good afternoon hello
hi
so
i'm not even going to try and pronounce
your name
let me do it for you
yes please please perfect my name is
evagenia
you have gained yeah perfect yes
fantastic
well you have genia welcome to bearcon
three
um
a double welcome um because you've also
been a sponsor for the organization
so you have genia works for
or is the ceo of hackenproof
and she's joined us today to talk about
the wonderful world of bug bounties and
the impact the profound impact that that
can have on an individual's career
so if you're ready
then the floor is
yours let me show you my screenplay
please
yeah it should be okay now
uh can you see it just to confirm
yeah we can see that perfect
my name is evgenia i'm a ceo of back
bounty platform which we started four
years ago
now we work mostly on the fintech
industry especially crypto and work with
top
industry players like different
exchanges like uptakes different
protocols avalanche switching and others
our community of political hikers now
more than
6000 hackers what hit hackers
and yeah i started my career in cyber
security like i don't remember like nine
years ago
and created a lot of local chapters like
of defcon of us different conferences
and cyber security for cyber security
focus for students
and doing a lot of work to educate local
community here and involve more and more
people into back bounties
and today i want to tell you more about
uh what the benefit of bug bounty
hunting what the what is it and how it
actually can help your back bouncy
career
so
let's start from the beginning
um probably a lot of us know the problem
that when you are
new in the industry or just a student
it's a problem when they you need to get
experience in order to get job and uh
in order to get experience you need to
get the job and the problem is it's like
a circle and for newcomers it's
definitely difficult to
enter this here
and getting some experience experience
which will count it like a
in your resume before going to any job
so
how how to start that and how backbones
actually
could be helpful here
so all of us
can participate in this world of black
bounties because it's open to anyone
like the student to developers to just
you know fans of crypto which where
we're working actively
and how it can be helpful you can
first of course you can find
vulnerabilities because like bug
bounties are open to everyone you see
this skull you see what's like which
vulnerabilities companies are looking
for and you can actually test your
skills there and it's like legal
so it's first also what you can do and
how bad balance he can be helpful here
is about like writing reports because by
writing reports you understand how these
vulnerability reports and what's needed
for like companies uh is fermented and
for example
while someone found a vulnerability in a
in a program what they do they go with
their like validation steps like
description of the vulnerability they
also determine the severity by cbss and
they also
choose the category of the vulnerability
which is by cwe and like proof of
concept so general it's like description
of the vulnerability and how it could be
prepared in other in the other part
of the uh probable laptop it could be
understandable
also for bank bounties definitely
there's quite a few tools that can help
you to find vulnerabilities to make your
process of getting this vulnerabilities
easier and faster
and definitely test a lot of different
scenarios about looking for
vulnerabilities and working with a lot
of different companies because while
you're back bounty hunter like
thousands of different programs are open
to you and you can interact with a lot
of companies and they actually inviting
hackers to cooperate with them they
asking for their help and that's pretty
cool because you know when you're
knocking the door where no one is
waiting for you it's not good and it's
uh kind of prohibited in back bounties
and in general in security when you are
doing some testing without any
authorization but in black bounty you
have this authorization and you can work
with different companies because they
ask you to do that
so um
what about
black bounty platforms and
how they actually help you
there are quite a few bug bounty
platforms on the market where you can
test your skills and actual background
platforms this kind of mediator that
help helps hackers to communicate with
companies in the proper way because from
both parties there could be some issues
and definitely that's not what you want
when you're just starting it's better to
use some platforms which help you to
communicate and in this communication
you can definitely
find the way how how to do it in the
proper way
so in the back bounties you
work with real issues with real products
with real businesses and it's good to
get experience because a lot of our
hunters for example they mention this
backbone experience just on their
linkedins and their cvs and it's good
because when you see that the person
doing like background is for two three
years
that sounds a lot because definitely
he knows what he do because like
spending two three years for bounties
that's quite a lot
and if you do that properly and you have
like proper uh like ranks hall of fames
like write-ups whatever that's
definitely influence a lot to when you
are looking for a job
and also what is good about bug bounties
and these like just countries
communities that they are creating
common tools that they are sharing for
putting them on github and you can use
a lot of stuff which is already
open sourced and you can use that to
find vulnerabilities
and
definitely what is also cool about bug
bounty community that a lot of people
just sharing what they found there is in
some platform that you have this um kind
