A US space launch is a very high-security affair. Systems are locked down, many of the staff hold national security clearance, and the rocket and its payload are carefully protected.

But when SpaceX launched its CRS-28 resupply mission to the International Space Station (ISS) in June, it did so carrying a special satellite that the US military was actively encouraging people to hack.

Run by the US Space Force, Hack-a-Sat was essentially a game of Capture the Flag. Organizers tasked ethical hackers with flexing their skills to break into a satellite and discover a special code, in a race against four other competing teams. The military hopes that this will also help raise awareness around cyber threats to space hardware.

The diminutive 34 x 11 x 11cm “cube” satellite is named Moonlighter and was deployed into low Earth orbit after about a month aboard the ISS, and was the target in this year’s Hack-A-Sat competition.

The event brings skilled cyber enthusiasts together to build enthusiasm for careers in the sector and specifically attract raw talent to the field of cyber security for vital communications satellites.

The event brings skilled cyber enthusiasts together to build enthusiasm for careers in the sector and specifically attract raw talent to the field of cyber security for vital communications satellites. This could help protect government assets from a new generation of threat actors, and address the ongoing cyber skills deficit.

“They started to go and ask all the different organizations within the government and military saying, ‘Hey, can you let these hackers, these top cybersecurity enthusiasts, go and hack into your systems?’, and their first response was, ‘Absolutely not. No way’,” says Captain Kevin Bernert, the Space Force’s Hack-A-Sat program manager.

But Captain Bernert’s team persisted. In the first few years, the competition was run on virtual machines (VMs) down on Earth, or actual space hardware planted firmly on the ground. This year, Moonlighter was actually put orbit where it patiently waited to be hacked.

It’s a real test for the competitors, as there are specific difficulties that we don’t need to deal with down on Earth. “With space vehicles orbiting the Earth at high speeds, you only have a certain amount of opportunities to make contact with that vehicle,” says Bernert. 

Hackers trying to send a command package, for example, might not know if it was successfully executed until the next time they can make contact. Other challenges include limited bandwidth and tricky power management. Hackers must be careful about how much energy their code uses on a device powered by only a solar panel.

Would-be attackers also need to take into account complex orbital mechanics to establish a connection with their target. Other aspects of the competition will be more familiar.

“It's still essentially a computer,” says Bernert. “You still have to apply all the cyber security principles. Now, it's just in a more rigorous domain.”

Cyber attack innovation

To communicate with the satellite in orbit, teams will use the same ground stations that are used for ordinary satellites. Moonlighter has been sandboxed so that even though the satellite is in space, nothing too dramatic can be compromised. 

“It works just like any other satellite would work in Low Earth Orbit,” says Bernert. “We don't have a propulsion system on it, so they won't be able to just send it off into deep space or into the Earth's atmosphere.” The satellite also has a built-in “reset” button that the military can use to restore the sandbox to a blank slate.

The competition is as realistic as possible and the organizers urge teams to pick members who have skills in the different disciplines such a complex hacking task requires, including radio communications, exploit development, satellite operations. and astrophysics.

Bernert is confident that by tapping into this “untraditional” pool of individuals, the task can be solved in innovative ways. But even with the right people, winning the competition will require an effective strategy.

“We let the competitors get creative with how they want to go about denying or degrading their competitors' satellites, but we also give them the opportunity to have game theory get involved,” says Bernert, describing how teams will have to choose between playing aggressively, to capture their opponents’ flags, or as in a real cyber-conflict, choosing to play more defensively to protect their own.

Even after the winners have been crowned and the Moonlighter satellite has been successfully compromised, the real-world stakes of the competition remain very much front of mind for those participating. Bernert’s hope, and that of Space Force, is that this can put threats to critical infrastructure in context.

“People are realising that it's not just limited to specific nations with large military budgets – it's becoming a lot more proliferated and more accessible to everybody,” he says. 

“With that, obviously, comes the need to make sure that systems that are now being procured and launched in rapid quantities are cyber secure, because so much of our lives for pretty much everybody across the globe is tied directly to safe satellite vehicle operations.”

OpenAI has unveiled a new bug bounty program offering rewards for security researchers if they can uncover vulnerabilities in its products. 

In an announcement on Tuesday, the California-based AI firm said the bug bounty scheme is “essential to our commitment to develop safe and advanced AI” and deliver services that are secure, reliable, and trustworthy. 

As part of the initiative, OpenAI said it will offer a tiered reward system based on the severity of bugs uncovered by researchers. 

Rewards can range from as little as $200 for low-severity flaws with a maximum reward of $20,000 for “exceptional discoveries”. 

“The OpenAI Bug Bounty Program is a way for us to recognize and reward the valuable insights of security researchers who contribute to keeping our technology and company secure,” the firm said in a statement. 

“We invite you to report vulnerabilities, bugs, or security flaws you discover in our systems. By sharing your findings, you will play a crucial role in making our technology safer for everyone.”

Researchers participating in the new initiative will be able to disclose vulnerabilities or flaws through a partner organisation, Bugcrowd.

Bugcrowd will manage the submission and reward process, which OpenAI said is designed to “ensure a streamlined experience for all participants”. 

ChatGPT vulnerability concerns

The move from OpenAI follows a period of unrest over security-related issues at the generative AI firm, which has close ties with Microsoft. 

Last month, the company revealed that a bug in ChatGPT led to a leak of users' data.

This flaw meant that ChatGPT Plus users began seeing user email addresses, subscriber names, payment addresses, and limited credit card information. 

The issue prompted the company to temporarily take the chatbot offline to work on a fix. 

“The bug was discovered in the Redis client open-source library, redis-py,” OpenAI explained in a post at the time. 

“As soon as we identified the bug, we reached out to the Redis maintainers with a patch to resolve the issue.”

A cyber attack on the Israel Institute of Technology has brought to light the emergence of a potentially aggressive new ransomware gang, DarkBit.

The institute, known as Technion, was struck by a ransomware attack over the weekend during which hackers demanded an 80-Bitcoin ransom, equivalent to around $1.7 million (£1.4 million).

In the ransomware note, the group threatened to raise the ransom sum by 30% if the academic institution failed to pay the ransom in a 48-hour period.

The ransomware note was also littered with anti-Israeli government rhetoric, suggesting that the attack was politically motivated.

Believed to be a hacktivist operation, the likelihood of a victim paying DarkBit and then later receiving the decryptor is generally lower since the attack isn't believed to be wholly motivated by money.

“We’re sorry to inform you that we had to hack Technion network completely and transfer 'all' data to our secure servers,” the note read.

“So, keep calm, take a breath and think about an apartheid regime that causes troubles here and there.”

Technion confirmed it was dealing with a security incident in a statement online on Sunday 12 February, adding that it was working to determine the full scale of exposure.

“The Technion is under cyber attack. The scope and nature of the attack are under investigation,” the statement read, “To carry out the process of collecting the information and handling it, we use the best experts in the field, in the Technion and outside, and coordinate with the authorities.”

While the exact scale of the attack is yet to be disclosed, the university said in a follow-up statement that campus activity, including exams, would not be affected.

Who are DarkBit?

DarkBit appears to be one of the newest ransomware groups to emerge in recent months.

The identity of the group remains unclear, but given the politically charged language in the ransomware note left over the weekend, the group could be the latest sophisticated ‘hacktivist’ group to land on the scene.

In its Twitter bio, the group claims to be against “racism, fascism and apartheid”.

Hacktivist groups have wrought havoc on organisations globally and the subcommunity within cyber security has received special attention since the war in Ukraine broke out.

Pro-Russian hacktivist group, Killnet, for example, has claimed responsibility for a number of devastating attacks against public services in Ukraine since the onset of the conflict in February last year.

Earlier this month, the group launched attacks against more than a dozen US hospitals amidst its ongoing reprisal campaign against nations supporting the Ukrainian war effort.

Bogdan ‘Bob’ Botezatu, director of threat analytics at Bitdefender, told IT Pro that while hacktivism is far from a new trend, recent geopolitical events have resulted in a surge of hacktivist-related incidents.

“Hacktivism is known as a type of hacking to support civil, political, or religious causes. It has become chiefly consecrated with the advent of the Anonymous hacking group and has become more and more frequently used in the past few years as hacking groups affiliated with state actors have entered the scene,” he said.

“In the past year alone, since the start of Russia’s invasion of Ukraine, several hacking groups have openly offered their cyber crime expertise to support Russia’s cause by hacking into companies in countries part of NATO or the EU.”

Chris Hauk, consumer privacy champion at Pixel Privacy, noted that DarkBit’s ransomware demand message also warned Technion to “be careful when you decide to fire your employees, especially the geek ones”.

This comment, Hauk noted, could suggest that the attack could have been the result of revenge from a disgruntled former employee.

Hauk’s suggestion follows similar comments by security researcher, Dominic Alvieri, who tweeted yesterday that the group has “gone from hacktivist, to ransomware group, now to a disgruntled former employee all in one day.”

A number of automotive manufacturers use systems containing vulnerabilities that could allow threat actors to hack cars, steal customer data, or complete full account takeovers, research has revealed.

Brands including Ferrari, BMW, Rolls Royce, Mercedes-Benz, Porsche, and Ford were found critically vulnerable to endpoint attacks, with flaws such as poorly-managed APIs and improper SSO configuration enabling lateral attacks and remote access to vehicles.

Researchers also found major flaws in the code used by telematics firm Spireon, which provides GPS services for more than 15 million vehicles.

Using an SQL injection attack, Curry and his team gained remote access to all Spireon devices, used commonly by emergency services vehicles, allowing them to view live locations and remotely execute code to unlock and start the engine of vehicles, for example.

Further endpoint investigation and manipulation revealed an admin dashboard with access to the system’s 1.2 million user accounts, as well as vehicle identification numbers (VINs) and fleet location data.

Vulnerabilities in Mercedes-Benz cars allowed for public registration on an associated vehicle repair website, and this account gave the researchers access to the Mercedes-Benz GitHub.

Attackers could use this as a launch pad for remote code execution, as well as access to internal Mercedes-Benz communications channels and Amazon Web Services (AWS) control panels.

The findings were the result of months of investigation by web application security researcher Sam Curry and others, as detailed in a full report on his website.

Many attacks could be performed without any interaction with users at all. By searching for domains under “ferrari.com”, the team discovered a number of subdomains such as ‘api.ferrari.com’, ‘cms-dealer.ferrari.com’, ‘cms-new.ferrari.com’ and ‘cms-dealer.test.ferrari.com’.

Although manufacturers had implemented single sign-on (SSO) measures for these subdomains, Curry and his team found these were flawed. By extracting the Ferrari SSO JavaScript code, they could identify the specific API routes that each used. Queries to Ferrari’s production API allowed for information to be returned on any of the company’s customers.

Through this method, attackers could access, modify, create, or remove user accounts, as well as alter their account’s role to give themselves heightened positions or list themselves as a Ferrari owner.

"Like many other industries, the automotive industry has incorporated heavy usage of APIs across many of its public services,” said Yaniv Balmas, VP of research at Salt Security.

“We also encountered similar issues with some of these car manufacturers and others. We can confirm these are not isolated cases and do not cover the entire attack surface and existing vulnerabilities. They do, however, show the depth and magnitude of the API adaptation issues.

“Rapid API adoption allows car manufacturers to publish more functionality to be used by car owners, dealerships, and others and is meant to provide a better user experience.

"However, human nature and history teach us that, unfortunately, usability will always be prioritised over security and privacy - and the results are very well shown by the report. We congratulate Sam Curry for publishing this wonderful research and highlighting the global API security issue."

Household brands such as Kia and Ford were also found lacking in security. Kia’s systems allowed for remote access to vehicles including car cameras through token manipulation, while an endpoint attack on Ford’s APIs granted control over customer accounts and vehicle telematics.

Curry’s full report follows his November 2022 Twitter thread, which detailed the vulnerabilities that enabled remote hacking of Hyundai and Genesis cars through API exploitation.

The researchers have informed all the affected companies of the vulnerabilities, which have since been fixed.

IT and cyber security organisation Offensive Security has banned ChatGPT in its certification exams.

The company becomes the second major IT organisation to ban the use of ChatGPT after Stack Overflow did the same, prohibiting chatbot-generated answers back in December.

In its Offensive Security Certified Professional (OSCP) exam guide, Offensive Security now lists chatbots such as ChatGPT and YouChat under its exam restrictions list. Other restrictions included on the list are spoofing, commercial tools or services, automatic exploitation tools, and mass vulnerability scanners.

“Any tools that perform similar functions as those above are also prohibited. You are ultimately responsible for knowing what features or external utilities any chosen tool is using,” the company stated on its website. “The primary objective of the OSCP exam is to evaluate your skills in identifying and exploiting vulnerabilities, not in automating the process.”

The use of chatbots is also restricted from its other exams, including Offensive Security Web Expert (OSWE), Offensive Security Experienced Penetration Tester (OSEP), and Offensive Security Wireless Professional (OSWP). Although it’s unclear when these rules were added to the guides, all of them were updated five days ago.

IT Pro has asked Offensive Security - the team behind Kali Linux - why it has decided to ban the use of chatbots. However, it stated in its exam guide that it will not comment on allowed or restricted tools, other than what is already included in the guide.

Developed by OpenAI, ChatGPT has impressed IT professionals across the industry with its ability to generate sophisticated answers from text prompts provided by users.

Its power has been particularly evident in software development applications, being able to generate entire functions based on programmer prompts, and cyber security professionals have shown it can also generate basic vulnerability exploit code.

Despite this, Stack Overflow's decision to ban the tool from its platform was made after it concluded that answers generated using it were often too erroneous. Stack Overflow moderators said this could be harmful to users who search for help with their problems.

“Because such answers are so easy to produce, a large number of people are posting a lot of answers,” said the moderators. “The volume of these answers (thousands) and the fact that the answers often require a detailed read by someone with at least some subject matter expertise in order to determine that the answer is actually bad has effectively swamped our volunteer-based quality curation infrastructure.”

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Meet the cyborg hacker’. We apologise for any errors.

Adam Shepherd

Hi, I'm Adam Shepherd,

Connor Jones

And I'm Connor Jones.

Adam

And you're listening to the IT Pro Podcast, where this week we're taking a look at the emerging world of biohacking.

Connor

Now it's probably worth making the distinction between the two types of biohacking there are in the world right now. You know, there is of course, the kind of biohacking reserved for scientists, professional and homebrew, that involves the CRISPR gene editing technology. But this of course, is is an IT podcast and we're most concerned with a form of bio hacking of the cyber kind; you know, the one involving tech baked into the human body.

Adam

Now, since the invention of computer systems, people have been finding ways to break into them and customise their operation to best suit their own needs. In recent years, however, adventurous experimenters have begun exploring how the same principles can be applied to the human body.

Connor

The so called biohackers have explored a number of ways to combine digital technology with flesh and blood, including implantable chips, digitally enhanced prosthetic limbs and much, much more. But what potential advantages does human augmentation hold? And are there any security risks that might be associated with this emerging practice? We're joined today by Len Noe, a technical evangelist, white hat hacker at CyberArk, and self described transhumanist, who's been immersed in this world for a number of years. Len, thanks for joining us.

Len Noe

Thank you guys for having me. It's a pleasure to be here.

Adam

So Len, first of all, you've got a number of, shall we say aftermarket extras? Can you talk about some of the biohacking modifications that you've made yourself?

Len

Well, to be fair, I didn't make them myself. I, the first thing I'm going to say is everything I have, I've done it as safely as humanly possible. I'm not one of those. Do It Yourself guys to do this in your garage.

Adam

Don't try this at home, kids.

