabling a chain of exploits

 affecting the chatbot, including prompt injection via a malicious email (or hidden in a shared document); automatic tool invocation without a human in the loop to read other emails or documents; ASCII Smuggling to stage, to the user invisible, data for exfiltration; rendering hyperlinks to attacker-controlled domains (websites, mailto:); and, optionally, conditional prompt injection. 

Second, Tenable Research has detailed a critical information-disclosure vulnerability in 

server-side request forgery (SSRF) that leveraged Copilot’s ability to make external web requests

. Combined with an SSRF protection bypass, the SSRF, which has now been patched, gave the researchers access to internal infrastructure for Copilot Studio.

Advanced server-side template exploitation with RCE everywhere

Our very own bug hunter and researcher enablement analyst has produced a pair of nifty hacking writeups since our last edition. 👊 In 

limitations are just an illusion: Advanced server-side template exploitation with RCE everywhere

, Brumens explains some novel techniques for exploiting SSTIs

with complex, unique payloads that leverage default methods and syntax from various template engines. Better still, he achieves RCE 

without needing any quotation marks or extra plugins

 within the templates. Brumens also found time to pen a writeup on how to 

perform white-box penetration testing on a Python web application

 running in a Docker container, and perform 

 in order to track our payloads throughout the process, and understand how security filters can hide vulnerabilities in plain sight. 💪

 on the topic at NahamCon 2024 has landed. As well as learning filter collision, transformation and space-excluding techniques on Dojo, now you can leverage 

 to turn your payload into a web application firewall nemesis. 🧠

We already have proof for the concept that open source vulnerabilities can have a catastrophic impact, in the form of the landmark 

 bug. The location of the devastating flaw, 

, happens to be among seven public Bug Bounty programs operated by the Sovereign Tech Fund, which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem. 🌐 The comparable ubiquity of the other programs’ technologies – 

Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP 

 – means it’s not hyperbolic to say that finding similarly critical bugs in these programs could help to prevent some pretty devastating downstream impacts. 💥 Mindful of the significance of these programs, we’ve 

 and, indeed, the satisfaction of helping to secure some pretty fundamental digital infrastructure. 💰

To mark Cybersecurity Awareness Month – starting tomorrow – we’re also giving away exclusive swag for any valid bugs reported to our #OpenSource programs 🎯 🎁 This is part of our ‘OPEN the code; SOURCE the bounty’ campaign.

 with one of the world’s most successful hunters, 

. Among other things, the Israeli hacker shares his journey into Bug Bounty, revisits his most memorable bug discovery, reveals the secrets behind his success, discusses currently productive scopes, and offers invaluable advice for aspiring bug hunters. 💎

As well as financial rewards and invites to private programs, an ultimate dividend of all this hunting education and advice could be a place on our 

and the respect of your peers. To this end, let us give thanks to and express admiration for all-time runaway leader 

(third for Q3, and recent climber into the 

Xel was among those to add to their points tally through participation at our live Bug Bounty in Rome over the weekend

, the maker of Ferrero Roche, Kinder Bueno and other sweet-packaged delights. The event took place at RomHack 2024

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

Halloween 🎃, Oktoberfest 🍺, and World Smile Day 😊 are not the only notable events happening next month… Our latest roundup of offensive security insights for CISOs, security teams and security-conscious devs begins with a reminder that 17 October is another date to mark in your calendar if you have a security role in an organisation providing critical services within the EU.

That’s the deadline by which member states must transpose the Network and Information Security (NIS) 2 Directive into national law. We’ve compiled 

10 need-to-know facts for organisations that might be affected

, which is designed to achieve “a high common level of security of network and information systems across the Union” more effectively than its 2016 predecessor, NIS 1. Or for a more in-depth explainer of NIS 2 and the implications for your SecOps strategy 

In this roundup (originally published as a LinkedIn newsletter called 

) we’d also like to flag the (fairly) recent publication of 

Gartner’s latest Hype Cycle for Security Operations

assess the maturity and value of a given security innovation

, whether it’s cyber AI assistants or pentesting-as-a-service, and their capability to adopt it. 🛠️ 