of open stream of reports disclosed
reports where you can see all these uh
scenarios that hackers are testing the
tool they are using like some some
specific stuff about testing
so it's kind of open community where you
can get a lot just you just need your
curiosity and willingness actually to do
that
um
so
mostly but bounty is about uh
of course except like doing research
like testing new tools and approaches
it's a good playground because you have
like thousands of domain names thousands
of applications where you can test your
new tools and it's illegal
and also you can build different case
studies based on different industries
because you can work with banks airlines
e-commerces crypto exchanges
like some hardware and stuff and it's
pretty cool because you have so many
different experiences and needless to
see them like applications that you can
work with
that's pretty cool because you don't
need to go for like for to work for some
airline actually to be able to test the
application and it's cool because you
can apply your knowledge there in the
back bounty and
and get some profit some knowledge and
experience
um in most cases by our experience
hackers
can train their attention during bug
bounties because
all black bounty programs has pretty
clear scope where they mention which
applications domain names ib addresses
whatever uh company wants to test and
which they
don't want to test
for example there are a lot of cases uh
just because of um
really low
attention level that hikers look
vulnerability is not at the right end
points and report something that's out
of school
because in every policy or we have
in-school vulnerabilities and outscore
vulnerabilities because not for all
vulnerabilities companies are willing to
pay they they are willing to pay for the
um
programs and for like for
vulnerabilities where
they they see the impacts about that and
it that's pretty important because you
can spend a lot of time and then just
because uh of low level of attention you
understand that you test it's not not
that end point and this endpoint is out
of scope
and also it's very important to follow
the program updates because in some
cases by our experience as well when um
when someone found a lot of
vulnerabilities in one endpoint they
usually uh put this uh endpoint out of
slope to be able to fix to fix
everything and then uh put it uh back to
in school so in most cases back bound is
about attention test as well because you
need to follow just rules because when
you're going
side back you can get into trouble
because it's also about legal stuff
because testing something
is you should uh have like
approval for that for example when we do
pen tests we all time we get approval
for doing this intrusion work because
it's it's illegal if you don't have it
and by our statistics uh for the last
four years uh they were found like
around 1000 vulnerabilities
and the average price vulnerability is
around 500
and that's pretty cool because you can
spend like minutes or hours and get to
get this money uh of course if you
if you're experienced enough but in
order to get experience you also can do
that we have a lot of cases when just
newcomers because of their you know
another way of thinking they found
vulnerabilities and get their first
money on back bounty not because they
have like pretty cool technical skills
because bug bounties is also about
testing business logic which is really
important it's about different access
controls about different like just
different access and different workflows
how it works when you're using some
application and see that something is
not going well or something is varied
you probably can test that
and see if the company
has the bug bounty and report it if if
something about security security issues
because um although um you can you can
do the back bounty you know like your
job but sometimes you're just using some
obligations for music for video or
whatever and you see something something
wrong because your
your hacker mind uh tells you that
something something could be wrong here
and i can see what's wrong and test it
but before it's there to check if they
have bug bounty and if they are willing
actually to accept your report
and then another interesting thing that
bug bounties is a part of that but
generally like vulnerability disclosure
industry is is like bigger and you can
not only look for bug bounty but also
for vulnerability disclosure policy for
security text on the websites
uh and trying to see if the company
actually
used some best practices about working
with hackers and being transparent in
this market
um
so what's behind these bounties and
what you actually can get with um
with doing bug bounties
so uh definitely you can
develop
some research tools
which can be used in in other cases i
can tell you a story here one of our
hackers he started like a qe engineer
and
he switched to like more biology
and from that point he was curious about
about security vulnerabilities he
started to work inside that industry uh
in some like um security consulting
company
and started to do but bounty
he'd done i guess like couple of years
he have made like millions
on like mobile vulnerabilities
with his scanner
and
he
now he's doing the startup where he uses
this scanner to help other hackers
actually to find vulnerabilities to
report them and to
like to get bounty to get more knowledge
from that and also he uh he's suggesting
his scanner to enterprises
where he found vulnerabilities before
and
yeah trying to help them to automate
make this process more automatic and
yeah security more robust
so a lot of
a lot of guys actually
sometimes lack of motivation to do bug
bounty because um because
you know when you are not funding