Len

Yeah. I mean, there was a time that that was the way it was, but we passed that time, we can actually get some some some safe implants. Yeah, currently, I have eight different microchips with varying degrees of functionality, but predominantly, they revolve around RFID and NFC. I can do redirection tags via NFC, I can also have chips that will handle a lot of physical access cards like MIFARE classics, HID procs one and two, pyramid and dala, I actually have a credit card payment chip in my the top of my left hand, so I can actually do tap to pay with my hand, I have a biosensing magnets so that that one's a lot of fun. It's not really a lifting magnet. But due to the way that the magnet was constructed, it actually gives me the ability to feel electromagnetic currents and electromagnetic fields, kind of like a spidey sense. So yeah, and we can get into it a little later. I'm actually in the working on the second round of my prototypes for my pegleg. Those won't be the standard microchip style things. But that's actually a Raspberry Pi Zero W2 that's been actually loaded with Kali encased in bio encapsulation, and then I'm going to be implanting that in my leg, so that way I can actually take systems into places where you can't, or shouldn't be allowed to take technology. So having it set up to run low energy Bluetooth sweeps along with auto pwns while I'm sitting here talking, so yeah, I kind of have a little bit of a fascination with human upgrades.

Connor

This is already my favourite podcast I've ever done. This is great. Can I just ask what is what is the upside of being able to detect and sense electro magnetic fields?

Len

Well, I'm also very, very passionate about physical pen testing. I'm an avid lock picker. I'm a member of multiple different lock picking clubs. And when you look at physical security, especially around warehouses, how are most of them secured? Magnetic locks, magnetic locks require electricity. So depending on the wiring and the amount of shielding in your your Romex cabling for your electromagnet, I can sit on the outside of your building, run my hands over the wall, and I can actually trace your electrical lines. So at that point, I actually have an idea of where to shim or make, you know, especially if it's a destructive pen test, I can make a small hole and basically clip the electrical wire. And if you know anything about mag locks, especially if you're dealing in like an emergency situation like a fire or a power outage, magnetic locks are automatically designed to actually go into an open state due to an emergency to allow people to get out. So basically the that's one great thing for the magnet. The other thing is it makes a really cool trick at a bar, you can pick up bottle caps and things, you know. And it's, if nothing else, it's a really cool way to get, it's a cool magic trick around young kids too.

Adam

In the immortal words of the Insane Clown Posse: magnets, how do they work?

Len

Why do you have to go there, man? I mean, I'm from Detroit, but I mean, in St. Cloud, we had better musicians, man, let's go with the MC5 or, or the Bay City Rollers. Ted Nugent.

Adam

This is Shaggy 2 Dope erasure, and I will not stand for it. So in terms of some of the other practical use cases that this technology has, aside from the magnets, you mentioned some of the chips that you've been using, particularly the RFID and NFC devices, the contactless payment devices; what other kinds of use cases are there for this technology, either currently, or that you can kind of see emerging in the near future?

Len

Well, I mean, at this point, it's anything around the contactless technology, we see a lot of NFC used in IoT. You know, when it comes to personal devices, almost every mobile device or tablet that's been released within the last three to five years has NFC capability. And the truth is not a lot of people understand what it is. And the fact that it by its design is an unsecured protocol. You know, the problem when it comes to NFC is we're using application level security to try and lock down an insecure protocol. You know, so anything from, you know, compromising a mobile device through the use of the implants, I mean, one of my favourites is the physical access side of things, you know, and, you know, let me, let me go into this for just a second, if I may, you know, when it comes to our physical access, a lot of places, especially in my tenure, you know, and I've been doing this kind of work for pushing 30 years, only two companies I've ever worked for had any type of multifactor for physical access locations of high, high privilege, you know, data centres, things like that. Most companies will have a single point of access, and it's usually just a bar or a card read, and then the door unlocks. So if we take a look at my implants, and the fact that I have the ability to basically emulate multiple different physical card protocols, here's where it gets funny. If I don't have a copy of a cloned badge, if I don't have a Proxmark, or some type of replay device, if I'm found in a restricted area, the worst you're going to be able to do is trespass me. You're not going to be able to get me arrested, because all I have to do is say, hey, you know the door was open, I'm here looking at the building, I thought this was part of the tour. You know, unlike the days of old, you know, where if I did have that physical piece of evidence that shows how I got in there, then I can be actually looked at as a criminal. So I'm playing a lot in the grey areas. You know, the whole point is the obfuscation. I'm not doing anything that anybody else hasn't done before in a different method, I'm just doing it in a way that would be very, very difficult from a digital forensics or incident response perspective, to be able to actually find that true root cause, on top of the fact that even if they saw some of the bulges in my my skin where I have some of my implants, when it comes to most of the privacy laws in most, you know, first world countries, they're not allowed to actually delve too deeply because it involves my personal medical, the minute it went inside my skin.

Adam

And also, I'd imagine they're not the kind of thing that one would typically notice, unless you knew exactly what you were looking for and where, right?

Len

Exactly. I mean, I've gotten asked a lot of questions in turn over the since I started doing this, like, you know, are these the same chips that I that, you know, are in my dog, are these chips that are in my cat, you know, and in some way the answer's yes. I mean, they all run on the same NFC style protocol. You know, and just like when it comes to a pet, you know, they have those very large wands. So they're gonna they would have to actually try and find the implant, energise the chip, to be able to get a read. Therein lies the same problem when it comes to all augmented humans, in order to be able to detect me and my chips, you would actually have to energise those chips to be able to get a read. So you would need multiple different spectrum analyzers on both high frequency and low frequency. And they would have to be strong enough to energise my entire body in order to for the detection. So from a management or you know, an actual implementation perspective, there is currently no way to actually detect an augmented human with this type of technology inside the body. And that becomes a very large problem for security professionals. And the only way that I can really give as a way to try and combat this is a true defence in depth, and a layered security approach. You know, I've said it a million times, you know, we have no problem putting multifactor authentication in front of all of our privileged data. But we don't do the same thing for our physical locations. And when if there's one person out here, like me, that has the ability to do this, I think that's fact enough that we should be looking at this as a potential threat on a larger scale, and we need to address it accordingly.

Connor

So you can clearly see that there's a real benefit to having sort of, like you said, multi layer security with a biological air to it. And you obviously yourself also, what maybe like 5% technology, both by the amount of things that you've got in you by the sounds of it.

Len

I'm working on it; I'll take 5% is a compliment.

Connor

So what what what attracted you to the world of biohacking in the first place?

Len

Why do you climb a mountain? Because it's there. If anybody wants to take a Google, just google me and you can find a picture; I am, I consider the fact that I have one tattoo, it just starts at my neck and goes all the way to my my, the top of my feet. I do flesh hook suspensions for fun. So when I saw that people were actually implanting technology, it just seemed kind of like the next natural evolution to somebody like me, I considered myself to be a modern primitive for a very, very long time. So as far as I know, I was the first person that had brung the, the idea that these can be used for an offensive purpose to the security community. I know I am not the first guy to ever do this. I'm just the first guy that opened his mouth about it. And I think that goes into just the way that I see the world. I was a black hat for a very, very long time. So when I look, walk into a room, the first thing I see is okay, there are cameras, where's the the exit strategies? You know, if you tell me that this is an NFC chip that can interact with a mobile device, maybe you're going to use it for your digital business card, I'm going to look at that same device and see how can I use this in a way that would suit my purposes?

Adam

So let's talk about some of those methods, then some of those ways in which this technology could potentially be used to target businesses. You've spoken already about some of the offensive applications of the magnets you have, for example, but what about some of the, for example, the NFC and RFID chips?

Len

Sure. NFC, you know, like I said, it's pretty much a standard protocol on most modern mobile devices and tablets. The abilities through NFC can be anything from transferring, beaming a file, it could you can use it to set up a Wi-Fi network, you can use it to redirect. I mean, we've seen all kinds of different possibilities. So the way that I've redirected those, I released three different attacks at RSA two years ago. The first one was called Flesh Hook. Flesh Hook is a redirect. Yeah, I made the exploits. I got to name them. That's one of the benefits. So essentially, what that one was, is I would I've set up a BeEF server. And you know, for any of the newbies out there that don't remember the good old days of BeEF, BeEF is the browser extension exploit framework. This is the website that, you know, we've all heard the rumours of the minute you log into this website, the bad guys are in your system. Yeah, that's BeEF. So it's a little bit of a social engineering play. You know, I'd walk up Hey, Adam, man, check this out, dude. Let me see your phone. I found this amazing new video on YouTube. I want to show you. As soon as I can get the device in my hand, if you have NFC turned on, the large flexNExT implant that's in the top of my right hand will actually have enough distance on the antenna that it'll actually read through the actual meat of my hand. I can hold the phone in the correct orientation. It will pop up a redirector where I'm going to just send you to a video, but the minute your browser hits that website, the Java code in the HTML page is actually going to hook the browser and then I have access to the entire BeEF suite. So I can do on device spear phishing attacks, I can geolocate your device, access the cameras, I can use DNS enumeration if you're on a local network or a corporate network, I can do domain identity, subdomain identification and enumeration. Anything that I could even think of. The other one was called leprosy. Again, my attack, I named it. Leprosy doesn't really work as well against iOS devices. But when it comes to Android, once again, you know, this one is a little bit easier. Adam, oh my god, man. You know, I'm over here in the UK with you, you know, my phone died. My wife, I was just on the phone with my wife. She told me something happened to my grandson, man, can I borrow your phone for just a second? You know, of course, you know, you know, yeah, here, dude, call your wife. And again, the URL that's been programmed into the NFC chip, points to a web location where I've got an infected APK that was created with MSF Venom or, you know, a Cobalt Strike beacon. At this point, you know, it's Oh, my God, you know, let's be honest, who remembers my who remembers phone numbers anymore? What's my wife's phone? What's the country code for the United States? Plus one. Okay. So I can go through this big rigmarole of trying to remember a phone number, when actually what I'm doing is installing that APK. And as soon as I'm done, it's like, oh, shit, I can't remember the phone number man here, I'm gonna just go plug my phone in. But at this point, I have a reverse TCP connection back to the device, I can set up persistence, I can get a shell. I mean, at that point, it's whatever I want. And the third one was called handshake. You know, they're all you know, biologically related names. What can I say? And, you know, at that one, you know, I can use a Proxmark, any type of card skimmer I want, get your badge information, write it down onto one of my chips. And if we're in one of those single point access situations, I'm in your privileged locations on prem. And once again, the problem is there's zero indications of compromised to any one of these different attacks.

Connor

I think judging by mine and Adam's reactions after the first question we came in with, and we're just like grinning like Cheshire cats, right? I think we can speak for the both of us saying we're so excited just to hear about this kind of thing, because it's not something we hear about a lot. So with that in mind, then, how many black hats like your former self, are using this in the wild or starting to think about using it in terms of real world attacks?

Len

Okay, this is one of the hardest questions to answer in regards to doing conversations like this. I can tell you this with 100. There, there are some facts that I can give you with 100% certainty. Within the United States, one of the biggest distributors for microchip implants is a company called DangerousThings.com. Within Europe, there is a company called KSEC, K-S-E-C. So I am, I spoke with the CEO of Dangerous Things, a gentleman by the name of Amal. And from him, I was able to gain the fact that Dangerous Things has sold close to about 300,000 implants. I was actually back in y'all's neck of the woods last weekend up in Newcastle, where I actually got to meet Kai from KSEC. And between the two of us we basically came up with an estimation of between four hundred and six hundred thousand implants have been shipped. How many of those implants were actually, have actually made their way inside of a human body? We don't know, but I can tell you this much. I know that I'm using it. I know of quite a few people who are on red teams that are using this technology. We have not found any indications from any type of incidents that have actually happened in the wild where implants were shown to be the root cause, but at the same time, how would you be able to determine that, you know, and therein lies the problem. We may have, I mean, we've seen, you know, breach reports where NFC or RFID were included in the evaluation in terms of cause of breach, but without actually getting access to an individual to find out if they were actually augmented, it could have been a card, it could have been an implant, we don't know. Because, as I said before, there's really no way to determine any type of augmented human with current technology.

Adam

And if yourself and, you know, a significant amount of other red teamers are using this technology and are interested in this technology, it's a fairly safe bet that black and grey hat actors are also interested in it and are deploying it in the wild, you know, it's not, it's not that much of a logical leap.

Len

No, and that's the way I see it. If once I actually brought this to the out at RSA, I knew this was going to open the door and somebody who is going to read this and there's going to be some black or grey hat somewhere that goes, Hey, this is a new vector. And due to the you know, the privacy laws and everything else, this becomes a much safer road to try and travel if you're going to try and do offensive type activities.

Adam

So let's talk about some of the practicalities of this, then, cause this is a very kind of new, very emerging field. Have you experienced any challenges with biohacking and with your implants, you know, other than getting through airport security, which I can imagine is just a barrel of laughs.

Len

Okay, well, you brought it up - the airport is the number one question that I get.

Adam

I'm not surprised.

Len

You want, would you like me to tell you how I walk, how I get through an airport?

Adam

Absolutely.

Len

I put one, the left foot in front of the right and then I repeat. That's it.

Adam

No. Does it, do none of them come up on the scanners?

Len

All right, let's talk about the two different types of metal detectors for two seconds. We have the magnetometer which is just kind of the archway you walk through. There is not enough combined metal in all of my implants to actually trigger a magnetometer. I'm going to carbon date myself here; before my my career in IT, you know, almost 30 years ago, I used to do the job of the TSA before there was a TSA and airport, airport security was still privatised. And don't quote me on this, but I if I remember correctly, the magnetometers would not trigger unless you had a combined metallic weight of at least a .22 calibre bullet. So I mean, if you think about it, when you walk through a metal detector, if you have like a necklace on with a gold charm, it doesn't go off, if you have earrings in, it won't go off. Now, I'm not saying that they couldn't change the sensitivity of the magnetometers to where they would detect it. But they would get so many false positives, trying to check people into an airport that it would be an unusable control. Same with the metal detectors. When you think about my implants, most of them are actually silicone, you know, with the exception of the copper antennas on the larger flexible main membrane implants or the bio magnet, which is a iron core wrapped in titanium, but that's less smaller than the size of a pea. So even if I'm doing you know, the X ray metal detector, doesn't show up, I can walk straight through, the magnetometer will not trigger. So that to me kind of says something about what we're dealing with in terms of airport security. But, you know, we can do a different talk on that one another day.

Adam

That's quite a scary prospects in some ways, particularly if you're trying to defend against these types of attacks.

Len

Yeah, I mean, thankfully, at least at this point, there's not a lot in aeroplanes that are relying on RFID or NFC, you know, but if I can get that pegleg you know, where I actually have a full Linux system, then yeah, that is something that could potentially interact with the Wi-Fi entertainment system on the plane, I mean, it opens a whole lot of different vectors at that point.

Adam

But even beyond air travel, if airport security - which is, I would argue, among the most stringent kind of security, you know, scanning in terms of concealed objects and devices - If it can get past airport gate security, then security in and out of a building or or complex doesn't really stand a chance for detecting this kind of stuff, does it?

Len

Not even, not even a little bit. You know, one one thing that I, just cause you guys are are a lot of fun, and I think you guys will get a kick out of this. I think everybody is familiar with the drug smelling dogs that are used by the authorities.

Adam

Yes.

Len

Well, one of the, they actually have a new type of canine that is being released to help military and law enforcement. And they're actually technology sniffing dogs.

Adam

No.

