Bug bounty program

And today we're joined by Tommy DeVoss, also known as doggyg.

Tommy is a bug bounty hunter who's here to share some war stories with us, and maybe talk about AI, and also possibly some cats.

Tommy-

[laughs]

I'm not really a big fan of most salespeople, though.

Like, when you actually have a job and you work for a company ...

Like, I spent so long as a bug bounty hunter, I didn't really care, uh, how people took what I had to say or anything.

I just didn't care-

this? So, because I think about this a lot.

So the first thing to remember is that crypto and crypto bug bounties are fundamentally different beasts than sort of the regular world and security and bug bounties.

250k, for reference, is also like at the top end of like Google's bug bounty program.

And there was like a really amazing... bug bounty that someone got from Google, or I think a full remote code execution series in Chrome, meaning you could basically like have, you could go and it's a good one.

It's totally

possible.

And, you know, I've dealt with this because I've dealt with teams that have sort of, let's say, out of date bug bounties, right? Where like they were operating as a little team and then they raised money, didn't ICO, had, you know, let's say 100 million TBL, right? And then they got a disclosure, but their max bug bounty payout like on paper was 5K or like even like a mug.

Right.

If you haven't paid attention to any of the developments of, like, vibe coding and stuff, um, there is a crazy landscape out there right now for, uh, modding and, uh, jailbreaking, uh, stuff right now.

So for example, the Google Bug Bounty, uh, oh, I didn't include this, but Go- Google Bug Bounty, which is, um, [keyboard clicking] you, if you find Google Bug Hunters, I guess, uh, it's called.

So basically they, like, straight up, "Okay, we don't...

Please stop.

Everyone pause, please," because you can get some money out of Google if you find, like, bugs and stuff.

So but they are, like, so overwhelmed right now with, like, uh, all the AI, uh, Bug Bounty AI program.

So they are completely buried in everything.

And, and yeah, people are coding with A- AI vibe coding basically, and jailbreaking everything, including the PS5.

Welcome to Cyber Byte, your weekly dose in the latest in cybersecurity news.

I'm your host, Dat Wing Kwan, and today we have Aesop's customer notification system being abused to send a random demand directly to thousands of users? Google temporarily suspending part of its open-source bug bounty program after being overwhelmed by largely invalid AI-generated reports, and the Wikimedia Foundation saying unauthorized open AI agents made edits on their Wiki pages.

Let's get started.

We'll start with Aesop.

...

I love about the pod is that we get to, like, just catch up with, with people every once in a while, and as I'm sitting here reflecting on the current state of bug bounty, I'm thinking, "Man, I need some OG perspective here." Um, so who do I turn to but Frans Rosen himself, uh, to provide that? Um, so let's, let's, we got a couple items here on the docket, but, um, first I'd like to just get a little, uh, update from you as far as, like, how bug bounty stuff is going and, um, the full-time life right now.

Because a lot of, what a lot of us are facing right now is a disconnection from our bugs and a general dissatisfaction with bug bounty, despite some of the best results we've seen in years.

Yeah.

Um, and I know that in the past you have not been using AI as strongly as some of-

Yeah.

Uh, I mean, and it's, it's super fascinating.

And, and to be honest, like, I've, I've taken this year, uh, like, early this year, I took, I took, like, a full break from bug bounty-

是。不过呢 AI 呢-

没有的了，我想这些，这些，就是这些 bug bounty 的 program 呢，应该，应该渐渐会没有的了。

嗯。哇，AI 在这个 open source 界呢，就是现在是好积极啦，那么也都好多朋友呢，好 creative 呢，就用 AI 的，的强大威力呢，去帮忙去做一些 open source 的 apps 出来的。那么啦，不过呢，都有些争议的这件事，啊，真的，嗯......呐，有些人呢，就觉得，哇，棒啊，好正义啊这件事，这样 [笑声]，那么在讲什么呢？在讲-

就好像罗宾汉这样。

I'm Sarah Lane.

Google pauses open source bug bounties amid AI spam.

Google temporarily stopped accepting product vulnerability reports for its open source software vulnerability rewards program after a surge of automated submissions, many of them invalid.

program covers google maintained projects like go angular and fuchsia along with critical third-party dependencies supply chain reports and reports submitted before october 1st aren't affected you can still submit fixes through patch rewards or report qualifying google cloud issues through cloud vrp before a planned update of the whole program in the first quarter of next year