• Non-Human Identity Top 10
• Implementing and Operating Bug Bounties

Non-Human Identity Top 10

Presented by 김동현 (CEO, Cremit), this talk introduces OWASP's Top 10 security issues related to Non-Human Identities (NHI) such as API tokens, service accounts, and machine identities in cloud and DevSecOps environments.

• NHI1 – Improper Offboarding: Failing to revoke access for unused or orphaned NHIs can allow lingering access post-offboarding.
• NHI2 – Secret Leakage: Leaked tokens, API keys, or secrets via GitHub, Slack, or CI logs often lead to severe incidents.
• NHI3 – Vulnerable 3rd-party NHI: Supply chain plugins or cloud integrations may introduce external risk and compromise internal secrets.
• NHI4 – Insecure Authentication: Weak or misconfigured identity federation like OIDC role assumptions may lead to privilege misuse.
• NHI5 – Over-Privileged NHI: Service accounts often have excessive permissions—50% are "super identities" in some orgs.
• NHI6 – Insecure Cloud Deployment Configuration: Misconfigurations and hardcoded secrets in CI/CD pipelines are a common vector.
• NHI7 – Long-lived Secrets: Credentials not rotated regularly pose long-term security and compliance risks.
• NHI8–9 – Environment Isolation & Reuse: Using the same NHI across dev/stage/prod environments can cause wide-reaching breaches.
• NHI10 – Human Use of NHI: People misusing automation credentials is hard to detect and increases risk.

Implementing and Operating Bug Bounties

In this talk, 홍성진 (Staff Security Engineer, Sendbird) shares practical guidance on launching and running a bug bounty program in an organization.

• Definition: A structured reward-based system where ethical hackers report vulnerabilities in exchange for compensation.
• Benefits: Cost-effective vulnerability discovery, broader threat coverage, talent acquisition, and improved public image.
• Challenges: Internal resource burden, public scrutiny, legal considerations, and payment processing delays.
• Adoption Process: Define scope & rules, secure internal buy-in, allocate budget, document workflows, and decide on platform use (internal or third-party).
• Recommendations: Start small with internal awareness, automate response workflows, and maintain transparency with researchers.

• Executive Summary
• Tactics and Techniques
• Detection Strategies
• Mitigation Measures

Executive Summary

The Outlaw Linux Malware is a persistent yet unsophisticated auto-propagating coinminer package that has been observed across multiple versions over the past few years. Despite lacking advanced evasion techniques, it remains active and effective by leveraging simple tactics such as SSH brute-forcing, SSH key and cron-based persistence, and manually modified commodity miners and IRC channels.

Tactics and Techniques

• Initial Infection & Deployment: Downloads the 'dota3.tar.gz' package and executes the 'initall.sh' script.
• Gaining Control & Persistence: Kills competing processes and deploys modified XMRIG for crypto mining, STEALTH SHELLBOT for remote control, and BLITZ for SSH brute-force attacks.
• Propagation & Expansion: Retrieves target lists from a C2 server and attempts SSH brute-force attacks on new machines.

Detection Strategies

Detection strategies include monitoring for unusual SSH authentication attempts, unexpected cron job creations, and the presence of unauthorized SSH keys. Implementing SIEM and endpoint detection rules can help identify these activities. :contentReference[oaicite:1]{index=1}

Mitigation Measures

• Regularly update and patch systems to prevent exploitation of known vulnerabilities.
• Enforce strong, unique passwords and consider disabling password-based SSH authentication in favor of key-based authentication.
• Implement network segmentation to limit the spread of malware within the internal network.

• Executive Summary
• Attack Vector
• Exploitation Details
• Mitigation Measures

Executive Summary

On February 21, 2025, Bybit experienced a significant security breach resulting in the loss of over $1.4 billion in assets, including 401,347 ETH. The attackers compromised the transaction approval process by manipulating what Bybit's signers saw during the authorization of cold wallet transactions, leading to unauthorized fund transfers.

Attack Vector

The attackers targeted Safe{Wallet}, a multi-signature wallet solution used by Bybit. By injecting malicious JavaScript code into the Safe{Wallet} user interface through a compromised developer machine, they altered the transaction data presented to the signers. This manipulation caused signers to unknowingly approve transactions that transferred control of the cold wallet to the attackers.

Exploitation Details

• Malicious JavaScript Injection: The injected code detected when a Bybit signer was initiating a transaction and replaced the original transaction data with attacker-controlled parameters.
• Transaction Manipulation: The altered transactions used the 'delegatecall' operation to execute code in the context of Bybit's wallet, allowing the attackers to modify the wallet's master copy address and gain control.
• Signature Deception: Signers were presented with seemingly legitimate transaction details, but the underlying data had been tampered with, leading to the authorization of malicious transactions.

Mitigation Measures

• Enhanced Code Integrity Checks: Implement strict integrity verification for all code, especially in critical applications like wallet interfaces, to detect unauthorized modifications.
• Regular Security Audits: Conduct frequent security assessments of both internal and third-party software components to identify and remediate vulnerabilities.
• Signer Awareness Training: Educate signers on the importance of verifying transaction details and recognizing potential signs of interface manipulation.
• Multi-Factor Authentication: Enforce multi-factor authentication for transaction approvals to add an additional layer of security.

