escrow @escrow_

If the sandbox escape was so advanced then publish the details.

@Hacker0x01 Could you clarify what the "12+ years of real-world vulnerability data" consists of, given that this was avoided in your refactor?

@5mukx Should have said "Sorry, we can't tell you. You need OSED for this"

@ZeroK_____ I think if the user has enough money to play around with / burn, and the agent is built correctly such that it can target these "actual exploitable issues", then sure, why not. Otherwise, no, as it is more than likely to be a perpetual negative ROI, and/or too risky.

@p6rkdoye0n But you can just ban the malicious peer that is providing falsified heights and sync w/o an issue post-ban? Plus, the attacker can't do much with this if the workaround is so easy - even if they scale. I also see an informational, and not a 0day or a 7.1 to be honest.

@mSanterre @mxcl @yacineMTB FYI, Chrome does not have the biggest bounties. There are many $1m+ on @immunefi for instance, and a $3m got paid out <2 months ago. > They are absolutely not worth millions lol. They are extremely contextual, but they definitely are, if we are talking about vuln + exploit.

This post does not work in your favour my friend. HTB literally state for CWES: "Successfully completing all web penetration testing activities is not enough" and "will have to prove they are market-ready and client-centric professionals" under their "Commercial-grade Report Requirement" heading. 99% of the people/companies who are your clients in the corporate world cannot understand the technicalities. They require generic / concise explanations on a report. The same logic applies to concise explanations on sections which should be deeply technical. Many different eyes see these reports. They need to be good and tailored to everybody (or whatever the relevant conditions are). Your examiner's feedback is really good too. You should definitely be mad at yourself, and not HTB. You could have 200 CVEs next to your name. That does not automatically translate into being able to construct good pentest reports, because of... language barriers which may exist, for example.

@Fav_Truffle "we have the dev team to take car-"

We triggered WhatsApp 0-click on iOS/macOS/iPadOS. CVE-2025-55177 arises from missing validation that the [Redacted] message originates from a linked device, enabling specially crafted DNG parsing that triggers CVE-2025-43300. Analysis of Samsung CVE-2025-21043 is also ongoing.

Hello, I've received a bunch of notifications today about the "Block Blaster" ... pseudo-takedown that occurred in response to a group of individuals spearphishing and cryptodraining a cancer patient. I appreciate everyone thanking me or giving me a congratulations. I am not fully responsible for the actions which occurred. I did reverse engineer the malware and identify infrastructure, however any work done was accelerated due to a group of people. When I announced I was going to look at the video game closer to determine if it was malware (it was malware), a person contacted me and spun up a group of like minded people interested in examining Block Blaster closer. Here are the cool and badass people I worked with: - @zachxbt - @John5725424446 - @andreee_eeeeee - @escrow_ - @C4L38 - @downsin - "J" - Random nerds who provided "tips" to us I've never really spoken with these people before, omit ZachXBT, but each of us was angry from what we had seen. Before I get off for the evening I want to note that I am uploading Block Blaster to the malware library. "./Samples/Families/Block Blaster" I have also synced all samples in Triage and VirusTotal if you want to examine them closer. I noted the SHA256 hashes in a previous post.

The full technical report details how we took down the C2 infrastructure of Block Blasters drainer malware that @valvesoftware allowed on their platform. We spoke to the threat actors who had no remorse for stealing from a terminally ill cancer patient docs.google.com/document/d/1vI…

tl;dr of today > @rastalandTV gets crypto drained > he has stage 4 cancer > hes targeted specifically for his cancer treatment money > loses $32,000 > nerds band together > @ZssBecker donates $30,000 to him > malware nerds come together > drainer infra found > pull all victim data from infra > victims will be notified > all malware flagged > osint nerds come together > find drainers info from their telegram ids > find info from their steam ids tl;dr tl;dr stage 4 cancer bro gets fucked over, 50+ nerds band together to undo the damage fuck cancer

@Montyly I don't even skim anymore. The minute I realise it's an LLM post, I just straight up mute. Disgusting rate of LLM usage in web3.