Len

Yes, you can look them up. So these are not used in the same way that narcotic sniffing canines are in terms of they don't use them to be able to get an arrest. They don't bring them up and smell somebody and go, okay, yeah, we've got you, we're going to take you away. They're used more in the post arrest investigation point. They're used a lot with human trafficking, child predators, things like that; people that would actually store illegal data on hard drives, in technology. So if someone gets arrested, they'll get a search warrant, they run the dog around the house looking for hard drives, thumb drives, you know, anywhere that they may have, you know, tried to store illegal and illegal things. I found out that one of the law enforcement agencies that is close to me here in Texas, actually recently got one of these drugs, these key technology smelling dogs. So after, you know, sending an email to the police department going, No, I am not crazy. Yes, I have implants. And here's here's my CV. So you can see I'm a real person, and I'm not messing with you. I'm interested in information about this dog. And after they researched me, they're like, okay, apparently cyborgs are a real thing. They became really open to, you know, having conversations, and I've actually been invited to go up to the Dallas Police Department. And we're going to see if Remi, the technology dog, is able to sniff any of the implants that I have. Because that would actually be probably one of the first ways to try and detect somebody of augmented nature. And the one point that I wanted to point out, and since you guys are definitely geeks, and take that as a hardcore compliment, if you think back to the Terminator movies, where, you know, wherever the resistance was right at the entrances, they always had the guys with the dogs, because they could smell the technology. And I just start to wonder is this going to be a situation where life imitates art or art imitates life? I don't know which, but I'm really excited to get up there. Due to my travel schedule, it's been a little difficult, but I'm hoping to be up there sometime towards the middle of November. And you know, maybe I'll drop you a line and let you guys know how it turns out.

Adam

Yeah, absolutely. I'm going to ask the obvious question, how can dogs smell technology? How can anyone smell technology?

Len

Okay. Just like the they've taught the dogs to be able to detect specific narcotics, you know, heroin, cocaine, marijuana, things like that. They actually have taught them to key in on specific components that are used in the creation of technology. The name is triphenylphosphine oxide.

Adam

Oh, wow.

Len

So they found one very, very specific element that is used in the creation and manufacture of technology circuit boards, hard drives, and they basically train these dogs to hit on that one specific compound. I don't know if they'd be able to smell it through the skin. I don't know. But I still think it's going to be one hell of an interesting experiment.

Connor

Hmm. Yeah, definitely. And you get to hang out with more dogs as well. So that's a win win, really, and especially in my eyes. So in terms of getting this tech into the mainstream then, because obviously, I'm just from hearing you for the past half hour, I'm super excited about it, and I'm probably not going to be alone. So say further down the line that this kind of stuff does reach consumers, the everyday consumer that is, what are the limitations you can imagine a potential regulator seeing, you know, for example, can can realistically we actually have Internet facing machine augmentations of the kind like your like your peg leg, or is that is that a hacking risk waiting to happen?

Len

Um, well, I mean, let's be honest, you know, we can talk about QR codes and they are hacking risks waiting, just waiting to happen, and we see those on buses and trains, and taxi cabs. I don't think honestly, the imposed threat of any technology is going to stop someone from using it if there is the potential for a monetary gain. So to answer your original question, there is a lot of implants going out right now that I see is going to probably help break that stigma barrier. One of them, like I said, is the Walletmor chip that I have in my right hand, it's an actual credit card. So I can do tap to pay. I think, right now, the idea of implants is still, like you said, it's very, very fringe. And you everybody looks at me like I'm some kind of a terminator half the time. I mean, my friends shut their Bluetooth and their Wi-Fi off, the minute I walk into a room. All I want to do is just look at him when I leave and go, I'd be back. But another one that I see that's really made an impact is there's the ability, if you drive a specific model Tesla, you can get an implant and you can programme your valet key onto an implant. And you can basically just jump in your Tesla and you can drive. I think as we see a lot more of these types of implants and technologies that people can actually find a legitimate day to day use for is going to help with the concept of adoption and understanding and acceptance. Right now, there's like I said, 400,000 to 600,000 potential augmented humans out there. I see it moving beyond just the microchip concept, especially with a lot of the advancements we're seeing around graphene batteries. The big issue when it comes to any type of implant is outside of anything that's considered biomedical, there's no internal power for anything yet. And even when it comes to the pegleg, that I'm planning on putting in myself, it uses an indirect power receiver to actually power the device, but there's no battery in it. Because to charge something generates heat. So I think we're right at the precipice of you know, a whole new set of things that could be potentially coming out. I did a keynote in Newcastle over the weekend, and the title was Resistance is futile, we're already Borg. And in that talk, I just brought up some of the stuff that's actually already out there that people may not even be aware of. We've got spinal implants that are, you know, returning motility, to paralysed people, we have ocular implants that are working on giving sight to the blind, we're able to use DNA as a storage medium, and one gramme of DNA could potentially hold over seven terabytes worth of data with a retention period of over 100 years. So we are right on the cusp of so many different technological breakthroughs that cross that human technology barrier, that I think that you know, in terms of what we're going to see in the relatively near future is going to really be up to the order in which these discoveries are made.

Adam

So speaking of future technology, and just going back to the kind of Tesla use case you mentioned a little earlier, just as a brief digression. What do you think is the kind of feasibility of projects like Neuralink and other brain computer interfaces?

Len

Oh, you brought up Neuralink, if everybody's familiar with Neuralink, but nobody's familiar with the other company. I'm very, very interested in BCI. Brain computer interfaces, especially for disabled and locked in individuals, I think it's going to be crucial. I just watched an amazing documentary on my way back from Newcastle. Dr. Phil Kennedy, the name of the documentary was called Father of the cyborgs. Dr. Phil Kennedy was actually one of the he's a neurosurgeon. And he actually was the first individual to implant brain computer interfaces into paralysed people. You know, so everybody wants to talk about Neuralink, but they don't want to talk about all the other ones. Another really big player in the BCI field is Synchron. And they're already in human trials. So I think that the idea of BCI is definitely something that's going to happen. But at the same time, all of these new technologies they do will have, you know, an underlying firmware. You know, and one of the things that I'm trying to look at in regards to this, the melding of technology and humanity is as security professionals, we already know there are going to be attack vectors there and we need to be talking about those now. You know, the attacks we see today, the vectors may have changed, but at the core, every single attack today is the same attack that it's been for the last 20 years. I mean, they're looking for credentials, I'm looking for data, I'm trying to exfiltrate things, or I'm going to ransom you, you know, the end game is going to be the same; how we get there may be different. And if we think about all this new advancements in technology, and just that crossover, what happens when ransomware starts affecting Bluetooth or internet enabled bio implants, you know, what happens if I'm, my pacemaker gets a ransomware, then it's an a real ransom at that point. You know, and, you know, we keep running towards the technology and trying to, you know, make ourselves more than human, which is absolutely the core of, you know, the trans human movement. But one thing that I've said all along, and I even started the conversation with you guys today is, it needs to be done safely. And when we look at everything that's coming up, honestly, in my opinion, the end game is still identity, you know, and being able to maintain our individual identity as we become something potentially more than human. And as such, I think our identities, our personal information, you know, identity is going to become the new security. Because once the lines between an individual and the tech stacks that they're interfacing with, you know, gets either faded or removed completely, the only thing left is the individual and the individual identity of the person that's making those interactions.

Connor

So just to round things off, then looking at the long term, what kind of potential benefits might be out there for technologists or IT professionals, you know, outside of red teams and perhaps even security, who want to explore biohacking as the practice itself matures?

Len

Well, again, you know, that's like, in my opinion, that's like asking someone how, how do you want to utilise a laptop or a mobile device? I mean, these microchips were never designed to be used necessarily as offensive tools. But if you look at things like Mimikatz, which is every hacker's favourite LDAP tool, it was, it's originally designed as a an LDAP auditing tool. Any tool this, regardless of what its intended purpose was, can be reused and misconfigured and used as a weapon. So I guess I, you know, not to try and blow off your question. But I guess it depends on really, what are they trying to do? You know, it could be something, I mean, I have no doubt that maybe we're going to start seeing the ability to do OTP. If you're not familiar with it, there's an amazing ecosystem out there. It's called the VivoKey. And this is an implant, the VivoKey architecture will actually allow for one time, you know, MFA OTP, where you're actually going to validate via an implant with an app on your phone, you know, so that's a potential security advancement moving forward, it could be something as simple as using your, your chip, almost kind of like a Fido chip, where you're going to scan your implant to access your computer, again, I would still want to password in there, don't like single points of failure as from a security perspective, you know, maybe you're gonna put your, your badge for work on your chip, and you're just not going to, you know, that way you can badge in. Not everything around implants, or implanted technology is a black art, for the lack of a better term, you know, they can be used just to make people's lives a little simpler. But one of the quotes that I love to use in pretty much every single time I talk is in from my personal experience, things that make life easier, rarely make them safer. So we have to, we are the security professionals, we're the ones that you know, have to warn the masses, we're the ones that have to take care of our employees. So it's up to us to understand what these kinds of threats are, and build that layered security approach and that defence in depth, so that these types of people, people such as myself, are left sitting at the door going well, I managed to hit the badge reader, but I still don't know the key, you know, our data, our physical locations, privilege is privilege, I don't care if it's physical, I don't care if it's digital, you know, and we are the ones that have been empowered by our companies to be the gatekeepers in the security for these types of things. And we need to do our job and be aware that people like me exist and build a strategy around that knowledge to be able to stop people like me.

Adam

Well, while we could spend all day digging into the intricacies of biohacking, sadly I'm afraid that's all we've got time for this week.

Len

Aww.

Adam

I know, I could spend the rest of the afternoon talking about this. But our thanks once again to cyberArk's Len Noe for joining us.

Len

It was absolutely my pleasure, guys. I really enjoyed talking to you. Maybe we can do it again sometime.

Adam

Yeah, absolutely.

Connor

Sounds great. You can find links to all of the topics we've spoken about today in the show notes and even more on our website at ITpro.co.uk.

Adam

You can also follow us on social media as well as subscribe to our daily newsletter.

Connor

Don't forget to subscribe to the IT Pro Podcast wherever you find your podcasts. And if you're enjoying the show, leave us a rating and a review.

Adam

We'll be back next week with more insight for the world of IT. And until then, goodbye.

Connor

Bye.

The technological arsenal available to cyber criminals is already enough to give any security professional nightmares, but there’s another emerging threat on the horizon that may keep them up at night: bio-augmented hackers. Implantable chips and other modifications are growing in capability and sophistication, and there are a variety of creative ways that attackers can use them to carry out both physical and device-based attacks -

This is made all the more concerning by the fact that these implants are all but impossible to detect. This week, we’re joined by CyberArk technical evangelist, white hat hacker and self-described transhumanist Len Noe to find out what kind of augmentations cyber criminals currently have access to, how can they be used in intrusions, and why the industry needs to start preparing for their implementation now - as well as some of the positive uses that this technology can be put to.

Highlights

“Would you like me to tell you how I get through an airport? I put the left foot in front of the right and then I repeat. That's it… There is not enough combined metal in all of my implants to actually trigger a magnetometer… even if I'm doing the X-ray metal detector, [it] doesn't show up, I can walk straight through, the magnetometer will not trigger.”

“I know that I'm using it. I know of quite a few people who are on red teams that are using this technology. We have not found any indications from any type of incidents that have actually happened in the wild where implants were shown to be the root cause, but at the same time, how would you be able to determine that - and therein lies the problem.”

“From… an actual implementation perspective, there is currently no way to actually detect an augmented human with this type of technology inside the body. And that becomes a very large problem for security professionals. And the only way that I can really give as a way to try and combat this is a true defence in depth, and a layered security approach.”

Read the full transcript here.

Footnotes

• The IT Pro Podcast: The secret life of hackers
• Stories from the front line: The secrets of the Red Team revealed
• Trade Unions Congress fearful of implanting workers with tracking chips
• Should employees be microchipped?
• What is Neuralink?
• ARM fights paralysis with brain implant chips
• What is penetration testing?
• Should human augmentation technology be regulated?
• IT Pro 20/20: The future of augmentation
• The IT Pro Podcast: Can technology make us more than human?
• The IT Pro Podcast: Should companies spy on their employees?
• BSidesSF 2022 - Biohacker: The Invisible Threat (Len Noe) - YouTube

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

SpaceX is offering between $100 and $25,000 in bounties to hackers who report exploits to the company through their website.

The spacecraft manufacturer has set up a dedicated page on crowdsourced bug bounty platform Bugcrowd, giving would-be white hats a centralised method for reporting un-patched SpaceX and Starlink exploits.

Hackers who submit reports on network vulnerabilities can expect up to $10,000, while on a “case-by-case” basis those who discover and report vulnerabilities with Starlink dishes, satellites or other such hardware can receive up to $25,000.

According to its Bugcrowd page, SpaceX has so far rewarded 41 vulnerability reports, at an average of $972 each. A more comprehensive list of prices per type of vulnerability discovered can be found on the page, but SpaceX specifically forbids physical tampering with its infrastructure or that of Starlink’s, as well as testing that could directly impact its services.

In a document shared by SpaceX titled ‘Starlink welcomes security researchers (bring on the bugs), the company outlines its position on bug bounties.

“We allow responsible security researchers to do their own testing, and we provide monetary rewards when they find and report vulnerabilities,” states the document.

“We recognize and appreciate the support of the broader security community in making Starlink better and more secure. We encourage researchers to test Starlink for security issues in a non-destructive way and to report their findings through our bug bounty program.”

SpaceX further states that it considers vulnerability research within its bug bounty policies to be exempt from Digital Millennium Copyright Act (DMCA) claims, legal action as a result of Computer Fraud and Abuse Act (CFAA) violation, and SpaceX terms and conditions that would interfere with research.

Bug bounties are a popular form of publicly-sourced testing for companies, that offer white hat hackers lucrative rewards and permission to attempt to hack some of the most challenging commercial security systems, in return for information on any vulnerabilities that they discover.

In June, an employee working for the vulnerability coordination platform HackerOne was found to have been stealing and re-submitting bug bounties for personal profit and was subsequently fired.

The Starlink constellation, which aims to provide satellite broadband access to customers worldwide, is rapidly growing. With over 2,500 satellites currently in orbit and an end goal of 12,000 having been approved by the FCC, it is a frontrunner in the growing race for satellite internet dominance, which has already spawned disagreements as well as interest from agencies such as DARPA.

The crypto bridge Nomad Bridge is offering hackers a 10% bounty after the company was hit by a cyber attack earlier this week in which it lost $190 million.

Nomad Bridge will consider any party who returns at least 90% of the total funds stolen to be an ethical or white hat hacker, it revealed today. The organisation will, therefore, drop any intent to pursue legal action against the perpetrators, who they'll deem to have conducted the hacking operation on reasonable grounds.

The company added it’s continuing to work with its community, law enforcement, and blockchain analysis firms to ensure all funds are returned.

Nomad said that although it won’t pursue legal action against to-be determined white hat hackers, it'll identify them to any third parties who may be considering legal action. It's also working closely with law enforcement and will advocate for no criminal charges when the so-called ethical hackers return the funds.

They need to be returned in Ethereum or ERC-20 to the official Nomad recovery wallet address, which is being run along with Anchorage Digital, a nationally regulated custodian bank.

“Given the unprecedented number of decentralised parties involved, coordinating amongst everyone was a complex process,” said the company. “We wanted to make sure we put the bounty out in the right way, so we took some additional time to make sure we considered the complexities due to the nature of the hack.”

Some white hats have already returned money to the crypto bridge. Paladin Blockchain Security and Rugdoc.io returned funds worth $1 million to the recovery wallet, stated Nomad. A total of $11.2 million was also returned by five white hats including darkfi-eth, anime.eth, and returner-of-beans.eth. The total returned seems to be around $17 million.

Cross-chain token bridge Nomad was hit with an exploit earlier this week which saw attackers drain it of nearly $200 million. Following a routing upgrade on the platform, messages were allowed to be spoofed which meant that attackers could abuse this to copy and paste transactions. This quickly drained the bridge in a “frenzied free-for-all” said the Paradigm researcher known as samczsun.