• Executive Summary
• Vulnerability Analysis
• Impact Details
• Mitigation

Critical Cloud Flaws

Team82 discovered multiple critical vulnerabilities in Ruijie Networks' cloud-connected IoT devices enabling remote code execution.

Vulnerability Breakdown

CVE	Risk	CVSS
CVE-2023-XXXXX	Unauthenticated RCE	9.8
CVE-2023-XXXXY	Hardcoded Credentials	8.4
CVE-2023-XXXXZ	API Abuse	7.9

Exploit Chain Components

• Cloud management platform flaws
• Insecure device provisioning
• Weak firmware validation

Attack Impact

• Full device takeover
• Corporate network pivoting
• Data exfiltration capabilities
• Permanent device backdoors

Affected Devices

Device Type	Model Series
Smart Switches	RG-SXXXX
Wireless APs	RG-APXXX
Security Gateways	RG-WGXXX

Mitigation Strategy

Immediate Actions

• Update to firmware version 3.1.7+
• Revoke default certificates
• Implement API request validation

Security Recommendations

Layer	Protections
Cloud	Multi-factor authentication, API rate limiting
Device	Secure boot, Firmware signing
Network	VLAN segmentation, TLS 1.3 enforcement

• Malware Overview
• Infection Chain
• Technical Analysis
• Detection Methods

DCRat Characteristics

Remote Access Trojan targeting financial data and credentials through sophisticated evasion techniques.

Key Capabilities

• Keylogging and screen capture
• Cookie and session theft
• Process hollowing injection
• C2 communication via Telegram API

Infection Vector Analysis

Stage	Description
Initial Access	Phishing emails with ISO attachments
Execution	LNK files invoking PowerShell scripts
Persistence	Registry Run keys modification

ANY.RUN Sandbox Findings

Behavioral Indicators

• Creates mutex "Global\DCRAT_MUTEX_01"
• Drops DLLs in %AppData%\Microsoft\Network\
• Establishes TLS connections to C2 servers

Network Traffic Patterns

Protocol	Pattern
HTTP	POST requests to /api/v1/collect
DNS	TXT record lookups for C2 IP resolution

Detection & Mitigation

YARA Rules

rule DCRat_Loader { strings: $s1 = "DC_LOADER_V2" wide $s2 = { 68 74 74 70 73 3A 2F 2F 61 70 69 2E 74 65 6C 65 67 72 61 6D } condition: any of them }

Mitigation Steps

• Block IP range 185.174.136.*
• Monitor registry key modifications
• Use application whitelisting
• Analyze email attachments in sandbox

• Technique Overview
• Prerequisites
• Setup Process
• Attack Execution
• Mitigation

Technique Overview

Using Kali Nethunter's MANA Toolkit to create malicious Wi-Fi access points and intercept unencrypted network traffic.

Core Requirements

• Kali Nethunter installation
• MANA Toolkit (pre-installed in Nethunter)
• Wireless adapter supporting monitor mode
• Root access on mobile device

Configuration Steps

1. Initial Setup

• Update packages: apt update && apt upgrade -y
• Enable monitor mode: airmon-ng start wlan0

2. MANA Toolkit Configuration

Command	Description
mana start --nl	Start NAT layer
mana start --dhcp	Enable DHCP server
mana start --ssid "Free_WiFi"	Set rogue AP name

Attack Execution

1. Launch Rogue AP

mana start --verbose

2. Deauth Attacks

• Use aireplay-ng for target disconnection
• Monitor connection attempts: tail -f /var/log/mana.log

3. Traffic Interception

Tool	Usage
tcpdump	tcpdump -i wlan0mon
sslstrip	HTTPS downgrade attacks

Protection Measures

• Always verify WiFi authenticity
• Use VPN connections
• Enable HTTPS Everywhere
• Monitor for duplicate APs

Key Interceptable Data Types

• HTTP website credentials
• Session cookies
• DNS query patterns
• Unencrypted API calls

• Executive Overview
• Key Findings
• Attack Vectors
• Mitigation Strategies

Executive Overview

The 2023 IoT threat landscape shows significant evolution in attack sophistication targeting connected devices across industries.

Key Findings

• 37.8 billion IoT malware attacks blocked in first half of 2023
• 71.2% of attacks target Linux-based IoT devices
• Top 3 targeted devices:

  Device Type	Percentage
  Routers	31.6%
  Cameras	23.4%
  Smart TVs	18.9%

Primary Attack Vectors

1. Brute Force Attacks

• SSH brute force attempts increased by 83% YoY
• Top 3 default credentials used:
  • admin/admin
  • root/123456
  • user/user

2. Vulnerability Exploitation

• 53% of attacks exploit known CVEs
• Average patch gap: 142 days

Mitigation Strategies

• Implement Zero Trust Architecture
• Enforce regular firmware updates
• Deploy network segmentation
• Use strong authentication mechanisms

Recommended Security Framework

Layer	Protection
Device	Secure boot, Hardware encryption
Network	VPNs, Intrusion detection
Cloud	API security, Tokenization