The Hype Cycle (to which no technology is seemingly immune) is visualised on two axes – mapping rising, falling then stabilising expectations of a given technology over time as reality outruns hype. The cycle always runs through five phases: innovation trigger, peak of inflated expectations, trough of disillusionment, slope of enlightenment, and plateau of productivity. It’s an interesting and valuable read from an independent, data-driven and respected market research firm. 📈

, widely considered to be one of the most talented and effective ethical hackers in the world. 👇 Nagli was speaking during his participation at our 

 recently shared his thoughts on the impressive 

 podcast, with Fredrick Lee joining co-hosts David Spark and Andy Ellis for the latest, beautifully-named episode, ‘

I Said I Was Technically a CISO, Not a Technical CISO

’ (they have form for great titles, with the previous instalment called ‘

Everyone Has a Zero-Trust Plan Until They Get Punched in the Face

Among other CISO-focused content we’ve browsed this week, notable highlights include a

interview with Sailaja Kotra-Turner, CISO and director of global infrastructure at

 (owner of Jack Daniel’s whiskey 🥃), and a piece exploring 

, for which journalist Sam Birchall spoke to a CISO and cyber firm CEO. 🤝

The continuing rise in the volume of new vulnerabilities is unsurprising, we admit – but we’ll flag it anyway! A 

 reveals that the number of new CVEs rose 43% year-on-year between H1 2023 and H1 2024, continuing the inexorable surge that began in 2017. The report also investigates trends in state-sponsored activity, new threat actor groups and why 

 are being targeted at an accelerated rate. 🧐

 on another all-too-common “clash of interpretations surrounding who reported a flaw, when it was discovered, how severe it is, and whether the resulting patch is adequate”, when it comes to coordinated vulnerability disclosure. This particular episode pertains to a ‘spoofing’ flaw fixed as a “defence-in-depth” issue in Trident, 

’s proprietary browser engine for Internet Explorer, which Trend Micro’s Zero Day Initiative (ZDI) team claims was an RCE that warranted a higher CVSS. 🔒

Other new content in our wheelhouse that might be worth a peek is a 

Inside the ‘three billion people’ data breach

Troy Hunt, founder of data breach notification site 

 and Microsoft regional director, has documented 

’, his blog post centres on National Public Data, “a data aggregator most people had never heard of where a 'threat actor' has published various partial sets of data with no clear way to attribute it back to the source. And they're already the subject of a class action”. The vendor is apparently claiming that 

 1.3 million people were affected, although Hunt discovered 134 million unique email addresses in the related data dump – which would amount to around 100 emails per individual if both of these numbers are accurate, 

We’re super-excited to break new ground next month when we run Italy’s 

 in Rome on 28 September. The identity of the organisation involved will, as usual, be kept under wraps until the event is about to begin. Learn about the 

Just in case you happen to be in the countries in question at the time, YesWeHack will also be showcasing our vulnerability management solutions at 

, (Nuremburg, Germany; 22-24 October). 📅🌍

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

object relational mapper (ORM) leak vulnerabilities

 by Elttam kicks off our latest roundup of InfoSec news and hacking writeups.

ORM leak flaws apparently occur when ORMs fail to validate user inputs, potentially resulting in the exposure of sensitive data. 💻 

 of Elttam’s research – described as “super-interesting” with “tons of potential for further research” 

 – focuses on the Django ORM and relational filtering attacks. 