At the time, the company thanked many of its white hat friends who acted proactively and were safeguarding some of the funds. It instructed them to continue to hold them until it provided further instructions through Twitter.

Vulnerability coordination platform HackerOne has announced the firing of an employee found to have used their position to access the vulnerability data of customers, and to sell duplicate data back to them for monetary gain.

HackerOne provides a platform through which white hat hackers can anonymously submit vulnerability reports on companies and also facilitates the secure transfer of bounties in return for the information. The company describes itself as the “global leader” in attack resistance management (ARM).

It was discovered this week that an employee had improperly accessed HackerOne systems between April 4 and June 23, stealing user-submitted vulnerability data to pass the information along to the affected customers themselves and receive the bounty.

Concerns were raised by a customer on June 22, when a submitter of vulnerability data used threatening language and provided information with remarkable similarity to a disclosure they had previously received through HackerOne.

Relying on a community of over a million hackers to submit reports can lead to ‘bug collisions’ or duplicates, where two or more hackers can discover the same vulnerability around the same time as each other. In this instance, however, the company states that it was provided with evidence that cast doubt on simple coincidence being behind this crossover of information.

24 hours after the customer tip, HackerOne had identified an employee suspected of being behind the incident and removed their system access. This was possible because only one employee’s access log showed that they had viewed all the disclosures that further customers had identified as being re-submitted by the threat actor.

Following an interview, their employment was terminated, and criminal referral has not yet been ruled out by the company.

In a report, HackerOne chief information security officer Chris Evans and chief technology officer Alex Rice described the actions as a “serious incident.”

“Insider threats are one of the most insidious in cybersecurity, and we stand ready to do everything in our power to reduce the likelihood of such incidents in the future.”

The company states that they have made all customers that they know interacted with the threat actor aware of the incident, but further stressed that any customer who was contacted by user ‘rzlr’ should contact them directly at support-incident-06-22@hackerone.com.

The US Department of Justice (DoJ) has announced that it will no longer prosecute ethical hackers under its anti-cyber crime law, the Computer Fraud and Abuse Act (CFAA).

The landmark change comes after a policy revision, stipulating that cyber security research conducted in “good faith” should not be prosecutable, came into force on Thursday.

There is no concrete guidance on what type of activity falling under the umbrella of ‘cyber security research’ is protected or unprotected under the new policy revision, but security researchers acting in a way that intentionally avoids harm will not be charged under the CFAA.

Cyber security researchers have previously been fearful of reporting security vulnerabilities in the past out of fear of being charged under the Act, but the US is now adopting a fresh perspective, saying vulnerabilities that are discovered responsibly benefit “the common good”.

“Computer security research is a key driver of improved cybersecurity,” said Lisa O. Monaco, deputy attorney general. “The department has never been interested in prosecuting good-faith computer security research as a crime, and today’s announcement promotes cyber security by providing clarity for good-faith security researchers who root out vulnerabilities for the common good.”

The majority of security researchers (60%) speaking to Bugcrowd in 2020 said they had not reported security vulnerabilities they found in the past due to fear of being prosecuted under the CFAA.

The law has also threatened other areas of cyber security such as legitimate penetration testing. Security professionals working for Coalfire in 2019, for example, were handed criminal charges for breaking into Iowa’s Dallas County courthouse after being contracted by the state of Iowa.

The charges were ultimately dropped but the CFAA, which was drafted in 1986, well before the modern internet, has always threatened ethical security research.

The UK’s equivalent legislation, the Computer Misuse Act (CMA), has been criticised in the past for also not legally accepting ethical hacking as a benefit to society and industry.

Drafted in 1990 but currently under review, the CMA has been labelled an outdated piece of legislation and like the CFAA up until this week, it too outlaws good-faith ethical hacking.

A recent report from the CyberUp campaign, in partnership with techUK, showed that 80% of legitimate cyber security researchers have worried about being punished under the CMA while defending cyber attacks.

Ethical hacking’s protection from the CFAA received a boost last year in a significant ruling in the Van Buren vs United States case.

In it, the US Supreme Court ruled that a law enforcement officer, bribed by an outside individual, did not break any laws under the CFAA in accessing information from a computer for unsanctioned reasons.

Although Van Buren was authorised to access a police database, he was not authorised to hand over confidential information to an outside party in exchange for money, but the ruling meant he could not be prosecuted under the CFAA, leading onlookers to believe this could lead to positive implications for ethical hackers.

The latest policy revision to the CFAA has been greeted warmly by the cyber security community. Brian Higgins, security specialist at Comparitech, told IT Pro that “this is definitely a step in the right direction by the US authorities”.

“It’s unreasonable to place such disproportionate restrictions on a vital community of professionals, the majority of whom operate to high standards of ethics and integrity,” he said.

“Taking the gloves off, even to this extent, will allow a better understanding of the threats we face and the best way to defend against them. This proactive development in the United States will undoubtedly attract a lot of scrutiny from the international community, the majority of whom will be seeking to follow suit in some fashion.”

The DoJ said that individuals claiming to be conducting security research “is not a free pass for those acting in bad faith”. It used an example of extorting other people after discovering a vulnerability, all in the name of research, which would not be protected under the policy revision.

“Hacking itself, using its current common definition rather than the original, isn't inherently good or evil. Using it for profit and abuse is evil,” said Sam Curry, chief security officer at Cybereason to IT Pro. “Breaking the law is evil. But using it to improve security is a vital function without which we really can't resist the darker kind. In the world of cyber, this is great news for white hats and gives a ray of hope to some grey hats too.”

Although greeted warmly by many, other corners of the industry have criticised the DoJ for not making more allowances in its policy review.

Not setting a clear line as to what constitutes an offence in the process of ethical hacking, and what doesn’t, is the main point of contention for the Electronic Frontier Foundation (EFF), which said that it would be better if there was a technological restriction defendants would have to defeat in order to be charged under the CFAA.

“Instead of this clear line, the new policy explicitly names scenarios in which written policies may give rise to a criminal CFAA charge, such as when an employee violates a contract that puts certain files off limits in all situations, or when an outsider receives a cease-and-desist letter informing them that their access is now unauthorised,” it said.

The EFF also criticised the DoJ for saying that security research should be conducted “solely” in good faith, and it excludes “a lot of how research happens in the real world”.

A certified ethical hacker and practising IT manager has been charged with several offences after stealing a large sum of cryptocurrency from an elderly person.

Aaron Daniel Motta allegedly stole more than $575,000 (£411,900) from an elderly victim by stealing a Trezor hardware wallet used to store cryptocurrency offline. The type of cryptocurrency was not disclosed in the police reports.

Clearwater Police in Florida said Motta transferred the sum into multiple wallets he owned after the victim hired Motta to install a security system in their home.

Motta faces felony charges of grand theft and offences against computer users, according to an arrest affidavit, Tampa Bay Times reported.

According to a LinkedIn profile in Motta’s name, the accused is a specialist in cyber security, penetration testing, offensive security, and IT.

The 27-year-old is currently self-employed, an owner at Motta Management & Mitigation Services, and recently left two positions - security technician and network technician - at different companies. Motta is also an active participant in Apple’s bug bounty program.

According to the profile, Motta also holds a degree in cyber/electronic operations and warfare from St. Petersburg College and is a Certified Ethical Hacker through Cisco Networking Academy - a course that is not currently available through Cisco’s learning platform.

Motta claims to hold other cyber security and networking certifications too. He achieved three CompTIA certifications in 2019: Cybersecurity Analyst (CySA+), Network+, and A+. His profile also shows he achieved the Cisco Certified Network Associate Cyber Ops (CCNA) certification in 2018.

Motta was taken to Pinellas County Jail on Friday 8 April and was released in the early hours of Saturday morning after paying a $60,000 bail, reports suggested.

The victim is currently unnamed and many details have yet to be released, but police said they are aged 65 years or older.

Cyber criminals are preying on ethical hackers supporting the IT Army of Ukraine by deceiving them into downloading information-stealing malware.

Opportunistic cyber criminals are posing as genuine representatives of the IT Army of Ukraine and pretending to provide them with tools to deliver distributed denial of service attacks (DDoS) that ultimately turn out to be malware, according to researchers at Cisco Talos.

The IT Army of Ukraine is a group that mobilise via the Telegram platform and was originally assembled at the start of the conflict by a Ukrainian Minister to recruit as many supporters as possible to fight Russia in cyber space.

The group currently has more than 300,000 members and posts daily ‘hit lists’ - lists of target .ru URLs for tech-savvy supporters of Ukraine to knock offline. Recent targets include Russian electronic signature services and importers of technology for the Russian military.

Criminals are targeting these ethical hackers using Telegram channels that are seemingly related to the real IT Army of Ukraine group, but are not genuine.

Cisco Talos researchers saw cases of adverts for inauthentic versions of genuine DDoS tools, such as the real Disbalancer Liberator tool, which when clicked infect the user's system with information-stealing malware that harvests credentials and cryptocurrency information.

The information stealer gleans information from browsers such as Chrome and Firefox, and scans other locations on the file system for key information before relaying it back to a Russian IP address.

“This is an example of one of the many ways opportunistic cybercriminals are attempting to take advantage of the Russian invasion by exploiting sympathisers on both sides of the conflict,” the researchers said.

“Such activity could take the form of themed email lures on news topics or donation solicitations, malicious links purporting to host relief funds or refugee support sites, malware masquerading as security defensive or offensive tools, and more. Users must carefully inspect suspicious emails before opening them and validate software or other files before downloading them.”

Cisco Talos said evidence suggests the threat actors behind the campaign have been distributing infostealers since “at least November 2021” but have now pivoted to targeting hacktivists siding with Ukraine.

It also said it expects the information-stealing activity to continue and diversify as the global interest in the conflict creates a potentially massive pool of targets for threat actors to prey on.

The Anonymous hacking group executed another major cyber attack in response to Russia’s invasion of Ukraine this weekend, claiming it hijacked Russian broadcasters and showed war footage from inside Ukraine.

The hacking collective announced the attack late Sunday evening, saying it was able to manipulate broadcasts on TV channels such as Russia 24, Channel One, and Moscow 24, in addition to streaming services Wink and Ivi.

Anonymous’ Twitter account made the announcement, and also shared footage that appears to show the hijacked broadcasts appearing on televisions in Russia.

It’s unclear if Anonymous hacked the broadcasters in question or were able to manipulate the broadcasts by other means, such as interrupting smart TV streams.

“We are #Anonymous. We are involved in the biggest Anonymous op ever seen,” the group tweeted Monday morning. “That being said, we are worried that some governments will indeed see us as a threat and create some scenario to make us look bad (false flag). We only want peace, not war.

“We abhor violence. We are anti-war. We are against police brutality. We have raised our fists in the air to stand against aggressors time and time again. We would never choose to hurt anyone physically. Understand this and know this if any government says otherwise.”

Anonymous also took credit for taking down Russia’s Federal Security Service (FSB) on Saturday too, posting a screenshot of its website not being able to connect.

The hack aimed to show the reality of the war to the people of Russia after the country’s regime effectively outlawed independent journalism last week, imposing a maximum jail sentence of 15 years for spreading what it calls ‘misinformation’, and has made numerous attempts to spread falsehoods about the country’s intentions with its efforts.

Videos supposedly showing a Russian prisoner of war, circulating online in recent days, have shown the soldiers were misled about the situation in Ukraine. The government allegedly told its troops that Ukraine was being occupied by a fascist, Nazi-like regime and they were being sent to help the situation, not cause it.

Access to outside information is slowly closing for Russia’s citizens as the country aims to control the narrative of the war.

The Kremlin blocked access to Facebook and Twitter recently after it said the sites were blocking Russian state-backed media.

Legitimate news sources like BBC News have been restricted too, though people in Russia are still able to access such websites via the TOR browser and onion mirrors.

Reporters from British news organisations have been forced to cease their coverage of the war as a result of the Kremlin’s ‘fake news’ law. In addition to a hostile legal environment for journalists, Sky News reporters also reported being shot at by Russian forces despite them making it clear they were from the press.

Journalists sustained gunshot wounds as a result of the ambush, an act that is considered a war crime under international law.

When you’ve been around the information security business for as long as I have (more than 30 years now) it’s not surprising to get a lot of emails from desperate people looking for help. Sadly, I simply can’t respond to most of them, or I wouldn’t have time to do my job.

Some don’t deserve my guilt for not replying. I’m talking about those who seem to think I’ll either hand out step-by-step instructions for accessing someone else’s social media account or simply do a job because they’ve said “please”. The reasoning behind these requests is most often transparently bogus: “I’ve been locked out of my account and Twitter support won’t help me, my partner is critically ill and I need access to their email for [insert spurious reason here], my partner has been cheating on me and I need proof”.

Wannabe hackers are the bane of my working life, truth be told; unless, that is, they want to become a hacker, an ethical hacker or vulnerability hunter, Odd, then, that I tend to receive very few of these genuine requests for guidance. The ones I do will be pointed in the general direction of great resources that can help them to help themselves. Teaching yourself to hack may seem a bit of a stretch, but you’d be surprised how commonplace this is.

I’m self-taught, not least as there were no accessible educational routes into the game back when I started out. The latest annual report from Bugcrowd, a crowdsourced bug bounty and vulnerability disclosure platform, revealed a staggering 79% of the hackers using the platform were self-taught. I’ll let that sink in for a bit.

These days there are more traditional educational pathways to becoming an information security professional than you can shake a stick at. If you did shake that stick, I daresay a ream of certifications would fall out of the learning tree as well. Vulnerability hunters, the kind of hackers who love tracking down security problems in hardware, software and services, however, tend to be cut from a different cloth. They’re naturally inquisitive, always interested in learning more, and the successful ones have an inert ability to approach problems from a left-field perspective.

With this in mind, it’s no surprise the Bugcrowd report found one in five of their hackers identified as neurodivergent. Obviously, a coding background – be that as a “hobbyist” programmer or someone who has been through the system and come out the other end with some qualifications – is a bonus for anyone beginning on the hacker journey. On the assumption you’re at least code-literate to some degree, though, where do you actually start? This is something I gave a fair bit of thought to recently and, with the help of hacker friends, information security professionals and, indeed, I’ve come up with a learning-to-hack resource list.

Before I get onto the list itself, it bears mentioning that “hacking” is a very broad church with multifarious specialisms. It’s possible to decide in advance that you want to find vulnerabilities in applications, devices, web-based services, cars and so on. A grounding in the basics, however, knowing the essentials of hacking methodology, should be a given across all of these. Start to learn first, specialise later.

Bug bounty and vulnerability hunting platforms themselves will often be a good place to start. Bugcrowd University is one highly recommended resource. It’s free to use, open-source, and has multiple content modules with slides, videos and labs, covering everything from introductions to tooling through to recon and discovery. It goes further than this, though, in that it extends out to other online learning resources on bug hunting methodology, data-driven web hacking, social engineering and so on.

Doing is better than reading, at least for me. It’s how I started my hacking journey decades ago, although largely driven by a lack of reading material (with the exception of the excellent Hacker’s Handbook series). Anyway, with a practical learning experience in mind, it’s hard to ignore the likes of the gamified learning resource that is Try Hack Me or the browser-based and highly interactive Hack The Box Academy. Both cater for varying skill levels, and you can’t fail but learn if you embrace them.

Talking of practicalities, the right tooling is one of the most important parts of your hacking armoury and Burp Suite is right up there. The PortSwigger Web Security Academy is free and from the people who created Burp Suite. It features interactive labs, with the author of The Web Application Hacker’s Handbook leading the team of experts here.

A number of my hacking acquaintances, including some with successful careers in the bug bounty world, recommend scouring the web, conference presentations, info security Twitter, for walkthroughs and explanations of proof-of-concept (PoC) exploits. These can be a highly informative way of understanding how the theoretical stuff works in practice once you’ve got far enough along the learning curve.