It's not about "protecting" the criminals. It just isn't a good perspective. 1 - You need to understand that not everybody cares about how things should be done, or what should be followed, etc. Take the ransomware industry for instance. There are actors out there who ransom private hospitals. You think they care about proper channels? You will never change their mind. Also, laundering money and keeping a tight opsec is not exactly hard if you know what you are doing. They know they have the advantage, and they know what is possible and what isn't. That in itself allows them to have an ego in whatever way is possible. 2 - True. I personally think this contributes to the problem as it is from inaccurate judging and projects intentionally lowballing whitehats etc. It opens the door to this style of thinking. 3 - Why would they return all funds when they can guarantee the 10% and be in the exact same situation of criminal liability? Whether you keep all, return 90% or return all, you have the same legal problems. The act is done. They are all equal. Which one you deem as correct or wrong is irrelevant because it is subjective. You are already in a tainted context full of wrongs. You need to remember they have the cards in their favour almost always. No limits on scope. No limits on judging. Yet whitehats - within the same hunting context(s) - are limited by those two factors incredibly. Blackhat activity will always exist, because it is also a moral and ethical problem. Improving judging and making projects not lowball whitehats will decrease blackhat activity by quite a fair amount imho, but you won't ever remove the blackhats who simply don't care about anything and/or are reckless. It's like trying to aim for no crime globally. Good luck.

Stay on topic [impossible challenge]. I don't need to understand your internal business affairs to tell you how absurd of a statement (for instance) "CertiK, Trail of Bits, OpenZepplin and many other similar auditing platforms are not able to do the same so there won’t be much of a competition" is. Anybody who does bug bounty (or overall red teaming or blue teaming) will understand why I'm critiquing a statement like this or the previous ones. And no, your statements don't make sense because all of your posts are generically worded for hits. You then invoke delusional cybersec takes and that's why I'm calling you out on them. You don't see them as delusional because you don't have enough experience to be able to realise what is (or sounds) bs or not. It is extreme corporate / PR talk. "and yesterday found a half a million dollar bug for this month which I’m reporting soon this week we’ll see how that goes" I wish you the best on the report, but why are you even mentioning it when the result isn't confirmed? It is irrelevant to mention. Invoking this doesn't add some guaranteed credibility to you, especially when you claim there are 30 other reports waiting. Even the best of the best can be wrong at times. I genuinely wish you the best Ehsan. But I've been in cybersec for many years, and cybersec is full of liars and cert collectors who can't even ssh into a server or scan ports. People know this scene makes serious money. Remember that how you word things and what you say directly shows whether you are living up to the truth or not. People who do this for a living can see right through this. You have a softdev background. Your YouTube is all about AI creations and startups. Many of your X posts are wall posts which turn into hits. Your opsec is weak. You dive into solving P=NP problem (per your LinkedIn) and you were interested in quantum field theory. Respectfully, I have 0 info to believe you have good cyber security skills to the point you can write tweets like that.

You randomly pull up into web3sec with insane hopium claiming to outperform the big players from the get go. Some of your statements don't even make sense. This post is something I'd see on LinkedIn. Nobody on this planet is going to claim they will find some new non-existing revolutionary bugs that others will not. What are you? A fake web2 cyber security CISSP holder? You just entered the space, and you are posting like you have been here for many years. I don't even want to flame you but this smells like BS and you keep making fake hit posts and it's getting a bit annoying. I don't care about your Porsche 911 either LOL. How is this relevant to what I'm saying to you?

@0xSorryNotSorry I think they simply knew it wouldn't have been accepted - or expected it to be a rocky road at least - because it contained (technically) out of scope logic.

@huntoor I agree. But, I mean, can you blame them for abusing this when the majority of platforms are not doing much to combat it? No harsh penalties exist, so it indirectly supports this behaviour.

One thing that I would like to see is the response time metric applied to all projects publicly. For instance, out of all the 311 bbp on Immunefi, only 56 have a public average resolution time. That is ~18% of all programs. I think so far only a few opt in for that to be revealed, but it should be fundamental. After all, SRs check a project's code for free *until* they find something. Then, they might have to be in an n month conversation / dispute / whatever about the bug. If I see a program for $100k per crit, yet the average resolution time is 6 months or something, then I will probably skip it. With the current implementation, nobody knows what they are really in for and have to gamble with not only finding something, but also at it being handled in a timely manner. Clearly, if there are no fast responses, then you also kind of know that you might be entering a heaven of duplicates due to such slow resolutions. It really says a lot. If a project is on Immunefi and that is their response time, then someone may wonder whether it is fair to skip it. I think you can answer that with the opposite question: is it fair for you (the researcher) to be in those conditions for the service you provide? Also, the same response time change logic can be applied to payouts. Hackenproof publish program payouts and it is nice to see. I think there was a program with like 40 reports and only $2k paid out, with $2k for meds or lows - I can't remember exactly. That in itself says something though. A project is not harmed (at least from the way I see it) from revealing these metrics. Low payouts could signal a protocol attempting to always invalidate findings, or simply have had poor reports from low quality SRs. Average resolution however, is entirely on them. These are all relatively small metrics which make a big difference for SRs.