Oops, I Hacked It Again: Grand Theft Disclosures | Ignacio Navarro

Overview: Ignacio Navarro presents at Security Analyst Summit on "Grand Theft Disclosures," exploring unauthorized access to bug bounty and vulnerability disclosure platforms and the sensitive data they hold.

Key Topics: Definitions of hacking as authorized versus unauthorized access; exploiting disclosure platform vulnerabilities for privilege escalation; modifying user permissions via token manipulation; and revenue data exposure through webhook endpoint access.

Technical Details: Navarro demonstrates accessing administrative permissions and revenue data through disclosure platform vulnerabilities, including webhook endpoints revealing ticket generation, financial metrics, and program data beyond intended user scope.

Takeaways: Vulnerability disclosure platforms themselves require rigorous security testing and hardening. Platform operators must protect researcher data, program metrics, and financial information as high-value attack targets.