Bug bounty platform HackerOne, for example, has a community feed called Hacktivity that showcases the latest hacking activity and enables users to search through the various reports for the ones they’re interested in. There’s even a Hacktivity Con, now in its second year, where hackers of all skill levels can learn from each other.

This is far from an exhaustive collection of hacking resources for the beginner, but it should be enough to provide food for thought as well as, somewhere among these options, a place to start that suits your personality.

There are some ‘don’t’ to be aware of, and they are very important ones so take heed. Don’t go using any of the readily available search tools that will find open hosts and give you immediate root access and so on. You can practise using Kali (an advanced penetration testing Linux distribution) or whatever on your own stuff, but be absolutely sure that it’s only your own stuff and that you don’t stray into opaque territory when it comes to networks used. Hacking any ‘live’ target is a no-no, a big legal no-no, that could see you landing in very hot water indeed.

You’ll find there are plenty of targets to practise on and stay within the law if you use those practical, gamified, learning resources. My personal recommendation is to stick to those resources if you want to be 101% sure you’re on the right side of the law.

Belarusian hacktivists claim to have infected the country's rail network with ransomware in a bid to stop the Russian military from mobilising around Ukraine.

The Cyber Partisan hacktivists claim to have encrypted "the bulk of the servers, databases, and workstations" belonging to the Belarusian Railways, and destroyed their backups, according to posts on Telegram and Twitter.

Cyber Partisan is demanding the release of 50 political prisoners who are in need of medical assistance and assurances that Russian troops will stop mobilising on Belarusian soil - a country that shares a border with Ukraine and whose leader has a close relationship with Vladimir Putin.

"BelZhD, at the command of the terrorist Lukashenko, these days allows the occupying troops to enter our land," the Telegram message read. "As part of the 'Peklo' cyber campaign, we encrypted the bulk of the servers, databases, and workstations of the BelZhD in order to slow down and disrupt the operation of the road. The backups have been destroyed.

"Dozens of databases have been cyberattacked, including AS-Sledd, AS-USOGDP, SAP, AC-Pred, pass.rw.by, uprava, IRC, etc. Automation and security systems were deliberately NOT affected by a cyber attack in order to avoid emergency situations."

In the online posts, the group echoed the message shared by Belarusian rail workers on Friday that more than 33 Russian military trains containing equipment and soldiers would be entering Belarus. The message was also corroborated by reports from other news outlets.

Belarusian Railways published a statement on Monday confirming that it was experiencing difficulties and that some services were unavailable, though no mention of compromised systems, databases, or servers was mentioned - nor was ransomware.

"For technical reasons, services for issuing electronic travel documents are temporarily unavailable," it said. "To arrange travel and return electronic travel documents, please contact the ticket office.

"Currently, work is underway to restore the performance of the systems. Belarusian Railways apologises for the inconvenience caused."

At the time of writing, IT Pro can confirm online ticket sales are still impacted and are unavailable, with customers greeted with the following message.

Tensions in the region

Russia has seized Ukrainian territory in the past and in recent months has stepped up its calls against Ukraine joining European institutions, with a particular focus on Nato. Ukrainians have been preparing for a possible invasion by Russia for months, with many in the region fearful of a war looming.

In recent weeks, both the US and UK have withdrawn significant numbers of embassy staff and their families out of the region, which may indicate that the two allies believe an invasion is likely.

Today, the US has placed 8,500 of its soldiers on alert amid mounting tensions of Russian troops mobilising at the Ukrainian border. Western powers are showing unanimous unity on the matter, saying they will step in with "swift" and "unprecedented" actions if Russia was to invade Ukraine.

The news follows days of unsuccessful negotiations between President Biden and President Putin in Geneva - failed talks that also prompted the FBI, NSA, DHS, and CISA to issue an alert to cyber security professionals that a Russian-linked cyber attack may be launched on critical infrastructure in relation to the worldwide tensions.

"The cybersecurity industry has gotten used to tossing around the idea of ‘nation-state’ adversaries, but I think we’ve yet to see cyber attacks used in concert with a full-fledged military campaign," said Tim Erlin, VP of strategy at Tripwire to IT Pro. "DHS’s warning sets that expectation that something has changed in the threat profile, and that organisations should be prepared for a change in the types of attacks they see."

Brief overview of hacktivism

It's thought the alleged ransomware attack on Belarusian Railways is one of the first times ransomware has been used in hacktivism but the practice of campaigning by hitting systems offline is well documented.

There were a number of high-profile hacktivist 'attacks' in 2021 alone, with right-wing social media platform Parler, and Verkada's surveillance cameras among the victims targeted by hackers. The Adalat Ali hacking group also exposed the beatings and mistreatment of prisoners in Iran's Evin prison in August 2021 out of protest against the abject living conditions.

Anonymous, LulzSec, and WikiLeaks are among some of the most well-known hacktivist groups in the world.

Hacktivism is a controversial practice with some seeing it as an effective means of campaigning while others believe the level of civil disobedience, and often the damage such attacks cause, goes beyond the acceptable level of resistance exhibited in more traditional forms of protest.

The US sees hacktivism as a significant threat and are categorised similarly, in the eyes of the law, to terrorist groups and transnational criminal organisations.

Poly Network has offered its own hacker a $500,000 bug bounty reward for finding the vulnerability which allowed them to orchestrate what is now considered to be the largest cryptocurrency heist to date.

The blockchain platform reportedly offered up the prize after the hacker returned the remainder of the $610 million (£440 million) worth of Ether, Binance, and USDC tokens, stolen in a hack on the platform on Wednesday.

This is according to a Q&A published by the hacker and shared online by Tom Robinson, the co-founder of the London-based blockchain analytics and compliance company Elliptic. Robinson had found the messages “embedded in ethereum transactions sent from the account controlled by the hacker”.

In a note meant for the hacker, Poly Network is quoted as saying: “We appreciate you sharing your experience and we believe your action constitutes white hat behaviour”.

“We plan to offer you a $500,000 bug bounty after you complete the refund fully,” the company told the hacker, before adding that they won’t face any legal repercussions for the heist, describing it as “very helpful”.

The hacker stated that they hadn’t responded to Poly Network’s bug bounty offer, yet added that all the stolen assets will be sent back.

Elliptic analysts had previously speculated that the decision to return the assets could have been motivated by their traceability: the hacker could be “pursued by the authorities” due to leaving “numerous digital breadcrumbs on the blockchain for law enforcement to follow, aided by blockchain analytics tools”.

On Thursday evening, Poly Network stated that “all the remaining assets on Ethereum (except for the frozen USDT) had been transferred to the multisig[nature] wallet controlled by Mr. White Hat and Poly Network”.

“The repayment process has not yet been completed. To ensure the safe recovery of user assets, we hope to maintain communication with Mr. White Hat and convey accurate information to the public,” it said, before adding that “any unfounded allegations and speculation may damage the extremely important process of asset recovery”.

The identity of the hacker continues to be unknown. However, in their Q&A, they had hinted that they do not come from an English-speaking country and had been engaged in hacking from a young age. They also described themselves as a “high profile hacker in the real world” working in the “security industry”.

The hacker behind what is considered to be the biggest cryptocurrency heist in history has now returned $342 million (£247 million) worth of stolen assets.

This is according to Poly Network, a blockchain platform that fell victim to the virtual robbery on Tuesday, having lost $610 million (£440 million) worth of Ether, Binance, and USDC tokens.

The company made the announcement on its Twitter page, that as of 8pm UTC (9pm BST) on Thursday, it had been reunited with $256 million worth of BSC, $4.6 million Ethereum, and $85 million Polygon – more than half of the total stolen assets.

“The remaining is $268M on Ethereum,” Poly Networks stated.

The hacker behind the heist started returning the stolen cryptocurrency tokens on Wednesday afternoon following an open letter published by the company, urging the hackers to “establish communication”. It also asked miners of affected blockchain and crypto exchanges to "blacklist tokens” associated with the hacker’s wallet.

Meanwhile, the hacker decided to explain their reasoning behind the heist by publishing a three-page Q&A which was found embedded in the Ethereum transactions sent to Poly Networks by the hacker.

In the Q&A, which was shared by Elliptic chief scientist & co-founder Tom Robinson, the hacker stated that they hack “for fun” and that they are “not very interested in money”. They added that the stolen assets would be returned in due time in order to preserve their identity:

“I understood the risk of exposing myself even if I don’t do evil,” they said, before adding that they “prefer to stay in the dark and save the world”.

They also alluded to the fact that they might be a white hat hacker, saying that they chose to steal the assets in order to make the public aware of the bug found in Poly Network’s system and prevent the platform from patching it “secretly without any notification”.

However, according to London-based blockchain analytics and compliance company Elliptic, the hacker is unlikely to escape the consequences of their actions:

“Whatever the motivation for the hack, these events have demonstrated how difficult it is [to] profit from theft or any other illicit activity using cryptoassets. The transparency of the blockchains allowed crowd-sourced, real-time collaboration between protocol developers, stablecoin issuers, blockchain analytics companies and the wider community, to ensure the hacker would not be able to disappear with the stolen assets,” its analysis stated.

“Despite the return of the funds, the hacker might well still find themselves being pursued by the authorities. Their activities have left numerous digital breadcrumbs on the blockchain for law enforcement to follow, aided by blockchain analytics tools.”

This article originally appeared in the June edition of IT Pro 20/20, available here. To sign up to receive each new issue in your inbox, click here.

Bryan McAninch grew up with very few computers around him. He was poor, but remembers always having something to tinker with. He also had a supportive grandfather – a secondary school science and maths teacher. One Saturday morning in 1984 McAninch’s grandfather sat him down, aged eight, in front of an Apple IIe in the school lab with a ‘choose your own adventure’ programming book.

“I was hooked like a fish,” McAninch says. “From then on I was in technology. I got into phone phreaking. I got into what we would consider an 80s ‘true’ hacking scene.”

McAninch developed an interest in Linux systems, which led him to networking and eventually network security. He’s worked in penetration testing, incident response, and cloud security. Hacking has become more than a job for McAninch.

“It's not a fashion statement or a movie character,” he says. “It's an identity. And it's something that's really deeply rooted in my own personal character.”

The vilification of hackers

A year before McAninch started coding, film company MGM released WarGames. The film tells the fictional story of a young hacker who, by accident, infiltrates a North American Aerospace Defense Command (NORAD) computer and initiates a World War Three-type situation.

Three years later, in 1986, US President Ronald Regan’s administration introduced the Computer Fraud and Abuse Act (CFAA), which was followed in the UK by the introduction of the Computer Misuse Act (CMA) in 1990. Both pieces of legislation limited hackers’ legal authority to penetrate computer systems. It was this legislation, according to McAninch, that marked the beginning of the world’s vilification of hackers.

Alyssa Miller, business information security officer at S&P Global Ratings, thinks the public’s overall impression of hackers has become distorted.

“Hacking isn’t just cyber criminal activity,” she says. “If you look back at the history of hacking, it comes back to innovators who take technology, tear it apart, figure out how it works, and then improve upon it. Unfortunately, because of things that have happened over the last 30 years or so, the cyber criminals get all of the media attention.”

Media organisations often use the word ‘hacker’ to refer to cyber criminals (IT Pro is, admittedly, also guilty of this). This frustrates many white hats who would prefer to be separated from the criminal side of the industry. Miller believes positive intentions are intrinsic to the role of a hacker and that we should avoid calling anyone else a hacker at all.

“All the work that's happening out there from people like me, Bryan (McAninch), and all the others in this community, kind of gets lost,” explains Miller, “and we become part of this almost clandestine community that people don't really understand and are often afraid of.”

This misunderstanding affects more than hackers’ identities. A spokesperson for the UK’s National Cyber Security Centre (NCSC) tells IT Pro it may contribute to the industry skills gap.

“We are aware that stereotyping can sometimes hold people back from applying for cyber-security job roles,” the spokesperson says. “However, there is a lot of work being done by both Government and industry to address diversity and the cyber-skills gap.”

Despite these warm words, after 30 years of vilification, McAninch decided it was time to do something.

The start of Hacking is NOT a Crime

McAninch was attracted to other subcultures in his youth, so alongside computers he also spent a lot of time skateboarding. With no money to build a ramp or rail in his backyard, like many others, he relied on public stairs and embankments to perform tricks on.

The police would harass him and his friends in an attempt to stop them and, after a while, stickers bearing the words ‘Skateboarding is NOT a Crime’ appeared. It was the skateboarding community’s response to rules it felt were unfair.

Decades later McAninch was chatting to Dustin Dykes, founder of the Dallas Hackers Association, at a local meetup. Both were frustrated with the media’s mischaracterisation of the hacker identity. McAninch had an epiphany.

He made a small graphic with the words ‘Hacking is NOT a Crime’, uploaded it to Sticker Mule, and printed 500 copies of the sticker. It was summer 2018 and security conference Def Con 26 was about to happen, so he handed them out to attendees. They were so popular he took 5,000 to the following year’s event. Since then, Hacking is Not a Crime, or HINAC as it has come to be known, has expanded at a rapid pace. It had 1,500 Twitter followers in August last year. Now it has 15,300.

The movement has grown from a simple stickering campaign to lectures and community outreach. Its international network of 109 advocates across six continents and 21 countries now includes Argentina, China and Pakistan.

More than words

HINAC has come to represent a movement with a much wider scope than the reductionist language often used in the media. It’s about changing the entire public’s perception of hacking and the cyber-security community. McAninch believes that, through this, governments can be convinced to improve legislation like the CFAA and the CMA that create unnecessary barriers for security professionals.

Miller says her CIO once received an email from a hacker when she was working in financial technology. The hacker was disclosing a vulnerability in the company’s online bill payment site, and the CIO’s first reaction was to call lawyers – Miller had to talk him out of it. It’s this type of treatment, which the likes of HINAC say is the result of a distorted public image, that bug-bounty hunters and researchers alike want to change. In fact, 80% of cyber-security professionals in the UK are worried about breaking the law because of the CMA.

McAninch says: “We're advocating global legal reform for security researchers so we can provide them some assurance that when they disclose any sort of privacy or security vulnerabilities, they're not going to receive some sort of legal retaliation.

“As we become more dependent on technology, so too is our security and privacy. So if there's no one out there proactively trying to identify these privacy and security vulnerabilities, the true bad guys are going to do it.”

There is hope for white hats like McAninch and Miller; in the UK, home secretary Priti Patel has announced a formal review of the CMA, for example. But it will take time for the industry to adjust its language and, as with all things, action must follow.

Google has announced the launch of a new bug bounty platform that will make it easier for vulnerability hunters to submit issues.

Available under bughunters.google.com, the platform brings together all of the tech giant’s vulnerability reward programmes (VRP) – Google, Android, Abuse, Chrome, and Play – with hunters able to submit issues using a single intake form.

Moreover, the new platform will provide more opportunities for interaction with other hunters through gamification, including awards and badges for certain bug-reporting achievements.

Google has also improved its VRP leaderboards, which will now be “more functional and aesthetically pleasing”, as well as show the best hunters per country, making it easier to use the results to boost a CV when applying for a job in tech.

The new platform also provides greater emphasis on research and education, making it easier for hunters to publish their bug reports in order to share their knowledge. Hunters will also be able to improve their skills through the newly-launched Bug Hunter University, which includes courses on how to submit a successful vulnerability report.

Research papers on the security of open source will be eligible for a reward, just like open source software patch submissions, while hunters improving security in open source programmes will be eligible to apply for a grant to better secure their own projects.

Commenting on the announcement, Google VRP technical programme manager, Jan Keller, said that when Google launched its “very first VRP” over a decade ago, no one knew “how many valid vulnerabilities – if any – would be submitted on the first day”.