vulnerabilities for a long time that's
definitely the motivation but
uh once you've found something cool you
can like you can find more and more like
every time
and also what's cool about that that you
can learn every time so for example a
lot of hackers just do um
mobile or web
back hunting but now in the market there
is more and more like crypto programs
which is smart contracts blockchain
protocols and other stuff and it's where
you can like enhance your knowledge and
go deeper in the this stack of
technologies and understand more because
the competition there is a defense
little lower than anything like
classical backbones but with the web and
the mobile
um and also what we see uh we heard a
lot of stories from our hackers that
they started with bug bounties doing it
like for a couple of years and then they
just
applied to facebook or twitter or like
some huge companies or tik tok and they
work now as they are
application security engineers or even
triage guys which means that
before they they
were on the other side of the screen
submitting this box and now they are
helping company to actually validate all
these vulnerabilities from hackers and
it's pretty cool because definitely this
industry is quite new but still there
are a lot of opportunities and when you
have this relevant experience you can
apply to
companies where they already implemented
approach and by gartner predictions it
would be like more than 50 percent of
enterprises which is going to use
backbone in the coming years so now it's
like around i don't remember but this
like two three percent just just 2
percent when you're starting this
approach with this crowdsourcing
approach to security definitely
in couple of years you can find more and
more job and actually get your first
experience with that because it's just
about your desire to do
um yeah so we just gathered some
some links for developers and for
beginners actually how they switched
how they can switch to security and
where they can try their skills it's
also about the theoretical knowledge and
also some about a vulnerable
lapse way you can try your skills
and
yeah i will share this presentation
afterwards to to be able to go through
that
so uh also
we we gathered some information
regarding podcasts where you can listen
and do some challenges and other stuff
where you can go deep into this industry
understand what's going on which
programs which tools which like
educational platforms you can use and uh
yeah just go deeper in the sphere and
understand what's going on
yes this this is about uh tools and labs
where you can actually apply your
knowledge and test it i'm pretty sure
you heard about a lot of them we just
make short conclusion of um
what what we use how our hackers work
what they recommend and uh yeah you're
welcome to test all that stuff
uh yes so
um we're actually developing our
community of hackers and working on
different academies and educational
materials how to involve more engineers
into back hunting and security testing
so you're always welcome to join our
community and also for all
beer lovers we are
doing the network party in lisbon
during the summit so if anyone there
just join us we'll be happy
to meet you all in person
yep i i'm done i'd be happy to answer
your questions
thank you very much thank you very much
gone here
really good really interesting hopefully
it's
um got the attention of people that are
interested in the bug bounty environment
and that community so wonderful um have
we got any questions yes yeah we do all
right so the question here from nolly
is
how do you guide young people who rock
up arrive expecting to make
a real big payday
from the start
um so definitely when you are starting
you you should
work more on your reputation on your
statistics work with different programs
and get you know some experience because
everyone is looking for experienced
hackers but definitely for open and
public programs everyone can participate
and get their first hall of fames ranks
and other stuff so
just start and and to look for
vulnerabilities
so yeah i i have a question so how do
you approach
the
bug bounty community from the
perspective of sort of educating them on
what's important you know because
i get hit up every couple of weeks from
so-called
you has bug bounty people um and they're
gonna say something like your website
supports um
insecure cipher suite please pay me 250
us dollars yeah oh missing headers or
some
settings yeah we know that
i get it all the time yeah definitely
it's a problem of the industry i would
say
it's it's more about you know
um educating community in the way we can
do other platforms or other engineers
but if you want to get real results you
definitely won't do that i guess
it doesn't work on the other side of the
screen there is still guys who who knows
what they do and all this
emails doesn't make sense it's just a
waste of time for both parties honestly
in most cases uh by our experience we
received so many of them like 98 i would
say was useless
only like two percent was by emails
because usually they are trying like
missing headers or spfs or something
that they can usually try with scanners
it doesn't work everyone can run a
scanner and the importance of bug bounty
in the hacker brain because that's the
business logic vulnerabilities are the
most interesting when you can go deeper
into in the products and technology
understand how it works and find
something how to bypass it like usually
just use your hack your mind to find the
backdoor not run a scanner like everyone
can run a scanner it's it's not what may
like brings you money
i i have another question and and it's
sort of a bit of a pivot i'm not aware
of any particularly
good scanners for mobile applications