, “a beautiful example of abusing framework features to make timing attacks that work in the wild”. 🔥

, meaning moderators have deemed the research truly novel in the realm of web security. 🚀

The same applies to Doyensec research that discovered that cross-site request forgery (CSRF) remains a viable vector in today’s applications despite browsers having been considerably hardened against CSRF (notably through 

). 🧐 The vulnerability research firm successfully 

client side path-traversal “to resuscitate CSRF

 for the joy of all pentesters” and unearth vulnerabilities in major web messaging applications, 

wrote Doyensec researcher Maxence Schmitt

. The research is documented more extensively in a whitepaper and has spawned a 

 “that provides advanced capabilities and automation for finding and exploiting Client-Side Path Traversal”. 👌

Other groundbreaking research to satisfy the exacting criteria of r/websecurityresearch recently includes: 

extending browser extension messaging chains with native messaging to achieve ‘universal code execution’

; Doyensec’s Viktor Chuchurski on how inadequate concurrency control in databases can 

“that is often overlooked by pentesters”, 

Assetnote co-founder and CTO Shubham Shah, meanwhile, 

 to be “one of the most critical exploit chains in the history of @assetnote”, no less. 😮 The researcher in question praised ServiceNow’s security team as being “excellent to work with” in securing the more than 40,000 potentially affected instances.

 writeup from 15-year old (!!!) researcher 

, specifically leading ‘from PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE’; PortSwigger’s Zakhar Fedotkin showing “

abuses widget annotations to create render discrepancies

, and share the code so you can generate your own”; Sonar’s Stefan Schiller on the value of

 when serving HTML documents to reduce the risk of XXS bugs; and ‘

how we discovered the AWS Organization ID for any AWS Account

’ from the CTO and co-founder of Tracebit. 😎

Over in LLM world, a former Apple engineer has 

 “an almost complete lack of bug reporting infrastructure from the LLM providers” after documenting his efforts to report a delirium-inducing prompt that he dubbed “LLM kryptonite”. 🦸 In a 

, Mark Pesce had recounted how he had induced “every chatbot I could access” bar Anthropic’s Claude 3 Sonnet into descending into a “

, LLM vendors came under fire for apparently declining to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”. 😲

As well as hosting a live Bug Bounty with L’Oreal 💄 (see the highlights video below or 

), YesWeHack had a booth at leHACK in Paris last month and can relay some interesting insights from the conference track at France’s biggest hacker con.

 and thinker on InfoSec, cyber warfare and internet privacy, was reassuring on the topic of 

resisting manipulation by AI and malign online actors

If humans seem increasingly helpless to resist their minds being 'hacked' by ever-more sophisticated algorithms, then who better to show how to fight back than the human hackers? 

Schwartau said a cybersecurity mindset could inoculate us against the algorithmic manipulations that keep us scrolling, clicking and feeling negative emotions – anger, disgust – that most effectively drive social media ‘stickiness’. 

“Apply cybersecurity to it and there is hope,” he said. The speaker urged humanity to “take a pause” and engage in slow, deliberate and conscious 

. 🧠 He also recommended resources for building resilience against misinformation and disinformation, such as the 

. Schwartau also lamented how while the UK and EU have numerous studies or initiatives on countering misinformation, the US has none – the most recent, the Stanford Internet Observatory, had closed down. 😯

, a lock-picker extraordinaire, offered some fascinating insights into the vulnerabilities of physical locks. 🔒 

How many of the lessons he drew apply to digital security? “Always look for simple solutions to what look like complex problems” when vuln hunting for instance. “Clever does not mean secure,” is another. The author of a 

 bemoaned a “lack of imagination by design engineers and red teams”. 🧐

Tobias played several videos of himself and others 

defeating high security locks within minutes or even seconds

defeating a Kryptonite bike lock with a ballpoint pen

. Tobias has also featured on an NBC Today segment on lock-picking in 2009, as you can see below. 👇 

 warned that only a ‘response in kind’ could adequately tackle the threat of 

machine learning supercharging malware development and distribution

. The former assistant professor of computer science at the US Air Force Academy noted that VirusTotal reports a daily submission of two million malware samples, around one million of which are unique – a challenge traditional detection mechanisms are hopelessly ill-equipped to address. 