“Everyone on the team put in their estimate, with predictions ranging from zero to 20. In the end, we actually received more than 25 reports, taking all of us by surprise,” he added.

Three years later, the programme was expanded to include open source as well as Google Android and Apache.

“Since its inception, the VRP programme has not only grown significantly in terms of report volume, but the team of security engineers behind it has also expanded – including almost 20 bug hunters who reported vulnerabilities to us and ended up joining the Google VRP team. That is why we are thrilled to bring you this new platform, continue to grow our community of bug hunters and support the skill development of up-and-coming vulnerability researchers,” said Keller.

Microsoft has said it awarded over $13.6 million (£9.87 million) in rewards to security researchers participating in its public bug bounty programmes over the last 12 months.

Between 1 July 2020 and 30 June 2021, over 340 security researchers from across 58 countries participated in the tech giant’s 17 software bug hunts, reporting a total of 1,261 valid vulnerabilities.

The number of participating researchers grew by at least a dozen since the same period last year, when Microsoft awarded $13.7 million to 327 security researchers. Since then, the tech giant has added two more bug bounty programmes, including one for its Teams desktop client with potential rewards of up to $30,000, and saw the number of vulnerability reports increase by 35.

However, despite the reward amount tripling between 2019 and 2020, 2021 saw a slight decrease, of around $100,000.

Over the last 12 months, the highest number of bug reports were submitted from security researchers based in China, the US, Israel, and India. Although the average reward was over $10,000 (£7,260), the largest payout – $200,000 (£145,000) – was awarded for a vulnerability reported in Microsoft’s OS virtualisation technology, Hyper-V, under the Hyper-V Bounty Programme.

Microsoft Security Response Center members Jarek Stanley, Lynn Miyashita, and Madeline Eckert thanked “everyone who shared their research with Microsoft this year and for their partnership in securing millions of customers”, in a statement on the company’s blog.

“We’re constantly evaluating the threat landscape to evolve our programmes and listening to feedback from researchers to help make it easier to share their research. This year, we introduced new challenges and scenarios to award research focused on the highest impact to customer security.

"These focus areas helped us not only discover and fix risks to customer privacy and security, but also offer researchers top awards for their high-impact work,” they said, adding that the Microsoft Security Response Center will share “more bounty programme updates and improvements in the coming year”.

The title of the Most Valuable Security Researcher 2021 is to be announced in August.

Welcome to issue 18 of IT Pro 20/20, distilling the most important themes of the previous month into an easy-to-read package.

In this cyber-security-themed issue, we highlight some of the most pressing challenges facing the industry. Our lead feature looks at the role of white hat hackers across the industry, the challenges they have faced in proving their value to companies, and whether media depictions of the traditional ‘hacker’ are creating unhelpful stereotypes.

We also look at the evolution of the security threat landscape from the 1990s until now, as well as consider whether the sudden appearance of social conscience among hackers may spell the end of the ransomware industry as we know it.

Also in this issue, you’ll find an overview of the most exciting features coming with Windows 11, as well as a look at the motivations fuelling the war against end-to-end encryption.

The next IT Pro 20/20 will be available on 30 July – previous issues can be found here. If you would like to receive each issue in your inbox as they release, you can subscribe to our mailing list here.

Hacking, ransomware attacks and other forms of cybercrime have become a fact of life in the modern age, but while the rates of these attacks have drastically increased, the ability of law enforcement to bring the perpetrators to justice seems to be lagging behind somewhat. Even when suspects are caught, it's rare for cases to result in convictions.

There are a number of factors that contribute to this, including the sophistication of modern anonymisation tools, police resource constraints and jurisdictional difficulties. In this week's episode, we're joined by Jake Moore, ESET cyber security specialist and former digital forensic investigator, to discuss why this is such a problem, and how police can work with the security industry to help solve it.

Footnotes

• IT Pro Live: Inside the mind of a forensic investigator
• LulzSec leader betrays clan as arrests made
• How do you become an ethical hacker?
• The IT Pro Podcast: The secret life of hackers
• The evolution of security
• Funding cuts lead to dodgy digital forensics
• CLOUD Act ends Microsoft's US data privacy dispute
• The Pirate Bay returns to its .org domain
• Open Rights Group calls for government to protect data post-Brexit
• Pen testers arrested after breaking into courthouse that hired them
• British 'hacker' Lauri Love invokes Victorian law in bid to get back seized computers
• What is the Computer Misuse Act?
• Google's about to push everyone into two-factor authentication

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Apple’s AirTag has only been out for around a week, but it’s already been hacked.

A German cyber security researcher cracked the AirTag’s microcontroller, the tiny integrated circuit that controls the device.

The AirTag, a small locator that retails for $29, can help you find your car keys or anything else it’s attached to. Normally, when you use your phone to find an AirTag, your phone opens in the “Find My” website at found.apple.com to initiate the “Lost Mode” process. However, the researcher found he could redirect the microcontroller to his personal website instead.

Security researcher Thomas Roth, who goes by the name Stack Smashing, posted a video of the process to Twitter, and wrote: “After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag."

This means hackers could potentially direct hacked AirTags to phishing or malware sites, and it remains to be seen whether Apple will implement some mechanism to block this sort of attack.

Although this sounds alarming, the tech review website SlashGear cautions that even if a hacker can reprogram an AirTag, “the process and the end result might not yet be worth the worry.”

“The security researcher hasn’t disclosed yet the process but he admits bricking at least two AirTags to get there,” SlashGear noted. “Unless the tracker’s firmware can be modified remotely over the air, the only way you’ll get a hacked AirTag would be if you acquired it through other parties.”

As always, there are proactive ways to avoid falling victim to phishing and malware campaigns like this. When you navigate to a site, always verify the URL looks exactly as you expect. Many times, these spoofed sites will have one character off or a different domain extension.

If you see anything suspicious in the link, close the browser, open a fresh browser and navigate to your target site by typing it manually into the URL bar.

The US Department of Defense (DoD) has expanded its Vulnerability Disclosure Program (VDP) to include all publicly accessible DoD websites and systems.

The VDP is run by the Department of Defense Cyber Crime Center (DC3) to enable security researchers to report vulnerabilities on the DoD Information Network (DoDIN) to improve network defense.

The expansion announced today allows for research and reporting of vulnerabilities related to all DOD publicly accessible networks, frequency-based communication, internet of things (IoT), and industrial control systems, according to Brett Goldstein, the director of the Defense Digital Service. Originally, the program was limited to DoD public-facing websites and applications.

"This expansion is a testament to transforming the government's approach to security and leapfrogging the current state of technology within DOD," he said.

Before the program’s launch, researchers had no way of reporting bugs they found in publicly accessible DoD systems.

“Because of this, many vulnerabilities went unreported," said Goldstein. "The DOD Vulnerability Policy launched in 2016 because we demonstrated the efficacy of working with the hacker community and even hiring hackers to find and fix vulnerabilities in systems."

Since the launch of the Vulnerability Disclosure Program, security researchers have submitted over 29,000 vulnerability reports. Officials said that over 70% of them were determined to be valid.

Experts believe the expansion will lead to a massive increase in the number of bugs reported to them.

"The department has always maintained the perspective that DOD websites were only the beginning as they account for a fraction of our overall attack surface," said DOD Cyber Crime Center director Kristopher Johnson.

In April, the DoD Cyber Crime Center unveiled a 12-month Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP) pilot to enable security researchers to report flaws in DoD contractor partner’s information systems, web properties, and other identified scoped assets. The 12-month program aspires to employ the lessons learned from existing reports made through the Pentagon’s Vulnerability Disclosure Program.

“The expansion of vulnerability research to participating DoD contractor networks replicates the DoD’s’ success by making participating DoD contractor networks available for vulnerability research,” said the DoD's Cyber Crime Center on its HackerOne webpage. “No technology is perfect, but DC3 believes that working with skilled security researchers across the globe is crucial to identifying their weaknesses.”

Last week at an IT security conference, a pair of cyber security researchers demonstrated how they could unlock and open a Tesla’s doors using only a drone outfitted with a Wi-Fi dongle.

They were originally going to demonstrate this at last year’s Pwn2Own hacking competition, but that contest got canceled due to the COVID-19 pandemic. So, they presented it at this year’s CanSecWest conference instead.

You can view the German cyber security experts’ presentation via a 40-minute-long YouTube video. If you want to skip to the action, you can head directly to the 36-minute mark to see them unlock the Tesla.

The hack shouldn’t be possible today, the researchers explained, because the security flaw they exploited got fixed with a software update last October after they informed Tesla about it. However, the researchers said other automakers might have the same vulnerability in their operating systems.

In their presentation, the researchers said they exploited vulnerabilities in ConnMan, an open source software component produced by Inte that functions as an internet connection manager for embedded devices.

The researchers discovered they could exploit this flaw to take control of a Tesla’s infotainment system. From there, they could do anything a driver could do by pressing the buttons on the car’s console, including unlocking the doors and trunk, changing seat positions, playing music, and controlling the air conditioning.

However, they couldn’t start or drive the car.

In the video, they use a drone equipped with a Wi-Fi dongle to remotely hack into a Tesla Model X’s infotainment system. They said this technique worked on Tesla S, 3, X, and Y models from up to 300 feet away.

The really concerning part is that other automakers besides Tesla use ConnMan software. An improved version of ConnMan came out in February, the researchers said, but it’s not clear how many automakers are using it.

Of course, this isn’t the first time hackers or cyber security researchers have targeted Tesla or its vehicles. In March, hackers breached more than 150,000 security cameras at Tesla and internet security provider Cloudflare. Last year, McAfee researchers used a two-inch strip of tape to trick Tesla autopilot systems into accelerating their vehicles 50 mph above the speed limit. Finally, in 2018, security researchers discovered Tesla keyfobs were vulnerable to spoofing attacks that would allow attackers to steal a Tesla simply by walking past the owner and cloning their key.

Four widely-used hacking forums operating on the dark web have been compromised in a series of cyber attacks, with unknown attackers seizing the personal data of members while also siphoning away cash.

Over the past few weeks, attackers have stolen user databases from these forums, which have included email addresses and hashed passwords, according to security researcher Brian Krebs. The incidents have left members of these sites worried that subsequent leaks could reveal their real-world identities.

The most recent hack, affecting an invite-only cyber crime forum known as Maza, took place this week, with security firm Intel 471 revealing that its users were redirected to a breach notification page upon signing in. This was posted alongside a 35-page PDF file allegedly containing a portion of forum user data, comprising more than 3,000 rows of usernames, partially obfuscated password hashes, email addresses, and other contact details.

The Maza hack follows attacks against Verified in January, Crdclub in February, and Exploit last week - all well-known dark web forums. This is in addition to a recent fifth attack against Hydra, a dark web marketplace known for the trade of illegal drugs and other criminal services, according to reports from Russian media.

“The incidents show that even perpetrators of cybercrime aren’t immune from experiencing the fallout that comes with personally identifiable information being made public,” Intel 471 said in a blog post.

“Various cybercrime forums are alive with chatter following the breaches, with nefarious actors wondering if their real-world identities will be discovered thanks to the leaked data.”

Some forum members have speculated these are the efforts of government agencies, although Intel 471 has cast doubt on the theory due to the public nature of these attacks. Krebs also reported that members across these forums have questioned whether the wider strategy is to sow distrust across the community, with cyber criminals now fixated on which platform would be compromised next.

The security company added that while the perpetrators haven’t identified themselves, they have indirectly given researchers an advantage. All information unearthed from these breaches will help in the fight against cyber crime, Intel 471 said, due to the added visibility it gives security teams who are tracking forum members.

Following the initial attack on the Verified forum, hackers then claimed on another site, Raid Forums, that they had taken Verified’s entire database of registered users and associated information, such as private messages, hashed passwords, and posts. The attackers also managed to steal $150,000 (approximately £108,700) worth of cryptocurrency from Verified’s Bitcoin wallet.

Crdclub’s administrator, a month later, announced the forum had sustained an attack in which their own account was compromised. The attacker was able to lure members into using a money transfer service that was supposedly vouched for by administrators, which led to an unknown amount of money being diverted away from the site.

Last week’s attack against Exploit saw a proxy server used to protect against distributed denial of service (DDoS) attacks compromised by an unknown third-party. The forum’s administrator said that a monitoring service had detected secure shell (SSH) access to the server, and had attempted to capture network traffic.

Intel 471 has said its researchers will continue to monitor widely-used cyber crime forums to assess how these incidents have affected members of the hacking community.

The Ministry of Defence (MoD) has introduced its own bug bounty programme through which white hat hackers can disclose vulnerabilities to the UK government department without fear of prosecution.

Partnering up with HackerOne, the MoD has published a submission form that security researchers can use to report any bugs or flaws with systems or platforms managed by the UK’s defence authorities. Unlike bug bounty programmes commonly run by private companies, however, there is no monetary reward available for disclosure.

Researchers who find a security vulnerability relating to an MoD system must include details of the website IP or page where the vulnerability can be observed, a brief description of its nature, and steps to reproduce. These should be a benign and non-destructive proof-of-concept and works to ensure the report can be triaged quickly and with accuracy.

“If you believe you have found a vulnerability on any MOD system, you can report using the Hacker One: submit a vulnerability report,” the MoD said. “We recommend reading this disclosure policy fully before you report any vulnerabilities. This helps ensure that you understand the policy, and act in compliance with it.

“This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause the MOD or partner organisations to be in breach of any legal obligations.”

After you submit a report, the MoD will respond within five working days and will aim to triage the report within ten working days. A representative will keep you informed on its progress throughout the process via HackerOne if you’ve registered for an account.

After the ten-day process has elapsed, the priority for remediation will be assessed based on the impact, severity and exploit complexity. Some flaws may take time to address if they are not deemed a priority, and researchers are welcome to enquire on the status of their reports. However, the MoD stressed they should only check in once every fortnight at a maximum.

The MoD will then report back when the vulnerability is fixed, with researchers invited to confirm the solution fixes the problem adequate. Future public disclosure arrangements will then be subject to co-ordination between researchers and the MoD.

Researchers seeking to report a vulnerability must abide by a set of strict protocols, however. They must not, for example, break any law, access unnecessary of significant amounts of data, modify data in MoD systems, disrupt any systems, use high-intensity invasive of destructive scanning tool, or attempt any form of denial of service.

Also out of bounds is social engineering or phishing exercises, demanding financial compensation to disclose vulnerabilities, submitting reports detailing non-exploitable flaws, or submitting reports detailing TLS configuration weaknesses.

The MoD claims its policy is compatible with common industry-wide vulnerability disclosure practices, and that it does not give white hat hackers or security researchers permission to act in any way that’s inconsistent with the law.

The government department will not, however, seek prosecution of any researcher who reports vulnerabilities on MoD services or systems where they’ve acted in good faith and in accordance with the disclosure policy.

Apple has paid a group of ethical hackers $288,500 (£222,813) for finding and disclosing critical vulnerabilities in its network, some of which could have provided access to company infrastructure and iCloud data.

Since 6 July of this year, Sam Curry, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes have worked together as a part of Apple’s bug bounty programme. The team managed to discover a total of 55 vulnerabilities, 11 of which were of critical severity, 29 of high severity, 13 of medium severity, and two of low severity.

The 11 most critical bugs made it possible for the group to access Apple’s infrastructure and use it to potentially steal confidential information such as private emails and iCloud data.

Sam Curry said that the team “found a variety of vulnerabilities in core portions of [Apple’s] infrastructure that would've allowed an attacker to fully compromise both customer and employee applications, launch a worm capable of automatically taking over a victim's iCloud account" and "fully compromise an industrial control warehouse software used by Apple", as detailed in a blog covering three months of research.

He added that exploits may have also allowed hackers to "take over the sessions of Apple employees with the capability of accessing management tools and sensitive resources".

