Stories from the Other Side of the Table: How Immunefi Is Fighting for You Behind the Scenes

Transcript

and our next speaker is Adrian hetman our Tech lead of triaging at immunify and he'll be talking to us today about stories from other side of the table how immunify is fighting for you behind the scenes hello can you hear me well great get closer maybe closer okay yeah so hello I'm gonna tell you some stories that shows what it takes to actually handle critical vulnerabilities at immunify or basically whenever stories that shows the importance of proper handling of

responsible disclosures I'm gonna show you stories that actually haven't been made public until today of course I wouldn't be disclosing any confidential information because I don't want to researchers nor the projects but I will share you some light on how imminify and triaging team Works behind the scenes what we do to actually make the project secure and white hats rewarded so welcome everyone to the stories from the other side of the table on how we Minify fights for you okay

it's winter evening 9pm I'm sitting in almost empty uh parking lot in my car groceries in the back I'm about to head to home to my lovely wife and to newborn child I start the engine and suddenly I get a notification and look at it and it's from work I never got notified that light I opened the notification and suddenly within two minutes I'm finding myself in a war room situation because White House has found a critical vulnerability that can shut down any evm RPC node number of affected projects on the MiFi 15. and yes that was actually just a Monday for me so how do you form our room in a matter

of seconds after you still experience some shell shock after receiving the news you take that deep breath and you remember that you've done this before we've been at unified in this situation many times before we've dealt with such cases multiple times dozens of times I don't know even the hundreds but possibly uh that could be true we've been in that spot before so we stayed uh with the hacker uh communicating with with him over secure channels and we started uh planning the responsible disclosure because yes he has found the vulnerability but we needed to be sure that the impact is actually there that the report is Rock Solid that it

wouldn't be this mess that it would apply to all the bug Bounty program rules for all these different affected projects and it took time and actually we wanted to a part of course uh keeping hackers best interest at heart the band delivers themselves we also wanted to have projects be secure so after Mass disclosure the Chase had begun we started contacting every project that was affected to look at the report immediately some of them responded to us within minutes some of them within hours some of them within days some of them patched the issue resolved

a bug report and rewarded the hacker because the report was well written because we prepared it so well before but some of them actually as it turned out didn't have this impact in their back Bounty program and some of them claimed that they were protected against this so through mediation even if I could officially step in and mediate this case we look at all technical details uh across all 15 cases and we managed to Showcase a real impact on the out of scope back uh to some of the project and get the hacker rewarded took us five months of effort five months of constant back and forth between the project and the Wildcat

analyzing every little detail of every bug report that they submitted yes the bug was actually common on every product on the same on the every project and the 95 percent of the background report was exactly the same but that five percent was so crucial to actually be being able to resolve this issue and it took us five months of us battling for you battling for the project to actually get their projects secure their user secured and white hat get appropriately compensated for this and it's important to know that whenever there was a slight dispute

slight disagreement we always encourage Whitehead to actually called us in because in some of these cases if we wouldn't be called in the case wouldn't be resolved and by resolve meaning that the project would still be open to vulnerability and Whitehead wouldn't get rewarded because sometimes information can get lost misunderstood and we are here to actually step in and provide all unbiased technical information to provide a just and fair platform to everyone to actually talk to each other and to report such vulnerabilities through immunify and

you might sometimes be thinking okay this this took five months but does it always take that long not necessary some of the issues are more straightforward some of them are more complicated but we always do our best we'll do every length that to actually resolve the issue but actually what am I really to talk about this it might be a strange time to introduce myself but my name is Adrian Hitman I'm the head of triage at immunify I've been in web free security space in since 2020 I've been in crypto since 2016. a personality triaged and negated some of the most paid bugs on MiFi