Sonywa demoed a research project that used machine learning “to provide enhanced classification of an entire 200+ gigabyte-malware family corpus consisting of 80K+ unique malware samples and 70+ unique malware families.” 👏

prevalence, usefulness and drawbacks of neuro-divergence in InfoSec

. In ‘a praise to laziness (or why hackers are awesome people)’, 

 said laziness had motivated inventions as significant as washing machines, balance bikes and neural networks. The pen tester-turned-hacker, who has ADHD, admitted being too ready to abandon promising projects when he reached seeming dead ends, but said his low tolerance for boredom has driven him to create tools to automate the most tedious tasks. 🧐

We also have some new hacking resources to announce… Our newest addition to our Dojo platform, for instance, is the second of four new WAF bypassmodules, this time focused on 

Our latest technical guide, meanwhile, centres on 

white-box penetration testing with Xdebug

, specifically explaining how to: configure a PHP web application within a docker environment; set up Xdebug; detect PHP vulnerabilities using this PHP debugger; and create custom payloads to deploy in black-box engagements.

Kudos also to the winners of our latest monthly CTF challenge, 

, which involved exploiting an XXE vulnerability.

 of our Bug Bounty leaderboard. 👏 Check out our video interview with Xel from last year. 👇 As for the 

 is top of the pile (and the all-time leader), followed by 

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

The first three stories in our monthly CISOs roundup (first published in our 

 newsletter) are all related to risks posed by society’s hyper-reliance on relatively few digital systems.

Securities and Exchange Commission (SEC) lawsuit brought against SolarWinds

 and its CISO in relation to the Sunburst cyber-attack. The far-reaching impact of that 2020 incident shows why security failures are increasingly treated with similar seriousness to, say, health and safety scandals.

The Sunburst attack, to remind readers, was a highly sophisticated software supply chain attack that resulted in the compromise of 18,000 customers, including Cisco, Microsoft and the US government, via a vulnerability in a SolarWinds component.

“CISOs have little reason to celebrate” the dismissal recently of all but one of the charges brought against the Texas-based firm over the incident, 

. That’s because the remaining charge – securities fraud – is the most serious. 

Reassuringly for CISOs, Brian Levine, a former federal prosecutor, told CSO Online that the SEC was unaccustomed to having its charges thrown out, and speculated that they might be more circumspect about launching similar lawsuits in future. Given the remaining charge relates to security claims made prior to the attack, he also suggested CISOs should think twice about making public statements about their security, especially when “you don’t get much credit for making them” anyway.

Meanwhile, in the InfoSec world beyond YesWeHack, the 

 was not technically a security failure, but the worst-ever global IT outage involves a security vendor and offers salutary lessons about a security fundamental: risk mitigation.

First, to return to our central thread, there's the risk of everyone, everywhere relying on the same few applications for critical functions. CrowdStrike itself accounts for 24% of the endpoint protection market. Ironically, a CrowdStrike executive 

 (before the outage) of the risk of using a “single provider for operating system, cloud, productivity, email, chat, collaboration, video conferencing, browser, identity, generative AI, and increasingly security as well”.

Responding to the crisis that erupted last month, Kevin Beaumont, a well-regarded security researcher, wrote that “CrowdStrike overall reacted really well”, but said “the incident highlights a bunch of wider concerns”.

 about the incident, Beaumont advised organisations to demand that their vendors: “Provide more transparency about how endpoint security updates are tested and rolled back”; disclose “potentially risky interactions with the Windows kernel, and develop a roadmap to safer drivers”; be more transparent about their own security; “disclose, in advance, if they are subject to national security laws” that could compel them to “allow access to customer data”; and publish a post-mortem for bad updates “with full transparency explaining what happened, why it happened, and steps taken to remediate”. 🧐

 at least showed there is a viable, analogue Plan B to ensure (partial) business continuity during digital meltdowns (always have a pen to hand!). 

Many experts are also concerned at the pace at which Large Language Models (LLMs) are being built into applications performing all manner of tasks. In light of their growing ubiquity, it’s alarming that a tech expert managed to induce “every chatbot I could access” – with the sole exception of Anthropic's Claude 3 Sonnet – into descending into a “

” with a prompt that he dubbed “LLM kryptonite”. 🤪

 (see video below), his prompt was too dangerous to expose to prying eyes. And yet, Mark Pesce, a VR innovator and ex-Apple engineer, encountered “an almost complete lack of bug reporting infrastructure from the LLM providers”, according to a piece he 

, Pesce said Microsoft had deemed that the bug “does not meet the definition of a security vulnerability”, and noted how some LLM vendors apparently failed to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”.