The 11 vulnerabilities found to be critical were as follows:

• Remote Code Execution via Authorization and Authentication Bypass
• Authentication Bypass via Misconfigured Permissions allows Global Administrator Access
• Command Injection via Unsanitized Filename Argument
• Remote Code Execution via Leaked Secret and Exposed Administrator Tool
• Memory Leak leads to Employee and User Account Compromise allowing access to various internal applications
• Vertica SQL Injection via Unsanitized Input Parameter
• Wormable Stored XSS allows Attacker to Fully Compromise Victim iCloud Account
• Wormable Stored XSS allows Attacker to Fully Compromise Victim iCloud Account
• Full Response SSRF allows Attacker to Read Internal Source Code and Access Protected Resources
• Blind XSS allows Attacker to Access Internal Support Portal for Customer and Employee Issue Tracking
• Server-Side PhantomJS Execution allows attacker to Access Internal Resources and Retrieve AWS IAM Keys

According to Curry, the “vast majority” of the 55 vulnerabilities have already been fixed.

“They were typically remediated within 1-2 business days (with some being fixed in as little as 4-6 hours),” he added.

Apple has so far paid the team a total of $288,500 for discovering the vulnerabilities, yet they could be awarded another quarter of a million dollars when the tech giant processes the entirety of their report.

An ethical hacker has been awarded $3,000 (£2,300) for disclosing a security vulnerability that could have lead to the exposure of private GitLab groups.

Solutions architect Riccardo Padovani first encountered the vulnerability in November 2019. He promptly informed GitLab to the fact that private projects which were formerly public could have been accessed by other parties through vulnerable search APIs.

Although the issue was disclosed almost a year ago, the report was only made public on 6 October.

As explained by Padavani on the bug bounty platform HackerOne: "Alice creates the public group 'Example', and a public project named 'Example-project' inside the group. In the readme of the project, Alice writes 'Example'. Now, Alice creates a private group called 'private', and transfers all the 'Example' group to the 'private' group.

'If Bob (totally unrelated to Alice) searches for 'Example' instance-wide, he will not find anything [... but if he] uses APIs, he will receive the results back with the information that should be private,” he wrote, adding that the issue only arises when entire groups are transferred, as opposed to single projects.

GitLab software security expert Jeremy Matos verified this finding and escalated the issue to GitLab’s engineering team. The DevOps tool patched the vulnerability in GitLab version 12.5.4 and awarded Padavani with $3,000 for disclosing it.

Bug bounty hunting, which is a form of ethical hacking that focuses on finding and disclosing security issues, is becoming an increasingly popular source of income for security experts.

In August, it was reported that Microsoft paid out $13.7 million (roughly £10.5 million) across 15 bounty programmes during the previous 12 months, more than three times the amount paid out to researchers in the same period during 2018/19. The company rewarded 327 researchers for identifying bugs and flaws in Microsoft software, with 1,226 eligible vulnerability reports being filed during the period. The biggest single reward was $200,000.

CREST chairman Ian Glover previously told IT Pro that "the demand for high-quality individuals working for professional companies far outstrips supply."

"The UK is seen as one of the leaders in this area and the opportunity to work on international projects is increasing every day,” he said, adding that a registered level professional would expect to earn in the region of £55,000 and a team leader could be looking at more than £90,000.

Hacking is one of the glitzier parts of IT, and Hollywood frequently bombards us with images of black-clad hackers hunched malevolently over glowing screens. Sadly, real-world hacking isn’t quite as glamorous as it’s often made out to be - but that doesn’t mean it’s not a fascinating and lively career.

In this week’s episode, we sit down with professional pen-tester and Cyberis director Gemma Moore to find out what the life of a hacker for hire is really like, the common security holes that intruders exploit, and why laziness is a hacker’s greatest weapon.

Elsewhere, we discuss the Twitterpocalypse which saw verified users barred from tweeting, and the landmark decision by the government to remove Huawei from the UK’s 5G networks, as well as what it could mean for UK businesses.

Footnotes

News

Twitter

• Obama, Biden and Musk Twitter accounts hacked in Bitcoin scam
• Twitter hack exposes 250,000 user details (2013)

Huawei

• Why the Huawei ban could be disastrous for UK businesses
• The Man has ruined my Huawei P40
• US officially designates Huawei and ZTE as national security threats
• Can tech survive without China?
• Deutsche Telekom tells Nokia to shape up with Huawei ban looming
• Ericsson increases 5G forecast as data demand surges
• Gigabit broadband and 5G could jumpstart the UK economy, report claims
• Can the UK develop a 5G giant to take on Huawei?

In-depth

• Ethics of red team security testing questioned in new report
• Stories from the front line: The secrets of the Red Team revealed
• What is phishing?
• 10 quick tips to identifying phishing emails
• IT pros air their opinions on phishing employees
• The IT Pro Podcast: How do we fix security?
• HP announces lockdown-friendly security products
• Most UK workers don't want to return to the office
• What hackers don’t want you to know
• Why business resilience matters in times of crisis (and beyond)

Subscribe

Positive Technologies has found that 14 banking apps available on iOS and Android were affected by vulnerabilities.

In 2019, Positive Technologies assessed the security level of a number of banking apps and found vulnerabilities in each one. Per the report, each vulnerability could be traced to faults in the application code, client-server interaction and the implementation of security mechanisms.

On the user-side, Positive Technologies found 13 out of 14 applications unwittingly gave attackers access to user data. For more than a third of the banking apps tests, vulnerabilities could be exploited without administrator rights. Further, 76% of these vulnerabilities could be exploited without the attacker having physical access to the account holder’s device.

On the server-side, researchers found servers contained 54% of all vulnerabilities identified in the study. According to Positive Technologies, each mobile bank had an average of 23 server-side vulnerabilities. Plus, at five out of seven banks, hackers were able to steal user credentials and at one-third of banks, users’ card information is at risk of being stolen.

Though these statistics are staggering enough, the FBI recently revealed a 50% increase in attacks against mobile banking apps since the beginning of 2020. In its announcement, the FBI said it expects threat actors to attempt to exploit mobile banking customers by using a variety of techniques, such as app-based banking Trojans and even fake banking apps.

To protect themselves, users should use two-factor authentication along with a strong password.

Apple awarded $100,000 to Bhavuk Jain for identifying a security vulnerability in the "Sign in with Apple" feature found on some websites and third-party applications. Hackers could use the bug to take control of a user's account.

Apple's servers use a JSON Web Token, which can contain the user’s Apple ID email address, to verify a user account during the “Sign in with Apple” process.

Jain discovered he could request a JSON Web Token for a real Apple account, and the signature would be verified each time. With an email address connected to an Apple ID, a hacker could to get a validated token and access the account.

Apple reviewed server logs during the patching process and determined the flaw had not been exploited. Accounts using two-factor authentication are less likely to be vulnerable to this bug.

This type of hacking-for-pay is relatively common today. Apple and other tech companies use bounty programs to encourage white-hat hackers to uncover vulnerabilities in their software.

This allows companies to patch flaws before they are made public for a fraction of the cost of fixing hacks post-mortem. Companies pay the most substantial bounties for exposing serious vulnerabilities.

The US Air Force is offering $50,000 to help shore up its satellite cyber security as part of an online challenge called Hack-A-Sat.

The event, which kicks off on 22 May with a final round set for August, has been developed in partnership with the US Defense Digital Service, the digital arm of the Department of Defense.

Due to the outbreak of COVID-19, the hackathon has been moved entirely online and aims to help improve cyber security safeguards ahead of the Pentagon's rollout of a satellite constellation network later this year.

The Hack-A-Sat challenge is open to hackers around the world and will begin with a 48-hour 'Capture the Flag' first-round. Participants will be given a set of challenges in one of several categories on a Jeopardy-style board. The first team to solve a challenge has the ability to unlock the next challenge in any given category, with each solved challenge resulting in the competitor retrieving a 'flag'. 'Redemption' of this flag by another team results in points being awarded to the challenger.

The final will be contested from 7 to 9 August where the top three constants will have the chance to attempt to hack a virtualized satellite and win $50,000, with $30,000 awarded to second and $20,000 for third.

"The democratization of space has opened up a new frontier for exploration and innovation," the Hack-A-Sat website reads. "But with this opportunity, new cyber security vulnerabilities are also being created. One human can design, build and launch a satellite, adhering to very few standards and security protocols. So how can we achieve safe, reliable and trustworthy operations to truly realize the promise of space? ...by hacking a satellite."

The event takes place at the virtual Aerospace Village at DEFCON, which will also host workshops for satellite hacking and avionics.

American journalist Glenn Greenwald has been arrested in Brazil and accused of hacking into the mobile phones of public officials following an investigation.

The reporter gained notoriety for his prominent role in publishing classified material that former National Security Agency (NSA) analyst Edward Snowden obtained from the US government agency in 2013.

Through his publication, the Intercept Brasil, Greenwald published articles based on information obtained from the leaked messages of public officials within the right-wing Brazilian government.

The articles accused key members of Brazil’s justice system, and the Jair Bolsonaro-led government, of engaging in corruption.

Brazil’s public prosecutors have responded in kind by charging Greenwald with cyber crimes and for being part of a criminal organisation that allegedly hacked into these individuals’ devices, according to the New York Times.

The 95-page criminal complaint alleges that the reporter had gone beyond simply publishing information that was passed to him, but played a “clear role in facilitating the commission of a crime”. Greenwald is said to have encouraged the hackers to delete archives that have already been shared in order to cover their tracks, authorities claim.

The Electronic Frontier Foundation, an organisation committed to campaigning for digital rights, has blasted the Brazilian government for charging the reporter under its computer crime laws.

“EFF has long warned that cybersecurity laws in the Americas have been written and interpreted so broadly as to invite misuse,” the organisation said in a statement. “Computer crime laws should never be used to criminalize legitimate journalistic practice. Prosecutors must not apply them without considering the chilling effects on the free press, and the risk of politicized prosecutions.

“It is a threat to democracy when authorities use cybercrime laws to punish their critics, as the Brazilian government has done here with Glenn Greenwald, and it discourages journalists from using technology to best serve the public.”

President Bolsonaro, himself, commented in July 2019 that he would relish seeing the journalist spend time in prison after he had published articles damaging his presidency. Greenwald, at the time, raised concerns that the authorities may respond by arresting and charging him.

This led to the country’s Supreme Court justice to issue an order preventing federal police from investigating the journalist’s activities with regards to the leaked information.

The prosecutors who charged Greenwald, however, said they had found audio messages that implicated the reporter in criminal activity.

Greenwald himself has denied the charges, and suggested in a statement that the country’s Federal Police examined the same evidence and explicitly stated that he had not committed any of the crimes he’s been charged with. Edward Snowden, moreover, has branded these charges as “unbelievable, unsupported, and indefensible”.

Photo by Robert O'Neill / CC BY 2.0

Provider of bug bounty support to major global organisations HackerOne has paid one of its members for exposing an internal security breach.

A reward of $20,000 (£15,244) has been given to haxta4ok00, the bug hunter who exposed the mistake committed by a staffer at the company which helps the likes of Uber, Goldman Sachs and the US Department of Defense offer bug bounties of their own.

The bug hunter was potentially able to view the records and private, undisclosed vulnerabilities of HackerOne's biggest clients due to what the company is calling a "human error".

A HackerOne security analyst tasked with verifying disclosure reports from bug hunters sent a URL loaded with their session cookie information which the hunter was able to use to view things on the site only logged-in staffers should be able to.

Sending URLs between analyst and hunter is a routine process, HackerOne said in a report.

"When a security analyst fails to reproduce a potentially valid security vulnerability, they go back and forth with the hacker to better understand the report," said HackerOne. "During this dialogue, security analysts may include steps they've taken in their response to the report, including HTTP requests that they made to reproduce.

"In this particular case, parts of a cURL command, copied from a browser console, were not removed before posting it to the report, disclosing the session cookie," it added.

The company confirmed that the event lasted only a short time and was not carried out with malicious intent. No undisclosed vulnerabilities were stolen, exploited or published as a result of the incident. All copies of potentially sensitive information were deleted.

"Similar to previously disclosed incidents or weaknesses within BugZilla or Google Issue Tracker, exposure of non-public HackerOne reports presents an immediate danger to not only businesses with hosted programs but also effectively all Internet users," said Craig Young, senior security researcher at Tripwire.

"While I commend HackerOne for their response, this incident is yet another reminder of the distinct risk organisations take by using managed vulnerability reporting services like BugCrowd or HackerOne," he added. "The consolidation of valuable data by such vendors creates a hugely attractive attack target for intelligence agencies (or even criminal actors) to fill their arsenal."

Something that seemed to concern Jobert Abma, co-founder of HackerOne and the individual responsible for following-up with haxta4ok00, was the observation he made regarding the sheer number of pages the hunter opened while accessing a privileged account.

"We didn't find it necessary for you to have opened all the reports and pages in order to validate you had access to the account," said Abma. "Would you mind explaining why you did so to us?"

"I did it to show the impact," said haxta4ok00. "I didn't mean any harm by it. I reported it to you at once.

"I apologise if I did anything wrong, but it was just a white hack," the bug hunter added.

The issue was given a CVSS score of 8.3, which is considered "high", not as severe as the likes of BlueKeep, for example.

It’s important to know what the Computer Misuse Act (CMA) is, as it forms the backbone of law enforcement against hacking in the UK. It’s through this law that UK legislators enforce protections for devices and data and in the UK, like their international counterparts.

The CMA was first introduced in the UK in 1990 and sought to draw boundaries between lawful and unlawful access to a computer system and its data. The CMA intended to criminalize any unauthorized activity of this nature.

The UK government has updated the CMA several times in the decades since, to match contemporary cyber threats. A particularly major overhaul was passed in 2015, which aligned the CMA with EU law and with the Serious Crime Act 2015 through added protections for attacks on personal property.

Some have argued that the CMA is seriously out of date and should be subjected to a more radical overhaul to address growing attacks on the UK and new concerns such as the cyber security implications of generative AI.

Computer Misuse Act summary and criticisms

The CMA is used to protect against and prosecute hackers and would-be cyber criminals. In 2022, computer misuse accounted for 14% of total UK crime and the CMA has provisions to cover a broad variety of criminal digital activity.

One of several laws that protects the devices and data of UK citizens, the CMA sits alongside the Data Protection Act 2018 and UK GDPR. It has alsom been joined by government projects such as the UK’s National Cyber Strategy, which seeks to shore up the UK’s digital skills.

The first level applies if one gains unauthorized access to a computer without permission, you could face a penalty of up to two years in prison and a £5,000 ($6,254) fine.

Those who gain access to a computer without permission to steal data or take part in another crime, such as using that data to commit fraud, will be tried under the second penalty level. For this, you face a sentence of up to 10 years in prison and can receive an unlimited fine. The extent of the punishment depends on the severity of the individual case, and the prosecution has to prove they had intent to commit another crime with illicit access, which can be difficult.

If one modifies the content of a computer or provides the tools for others to alter or destroy them, for example through the sale of ransomware, they could face a prison sentence of up to ten years alongside an unlimited fine.

The final level relates to those who perform acts that cause or risk causing serious material damage. It carries a maximum prison sentence of 14 years, but if this potential damage is found to threaten human well-being or put national security at risk the sentence could be up to life imprisonment.

The legislation was additionally amended in 2015, thanks to the Serious Crime Act, which included specific passages on computer misuse and introduced three alterations to the original law. Amendments in Section 3ZA defined unauthorized acts causing serious damage as offenses and brought the EU Directive on Attacks against Information Systems into law in the UK. It also sought to clarify the "savings" provision that protects law enforcement from prosecution for acts performed on computers under powers of inspection or examination.