so i'm wondering is that an emerging
space then in the bug bounty community
and if it is how do we reconcile a app
that has vulnerabilities versus the
android or even that other company that
rhymes with apple
um
in terms of like
please yeah yeah yeah okay good
so uh the heart current management uh he
is top one on the google back bounty
program and he has his own scanner which
is mobile application scanner
that's how he found all this
vulnerabilities and now he's moving to
enterprise it's called over secured he
has the like android and i got scanning
and they're like a lot of top
enterprises who works with him
cool so i guess the follow-up to that is
is i wanted to differentiate between
finding a bug bounty in a app
versus finding a vulnerability in an
underlying operating system i mean
clearly you do both
but i guess what is the ones that are
paying out more is it an app that is you
know 300 000 installations or is it um
a operating system level
vulnerability definitely different
spheres and different specialists and
skills that you need
and suppose both fears are good
interesting but of course more is where
more like harm for the users and the
like level of enterprise and other stuff
because like for zero days they can like
pay millions and the other interesting
stuff that's millions of course in this
top
giants but in in crypto now that's
that's insane because for finding
vulnerabilities my contract it can give
you millions just recent like last week
it was like 10 million or something but
bounty for smart contract vulnerability
because in this smart contract they they
hold like a lot of money billions and of
course they they are willing to pay for
vulnerabilities because in other way
they just lose money in their users
but it's you know it's pretty specific
sphere you should have specific
knowledge but it's really emerging there
is so many companies and so few hackers
who can do that
so it's really good one of the things
where to invest your time and
knowledge right now
scott
i wasn't going to speak but it looks as
if we're all super excited to ask you
loads of questions yeah mike
yeah
sean
thank you
thank you mark um so i have a question
doing bug bounties can be really
frustrating i imagine um especially for
those beginning now if they're not going
to find something and how do you or what
sort of advice do you
want to give out in terms of trying to
get people staying motivated so they can
just keep at it and hopefully find
something that pays off eventually yeah
definitely there is like a really
frustrating when you can't find like
something for some time
but it's also you know it's uh work on
like each person and uh what we do we're
trying to you know motivate to find more
vulnerabilities and you know hub hacker
is doing some educational stuff
doing some like joint hacking um
into different programs so
it's it's okay you should just accept it
you can't find vulnerabilities all the
time because probably it's it's not
about you it's about just very good
security of this application or because
like southern hackers already checked
that of course this security level is
higher
just uh switch a program switch
attention just go relax i know doing
something and then go back to that and
do what you love
cool great
and my question was
my observation i think and question
is one of the things i really love about
bug bounties and the bug bounty programs
is this idea that it incentivizes
hackers
in a positive way
so rather than them become criminal
and hack and hold companies are ransom
and all that kind of stuff
they hack through ethical channels using
recognized platforms or just directly
with the organization um
but not missing headers
and
but the idea is that it moves people
away from a criminal
direction and into a completely
legitimate direction so in your
experience are you seeing that being the
driver and the and the motivator for
people to do it the honest way
yes definitely especially encrypt
because you can steal a lot of money but
the problem is you can't withdraw them
easily and you should go through bug
bounties you have no other way because
if you hack some money and it would be
blocked on all exchanges and another
stuff of course you can find some ways
but it it won't get you you know legal
money uh you will be definitely tracked
and uh
you never know what's happened after
that so definitely we see positive
change because while the companies are
adopting back bounties more hikers and
more just engineers see that and can
legally participate because they're just
using some application and found
vulnerabilities what they should do with
that of course they can just leave it
and don't do
like anything with that
but
if you can get money of it and it's
legal and you see the the company is
actually open to receive vulnerabilities
why not to do that in the legal way and
definitely like bouncy started um like
around eight years ago and definitely
like positive change into this ethical
way of hacking
and working with hackers because for a
lot of people hackers you know we just
you know someone in black hoodies and
really criminals and very dangerous
person but in fact it's not just curious
programmers curious guys who wants to
help but probably help themselves not
the company
because there is no legal ways how to
help these companies and this this
problem is definitely um evolving and
yeah more companies trying to do that
yeah perfect okay well i think we're out
of questions
um
so i'd just like to thank you again
we've had some
again like with all the other speakers
we've had some wonderful feedback in the
twitch chat
so
thank you for participating we really
appreciate it thank you for inviting
wish you luck was all the other day