and I'm honored to stand in front of you and tell you some interesting War Room stories from my work our platform is built on the idea that the project and White House can collaborate to mutually benefit one another by utilizing their backhanding expertise whiteheads can help projects secure millions of dollars worth of assets and in return projects are a bit of that wealth with the White House to thank them for their time and effort and however as much as we try to build objective metrics into black money programs on our platform sometimes gray areas are still there sometimes edge cases happen and in such cases It's

always important to call us in for a mediation because every crisis situation that we ever handled and that also I'm gonna present right now was eventually result through a mediation process because then we could officially step in and fight for you so let's now look at some of examples of different mediations that were eventually a war rooms situations or are worthy of the name of a crisis this is the case where Whitehead was right and this is the story that a few of you already may know pointing.if an elite white hat has found a critical vulnerability in Moonbeam twice within

the span of two months he got paid for those two bags uh over two million dollars in Back Rewards the first bug resulted in 100 million dollars of potential value address second back in 200 million dollars of value at risk amazing bug report amazing effort of both sides but you might not know all the behind the scenes details because you know actually those two bugs were out of scope initially back Bounty program rules that not been has said so it was crucial as with every case

to call for a mediation because yes Moonbeam wanted to reward the hacker they understood the severity of the vulnerability uh the severity of the impact but they weren't sure how to actually reward the hacker based on their back Bounty rules so they called us in and also we stayed online with the pony and Whenever there is such case that bugment programs rules aren't clear as I said before call for remediation and we're always encouraging and pushing for fair compensation as determined by value created for the project and in this case the value created was obvious

in total 300 million dollars saved right but it wasn't that clear how to actually progress with that so through um many weeks of effort of navigating through the rules and understanding the technical details of the bug report itself we managed to showcase the real impact on foreign in both of these cases and through collaborative efforts of uh Moonbeam and pony.if acting in a good fight just wanting to get this back result fixed and later of corresponding that if getting rewarded an appropriately compensated after even if I helped we managed to

resolve this because as with every case I'm gonna repeat this constantly some of these cases wouldn't be either as successful or successful at all if we wouldn't be called in because we handle 100 thousands hundreds thousands of cases difficult cases and we are expressing in that we know how to navigate uh bug Bounty program rules we know how to navigate impact we know how to navigate all the technical information because we've done this before and through collaborative effort as I said back Hunter was eventually rewarded and by result we also updated lots of hours

uh back Monday program rules uh created some updates because with every Edge case scenario every crisis situation we are always constantly improving because we don't want such case ever to happen again and if that case happens then we can just do business as usual because we already know how to handle such cases that's why we're making constantly uh smaller updates and each smaller update is based on one of the difficult cases that we have next case um project was right because from the previous story you may think to yourself why on Earth Project didn't pay maximum payout immediately because

it isn't actually always clear if the impact is actually real in this case white has submitted a beautiful report all technical details were already in there POC was working it was runnable uh he even included fanservice calculation 10 million dollars everything was in a report from trash in perspective it was a piece of cake to triage but it wasn't a piece of cake for the project project disagreed with this report and disagree with the white hat and after having a disputes on our platform between the White and the project we were officially called in we analyzed every bit of

technical information that was shot in the back report itself in a POC and also within the conversation because a new information came to the light and we eventually got in a clue of the project because we had one information one piece of a puzzle that was still missing before we we could give our judgment and our recommendation and after that call it became clear that the liquidation mechanics because back was around that was working as intended and project was actually right and project close the report but the issue lied with the POC itself because you see um White had made some assumptions about how POC uh should work how the

liquidation mechanics of the project should work and that assumptions were wrong those assumptions weren't tested and we always encourage everyone to actually test every assumption because we are dealing with facts and every facts that we that we have help us get to the resolution of the bug report and in this case we managed to looking at only the facts to state that the project was actually right we provided with all technical reasonings and information to the white hat project did the same Whitehead understood uh what he did wrong so the case was closed and white had left