In a fact sheet [PDF], the government stated that the new offense of unauthorized acts causing serious damage "addresses the most serious cyber attacks, for example, those on essential systems controlling power supply, communications, food or fuel distribution". 

This helped to align the CMA with the severe nature of modern cyber crime, with organizations such as the National Cyber Security Centre (NCSC) having warned of advanced attacks on critical national infrastructure (CNI) by Russia-aligned threat actors. The government’s own National Risk Register (NRR) report has also compared cyber threats to chemical weapons in terms of severity, particularly those that could affect critical utilities.

Until this provision, the most serious crime covered by the act was the aforementioned section 3 offense of unauthorized access to impair the operation of a computer, which carries a maximum penalty of 10 years. The government argued that this "did not sufficiently reflect the level of personal and economic harm that a major cyber attack on critical systems could cause". Therefore, conviction under the new offense can result in a more severe prison sentence, of up to 14 years.

Changes made regarding the EU Directive on Attacks against Information Systems extended extraterritorial jurisdiction, increasing the ease with which cyber criminals using the UK as a base of operations can be prosecuted. It applies even if they are not physically located within the UK, and also allows the police and Crown Prosecution Service (CPS) to pursue and prosecute UK residents for cyber crimes committed overseas.

"The changes do not extend law enforcement agencies' powers but merely clarify the use of existing powers (derived from other enactments, wherever exercised) in the context of the offenses in the 1990 Act," it added.

However, civil rights groups including Privacy International have argued that the changes are far too broad, and that complete legal exemption for police and spy agencies such as MI5 is excessive and unwarranted. Privacy raised concerns in a case to the European Court of Human Rights along with five other complainants.

Is the Computer Misuse Act fit for purpose?

Recent years have seen repeated calls to reform or scrap the CMA, with many security researchers and law enforcement professionals citing its ability to cope with the complexities of modern-day computing.

Some point to the act’s relatively poor record of backing criminal investigations, with around less than 1% of computer hacking offenses investigated in the UK in 2019 resulting in prosecution. The National Fraud Intelligence Bureau (NFIB) does not link individual computer misuse offenses to their outcomes, which makes analysis of its effectiveness difficult. 

There is also little evidence of the CMA acting as a deterrent to criminals, with the 850,000 offenses of computer misuse reported by the Crime Survey for England and Wales (CSEW) in the year ending June 2023 similar to the 876,000 offenses recorded in the year ending March 2020. Much CMA criticism hinges on the limitations of the act’s definitions and its binary view on hacking.

The definition of 'computer' in the Act

Perhaps the most obvious criticism is that the act represents a time when ‘computer’ is mainly referred to as a desktop or all-in-one PC. In this regard, it fails to account for much of the innovation of the 21st century, putting it well out of step with the demands of the modern world.

“The Computer Misuse Act 1990 contains several issues that apply subjectivity when objectivity should be the test,” argues Tim Mackey, principal security strategist at the Synopsys Cybersecurity Research Centre. “The term “computer” isn’t defined and the contemporary definition of “computer” has likely shifted in the intervening thirty years.”

This lack of clear definition creates a “grey area”, adds Mackey, where prosecutors are forced to apply the act based on subjective interpretation, rather than objective information.

“This can lead to interesting scenarios that would question whether a smartphone, nanny-cam, Wi-Fi-connected dishwasher, or CCTV system are in fact computers – despite the reality that each of these devices often runs a general-purpose operating system, is connected to a network, and runs software at the behest of its user.”

Failure to keep up with novel cyber threats

Another area of criticism for the CMA is that it has failed to keep up with the developments in cyber crime landscape such as the rise in identity-based attacks and business email compromise (BEC).

“The types of crime the act was originally designed to fight are actually decreasing – but new threats are emerging seemingly every month,” says Peter Yapp, Partner at law firm Schillings and former deputy director of the UK’s NCSC. “For example, hacking for extortion has nearly doubled over the past year while virus/malware reports have dropped. This underlines one of the main shortfalls of the act – the evolution of using computers to commit fraud to the computer becoming the main conduit for fraud.”

The subjective interpretation of the Act ultimately drives a wedge between the legal system and security researchers, and some have argued that judges often appear to misunderstand the wider issues facing the industry.

“In essence, the Act isn’t working for cyber security practitioners, law enforcement officers, the Crown Prosecution Office and the Courts,” adds Yapp. “Even more worryingly, judges don’t seem to understand the issues. For example, Southwark Crown Court is supposedly a specialist fraud center that deals with the majority of the serious and major fraud cases in England and Wales, but its level of understanding around computer crime isn’t sufficient to facilitate any significant number of successful prosecutions. The police have dedicated many more resources to this area over the past five years, but until every police officer understands cybercrime, we will be playing catch up.”

Richard Millett, training development manager at Firebrand Training and regular cyber security advisor for police forces across the UK, explains that many cyber crime cases are instead tried under other legislation, such as fraud and theft, not only because of a lack of definitions but also because it allows stricter penalties to be issued.

“If you look at the tariffs for the various sections under the [Computer Misuse] Act you see that the penalties defined do not match the severity of some of the offenses that have been committed,” says Millett. “It is only when you look at section 3za which covers “causing or creating a risk of serious damage” do you see tariffs of “imprisonment for life”. The financial and economic damage that has been inflicted by some individuals is not reflected in the penalties that have been applied, running into millions in many cases.”

How the Computer Misuse Act limits ethical hacking

The greatest challenge facing cyber security researchers trying to operate within the scope of the act is its failure to distinguish between criminal and ethical hacking.

As Rob Shooter, managing partner of law firm Fieldfisher explains to ITPro, many in the industry argue that offenses under the CMA are too “broad brush”, leaving cyber security researchers with little legal room to perform ethical hacking against cyber criminals.

The Act defines non-consensually accessing a computer system as a crime, regardless of the intent or benefits that may come about as a result of the action. Technically, this means that core cyber security skills and research tasks used to analyze potential threats from probing for vulnerability management, file interrogation, or analyzing compromised systems are illegal unless consent has been given by both the victim and perpetrator of the crime.

“As an example, there are a multitude of US-based companies offering vulnerability scanning services of the extended supply chain, whereas there are few, if any, UK companies offering the same service,” explains Yapp.

Although this technicality may limit the actions of ethical hacking or may leave some wary about potential prosecution, Yapp adds that he is unaware of any cases involving UK researchers being sanctioned by law enforcement as a direct result of their work.

Often depicted as hooded basement-dwellers, faces lit only by blue light, hackers come in all shapes and sizes - and notably wear different coloured hats. The annoying, destruction-wielding hackers are known as black hats whereas those who use their hacking abilities for ethical, productive purposes are known as white hats.

Ethical hackers are in short supply in the industry and they serve an important purpose in the overall protection of modern businesses and other organisations. The old saying ‘attack is the best form of defence’ certainly rings true in the cyber security industry, and it’s why ethical hackers are paid handsomely for their services. Their role is to use their hacking abilities and knowledge of systems to find security vulnerabilities in software and infrastructure so they can be patched before criminals can exploit them.

Their work is invaluable to businesses that handle large quantities of sensitive or personally identifiable information, or those that are subject to tight regulations such as banking and financial services firms.

White hats can most commonly be found working in-house at businesses or independently, either as contractors or as modern-day bounty hunters - hackers who look for security vulnerabilities in companies that offer bug bounty programmes. There are a number of large companies such as Apple and Microsoft that offer lucrative bug bounties that increase in monetary reward based on how severe the vulnerability is.

There are a multitude of routes one can take to become an ethical hacker and, as previously mentioned, a number of different ways these hackers can monetise their skill set. The cyber security industry has been intent on attracting new talent to the scene and there is an abundance of resources to get you on your way to becoming a fully-fledged white hat.

What is an ethical hacker?

Before delving any deeper, it's important to clear up any misconceptions of what an ethical hacker is, rather than making judgements on what's morally right and wrong.

Jeff Schmidt, global head of business continuity, security and governance at BT, describes an ethical hacker as a computer security expert. They must specialise in penetration testing (i.e. working out how easy it is to break into computer systems) and other testing methods to ensure infrastructure is sufficiently secured against potential hacks.

However, another expert in the field of cyber security, Conrad Constantine, a research team engineer at AlienVault, thinks the description of any role as a "hacker," whether ethical or not, is irrelevant.

"Nobody says they are going to go see an ethical locksmith or an ethical lawyer do they?" he told IT Pro.

But what the role is called is simply semantics. It could be we decide to refer to them as a white hat hacker or penetration tester. The important differentiator between an ethical hacker and a criminal hacker is that the former carries out security testing with the full consent of the company they are working on behalf of.

If they did not have permission, the offence would be punishable under the Computer Misuse Act.

Ian Glover, chairman of CREST, prefers the penetration tester label and his definition goes a little further in that it recognises you need to be more than just a techie in order to truly fulfil the role. He believes you need to have consultancy skills as well.

A penetration tester, he says, has to be able to "communicate the results of the tests at a level tailored to the audience", Glover says, and "provide technical consultancy and recommendations to customers as to how any reported vulnerabilities could be mitigated".

What certifications and training do ethical hackers need?

OK, so talking of the necessary skills for the job, what qualifications do you need? Peter Chadha, chief executive and founder of DrPete, reckons that all you need is "a vast amount of technical knowledge of IT systems and software and, in particular, how to exploit their vulnerabilities", but acknowledges that there are formal qualifications available.

"Most commonly the EC-Council Certified Ethical Hacker certification, a self-study or classroom course with a 200 multiple choice question exam at the end," Chadha says, adding: "Communications-Electronics Security Group (CESG) [now part of the National Cyber Security Centre] approval is also required for any penetration test on a company, and this is appointed by a government department."

This involves the CHECK scheme, where penetration testers prove themselves through practical examination under lab conditions. "There are two levels of approval," Chadha explains. "A penetration test member and a penetration test team lead, and government departments will require at least one team lead working on any project."

Phil Robinson, director of Digital Assurance and a Founder Associate Member of the Institute of Information Security Professionals points towards the Tiger Scheme and CREST certifications. "There are entry level testing certifications, for those wishing to be part of a testing team and working under the management of a team leader, and senior testing certifications for more experienced individuals to either work on their own or to lead a team," Robinson told IT Pro.

"It also helps to have a reasonable general background and experience alongside certifications such as a Masters in Information Security," he added.

As far as the CREST certification is concerned, Ian Glover points out that in order to pass at the lower level a candidate will need "knowledge and skills on a wide range of relevant subjects, and in addition they would normally require two to three years regular and frequent practical experience, equating to about 6,000 hours experience and research." When it comes to the higher level that increases to five years or 10,000 hours.

Can cyber criminals become ethical hackers?

But what about if that 'experience and research' was largely garnered on, for want of a better phrase, the dark side? Can, and do, black hat hackers cross the divide and enter the legit world of the penetration tester?

Dominique Karg, is the co-founder and brilliantly titled chief hacking officer at AlienVault. He has no problem with poachers turned gamekeeper.

"I think they're the only ones that can do the job well," he says, adding "I got my ethical hacking job that way. I had to choose between being taught something I already knew at the university or getting paid for what I liked to do anyway. The decision was easy."

Ian Glover agrees that we have to recognise where the industry has come from. "There are individuals within the industry that have crossed from the dark to the light," he says, but warns that the situation is changing very quickly.

"There is no reason now to have worked on the dark side to enter or progress in the industry," Glover argues, concluding "in fact the high ethical standards that CREST member companies sign up to would make it difficult for them to employ such individuals."

Marcus Ranum, chief security officer at Tenable Network Security, thinks that a track record as a recreational hacker simply shows errors in judgement and a willingness to put self-interest first. "That's not something that should impress a prospective client," he insists. "After all, if you were acting like a sociopath last month, why should I believe you're not one today?"

What kinds of ethical hacker job roles are available?

Much like how cyber security as an industry is somewhat of a catch-all term for different sub-fields, the term ‘ethical hacker’ also encompasses many different types of jobs, the most common and perhaps most glamorised being a penetration tester.

Penetration testers, or pen testers, are hired to probe a business for cyber security weaknesses through both digital and kinetic means. Some penetration testers are hired to assess the physical security of a company’s office building, for example, since this can be an entry point through which hackers could conduct local attacks. Other common job roles are security analysts, information security consultants, and network security specialists.

There are also opportunities to get involved in corporate red team-blue team exercises, which involve cyber security staff taking part in virtual war games to hone skills and ensure everyone is prepared to face a real cyber attack when the time comes. Ethical hackers will typically get drafted in to participate on the red team - the offensive team the company’s staff try to keep out of their systems - and these kinds of roles can often pay well too, especially on a contract or consultancy basis.

What's the average salary for an ethical hacker?

Experts speaking to IT Pro all said that there is plenty of money to be made as an ethical hacker, with the demand for such talents far outweighing the supply. Newcomers to the job market can expect to make around £25,000, according to Ian Glover, while a registered professional with some experience could be looking at a salary in the region of £55,000. A team leader should be expecting even more; a sum north of £90,000 would be about right in the current market.

Peter Chadha adds that a penetration tester working as a contractor can easily earn between £400-£500 a day. As for market buoyancy, Glover told IT Pro that "the demand for high-quality individuals working for professional companies far outstrips supply."

"The UK is seen as one of the leaders in this area and the opportunity to work on international projects is increasing every day."

John Yeo, director at Trustwave SpiderLabs, put it in a nutshell when he told us that given the recent uptick in mainstream media awareness of the types of malicious compromises that take place on a regular basis, and the reality that now cyber security is much higher on every organisation's executive agenda "in many respects it has never been better".

Another way to ethically make money from hacking is to take part in bug bounty programmes, which are used by companies like Google, Microsoft, Uber, and even PornHub to encourage hackers to discreetly report flaws instead of exploiting them. However, bug bounty programmes aren’t only reserved for major tech companies. The UK’s Ministry of Defence (MoD) recently introduced its own programme through which white hat hackers can disclose vulnerabilities to the UK government department without fear of prosecution.

Apple is especially well-known for handsomely rewarding its ethical hackers, having launched a bug bounty programme in 2016 which pays security experts between $25,000 (£18,000) and $1 million (£720,000) for a disclosed security issue. What's more, the company states that vulnerabilities which “were previously unknown to Apple” could potentially “result in a 50% additional bonus” added to the payout.

In October 2020, the tech giant paid a team of penetration testers at least $288,500 (£222,813) for finding and disclosing critical vulnerabilities in its network. Out of the 55 bugs reported by the team, the 11 most critical ones made it possible to access Apple’s infrastructure and use it to potentially steal confidential information such as private emails and iCloud data.

Only a few months prior, developer Bhavuk Jain managed to identify a security vulnerability in the "Sign in with Apple" feature which could have been used to enable hackers to take control of a user's account. For this discovery, the tech giant chose to award Jain with a $100,000 (£72,280) payout.

So what are you waiting for?

How to apply for a job as an ethical hacker

Who should you approach if you actually want to get started in the penetration testing field? We ask the experts...

• Ian Glover: "Anyone interested in a career in the industry should contact CREST who will provide advice and guidance on the best way to enter and then progress in the industry. We are also working with a number of universities to provide internship and work placement opportunities for individuals, with a great deal of success."
• Marcus Ranum: "Get a job working as an auditor. Penetration testing can be thought of as a 'more aggressive audit' and there's a lot of intellectual overlap in the field."
• Jeff Schmidt: "The Cyber Security Challenge UK is a good starting point to get an understanding of the cyber learning opportunities and careers within the industry."
• Peter Chadha: "Search for the equivalent of CESG team members and network with them to build connections and knowledge in this area."
• John Yeo: "Invest the time and effort in going to conferences and get to know the various characters within the industries for which this isn't just a day a job, but enjoy it so much that they're regulars on the conference circuit."