Sean Cassidy
LightNews LightNews
seancassidy.me
Sean Cassidy
@seancassidy.me
520 followers 240 following 68 posts
Head of Security at Asana
Posts Replies Media Videos
seancassidy.me
bug bounty brag posts are just the hustle culture of infosec.
Screenshot of a LinkedIn post which says, “While people struggle to reach $200k/yr in #cybersecurity after years of experience, folks in #bugbounty are earning $200k per bug report. Wild. Proves that skills can definitely outdo certs, formal education, and the number of years of exp. Note: The person quoted in the screenshot is Hackerone user "stealthy", not me. #bugbountytips #infosec #hacking” with a screenshot of a bug bounty payout by a user named stealth worth $200,000. A screenshot of a LinkedIn comment by Erik Cabetas that says, “Arif ‎Was the purpose of this post to make bug bounty life seem more glamorous and "get rich quick" than what it actually is? Let's take a look at the numbers.... Looking at Stealthy's H1 activity, he's been hacking on the platform for six years and has peen paid for a little over 100 vulns. Most payouts are <$1k. With only three payouts being >$5k and all three of those payouts were within the last year. There are also another huge group of vulns he reported (~50) that he got zero payout for. The $200k payout is an extreme anomaly that only ~0.001% of bug bounty hunters would expect to be awarded. While it is clear that Stealthy has gotten really good recently, the reality is that we have no idea how many programs he has participated in and how many dead end paths were followed to get to $200k. If you spend 10,000 hours of training and research to get a single big payout, does that make bug bounties worth it? That is a net equivalent of $20/hr with tons of uncertainty to even get close to that number. Most people would rather get a consistent regular salary doing security work than live the uncertainty of bug bounties IMHO. p.s. Sachin Gupta the OP didn't get this reward, Stealthy is some bug hunter from California.”
November 18, 2024 at 2:58 AM
seancassidy.me
neat
Screenshot of Bluesky celebration that says "Celebrating 10M users" I was #19,956, and it says "Bluesky Elder Certified first 1%"
September 17, 2024 at 8:05 PM
seancassidy.me
aim had a buffer overflow in it as part of its protocol! wild stuff

www.nplusonemag.com/issue-19/ess...
The pieces then came together. Normally, these protocol messages sent from the server to the client are read and understood as data, not as code. But AOL’s client had a security bug in it, called a buffer overflow. The buffer is a place where a program temporarily stores data while running some operation. However, it’s all too easy in lower-level languages to allow in more input than the buffer can actually accommodate. In this case, very large protocol messages could flood it, overwriting the client code and arbitrarily controlling the functioning of the client program—this is why it’s called a buffer overflow, and it’s a huge security hole, since it gives the server control of the client PC. In the wrong hands, the server can choose to shut down or corrupt or do other terrible things to your computer. AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until the
December 12, 2023 at 12:59 AM
seancassidy.me
just look at this
A password confirmation dialog with a password quality meter showing "402: Very Strong". It has a complex description of how that number is derived below separated into two sections, Additions and Deletions. Additions has items like "Number of Characters", "Symbols" and "Middle Numbers or Symbols" with types like "Flat", "Cond", and "Incr", and rates like "+((len-n)*2)"
August 23, 2023 at 5:45 PM
seancassidy.me
is this the best hacker news comment ever?
This reminds me of when I interviewed at Stripe, a few years back. It was a surreal experience. We were in a small conference room. I sat at the table on one side, Patrick and Edwin sat on the other side. They asked me questions, I answered them. It was a good discussion. Then there was a brief pause in the conversation. Suddenly, Patrick let off the most absurdly loud fart. I chuckled in surprise. Patrick and Edwin stared back at me, in a stony silence, neither of them making any acknowledgement of Patrick's colonic eruption. I forced myself to adopt a similarly straight face. As the smell of it filled the room and my nostrils, I could only assume this was a power move, intended to dominate. I held my nerve, and continued the interview. Unfortunately, I wasn't offered the job. Now I wonder if maybe it was a cue to speak up and point out the loud, smelly elephant in the room. I suppose I'll never know. Has anyone else here who's interviewed at Stripe had a similar experience?
July 5, 2023 at 11:09 PM
seancassidy.me
how much better off would we be, security-wise, if we didn't have awful security solutions like legacy IPSes and VPNs on the internet?
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Initial access Volt Typhoon achieves initial access to targeted organizations through internet-facing Fortinet FortiGuard devices. Microsoft continues to investigate Volt Typhoon’s methods for gaining access to these devices. The threat actor attempts to leverage any privileges afforded by the Fortinet device, extracts credentials to an Active Directory account used by the device, and then attempts to authenticate to other devices on the network with those credentials.
May 24, 2023 at 8:44 PM
seancassidy.me
paella tonight
Paella
May 8, 2023 at 1:30 AM