, purveyor of high quality web security research, has recently recommended 

 when serving HTML documents to reduce the risk of XXS bugs, and detailed 

, a popular open-source solution for hosting and managing source code, together with advice on protecting instances.

Other notable writeups includes a Phylum analysis of North Korean threat actors 

, and an Evasec investigation of vulnerabilities in the 

dependency manager that allows malicious actors to claim ownership of thousands of unclaimed pods and insert malicious code into 

Novel attack techniques that combine vulnerabilities found in dozens of 

are allowing threat actors to spoof emails from more than 20 million domains of trusted organisations, according to 

 ahead of its presentation at Black Hat USA next week.

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Europe’s most successful ethical hackers and an iconic luxury fashion house proved an irresistible combination for our most glamorous Live Bug Bounty yet.

From the Paris headquarters of Louis Vuitton, around 40 high-ranking hunters deployed their eclectic skills to produce an impressive variety of findings at the second edition of YesWeHack’s ‘Hack Me I'm Famous’.

Louis Vuitton has declared itself delighted with the results – a reflection of the calibre of the hunters, the time (30 hours) and productive setting for hunting, and the target’s commitment to making its internet-facing applications as secure as possible.

YesWeHack keeps Live Bug Bounty targets under wraps until the last-possible moment. This prevents hunters performing pre-event reconnaissance on the targets to get a head start.

On day one, the hunters were kitted out in stylish, baseball-style jackets customised with their hacker alias, before being led to the mystery venue. En route, some excitedly speculated, aided by Google Maps, which nearby organisation might be welcoming them. A famous company? A government agency?

It was no anticlimax when Louis Vuitton’s impressive headquarters heaved into view.

Founded in 1854, Louis Vuitton’s clothing, bags, jewellery, perfume and other fashion items are instantly recognisable worldwide via its iconic LV monogram. The haute couture pioneer is part of LVMH group, the world’s largest luxury fashion multinational.

If the Live Bug Bounty target excels in its field, then so too do the hunters carefully handpicked for the occasion. Ten of YesWeHack’s all-time top 25 performers were enlisted, although hunters were chosen not just for their leaderboard ranking, but also for the relevance of their skillset to the scopes at hand.

Louis Vuitton was a tantalising target – and not only because of the lustre of the brand itself.

Unusually in its industry (and most industries), Louis Vuitton develops most of its digital assets internally. Adding to the anticipation for the Live Bug Bounty was an API among the scopes that had not been part of the private Bug Bounty Program.

Partly thanks to some participants’ familiarity with the scopes via the private program, the reports started rolling in relatively early. Vulnerabilities were surfaced throughout, with the final report submitted in the last few seconds of the competition.

Just 30 minutes later the Louis Vuitton team had, with YesWeHack’s support, reproduced and assessed all vulnerabilities.

The hackers seemed particularly laser-focused as they hacked for 30 hours with infrequent breaks for food, socialising and sleep.

And yet, they were still happy to take time out to patiently explain their findings to Louis Vuitton security teams during their event. There were also ‘show and tell’ presentations of the most significant vulnerabilities at the end.

News

Web timing attacks, Apache HTTP confusion attacks, email parsing discrepancies – ethical hacker news roundup

NIS 2 in brief, security tech hype cycle, Italy’s first ever live Bug Bounty – OffSec roundup for CISOs

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

L'Oréal lauds live Bug Bounty success at LeHack 2024

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

Critical infrastructure-level protections for YesWeHack cloud after switch to SecNumCloud-qualified service

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

YesWeHack raises 26 million euros to accelerate its growth and international expansion

Bug Bounty hunters mount impressive sprint finish to Caisse des Dépôts marathon

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

Produits

Chercheurs

Ressources

A propos

Suivez-nous