happy knowing how to do better back bunches in the future next case middle ground because some of these cases uh may be quite obvious sometimes from the beginning sometimes after a while some of cases aren't as black and white and it can take months of constant discussion technical analysis twice or even three times analyzing the same thing over and over again to actually understand what's going on on one of such cases we handled uh this year a few months back two Allied whiteheads submitted a critical vulnerability to a VIP project the attack Vector was very complex it

was a weaponizing uh Randomness and after the disclosure both white hats and the project were working flawlessly together to develop a fix to protect the project and from our standpoint it was the collaboration was beautiful until it wasn't because you see the the speed happened when it came to deciding on them final payout and the severity of the of the back the project uh for that this is this was a medium severity impact not a critical one and project of course disagree and with

severity also the payout recommendation smaller than the White House actually wanted and white has the pointer by point counter arguments project responded with the same and such arguments arose tension between between the two at a higher degree when finally one project still and didn't want to impact about the reasonings whiteheads acted in a bad fight they threatened the project to go to make this case public to get a higher reward we admify don't take blackmail easily we treated really seriously

because we want to provide a fair and just platform to everyone to actually being able to act together to get the project secure and what in the end compensated and blackmail doesn't help with that we either trade ban hackers or heavily warn them of course everything is based on on case-by-case basis in this case I cannot tell you all the technical details which I wish I could but the end result was this the impact state are critical uh the project didn't pay the max critical payout that white had wanted based and they paid

much less based on the actual funds at risk after our technical assessment removing all the assumptions from the pocs and the impact and middle ground isn't always in the middle White House were left unhappy yes they found a critical vulnerability but the payout was much less than they expected but they still got a few hundred thousand dollars in reward and the project was also a bit unhappy because they didn't they they needed to pay way more than the initial effort but it's always important to emphasize in such cases why we reached such a decision a decision that regards the payment the decision all technical

details to lay them out to every party so we can base our mediation on truth and of course we have many more cases to talk to I talked about about Greyhound activity and as with previous case this case could go really nasty if we wouldn't be called in we help to diffuse the tension and that's what we do in such cases we diffuse the attention we go straight in analyze everything we clean everything and provide with clean technical information to everyone just looking at the facts to be fair and just to anyone because we have rules for a reason and we execute our rights to ban secured

researchers or the projects if they go against them you want to create a fair platform for all parties involved and we won't accept any pathfade Behavior and each musician like the ones that I presented even if we cannot make it public always the results in some improvements on our platform in some articles that we write for the public to better educate the White House or the projects and we will always fight for you no matter what but we need all necessary information to do that we cannot make a judgment call we need to analyze every possible scenario every possible Edge case and

for that we need all technical information and as I go as I said we will go every land possible as long as you need to prove to prove your point if of course is a valid one making predictable outcomes out of bbps we host is something that we work on every day and for the future of mediation we're codifying our best practices learn across thousands of difficult cases and we will form that into a new bbp that will form the basis of our work for a few years uh years to come and with that our common investment in other areas around the BPP we are making tons of improvements

tons of new articles explanations to make a everyone to make everything more predictable when back hunting for the white hats and for the projects and with that I want to thank you for the talk it was a pleasure sadly I had a funny video at the end but it doesn't seem like it will work but thank you everyone thanks Adrian thank you we may have time for one quick question all right you're very quick how do you educate your team on communication skills peaceful resolution

and like negotiation with everything we are trying to be always respectful to anyone no matter who are we talking to even if uh to someone who's uh on a basically a great heart and he's threatening a project we're always respectful and we're always basing our uh communication on the facts we just want to have everyone to have a nice time on our platform and I and I said that just unfair outcome and for that communication is a key and we're learning that on every case also because we uh constantly improving on the ways that we communicate we starting to add

way way more information into our remediations uh uh analysis that we post to both sides and we still continue communicating with the white house or the project after mediation has been posted and with everything this is just a constant process we don't have any one way that we can say that we have we do this and that we're just trying to be respectful awesome thank you Adrian will be around I'm sure uh over the next few minutes