Episode 48: MVH, DEFCON Black Badge, Googler - Sam Erb

Episode 48: In this episode, joined by the spectacular Sam Erb, Google Security Engineer and DEFCON Black Badge winner. We talk about the importance of understanding how systems work to find vulnerabilities, and how his engineering background influences his hunting style and methodologies. Then we jump over to his Career Development and his work with Google, and then chat about some of the recent Google Vulnerability Programs.

This episode is sponsored by Wordfence! Wordfence recently launched a game-changer of a bug bounty program with ALL WordPress plugins over 50k installs are in-scope. They are currently paying 6.25x their normal bounty amounts, and have agreed to give CT listeners a 10% bonus on top of that! Head over to https://ctbb.show/wf for more info and keep an eye on the CTBB Discord for inspiration/collabs.

Follow us on twitter at: @ctbbpodcast

We're new to this podcasting thing, so feel free to send us any feedback here: [email protected]

Shoutout to YTCracker for the awesome intro music!

—— Links ——

Follow your hosts Rhynorater & Teknogeek on twitter:

—— Ways to Support CTBBPodcast ——

Sign up for Caido using code CTBBPODCAST for a 10% discount.

Hop on the CTBB Discord

Discord premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.

Today’s Guest:

https://twitter.com/erbbysam

Sam Erbs Static Secret

Security Now Podcast

BIMI:

And

https://bimigroup.org/

Google Device Vulnerability Reward Program Initiatives

Google Invalid Reports

Hacking Google

Transcripts

(00:00:00) Introduction

(00:02:50) Hacker Methodology with Sam Erb

(00:12:20) Balancing Bug Hunting and Personal Life

(00:15:53) Deep Diving on a program and using automation.

(00:27:00) Optimizing Bug Hunting and Understanding Attack Vectors

(00:39:22) Collaboration and Boundaries

(00:45:42) Career Development and Entrepreneurship

(00:55:13) Winning Black Badges at DEFCON

(00:58:02) BufferOver

(01:09:11) Working at Google

(01:19:23) Google Bug Bounty Programs

(01:31:41) BONUS Cool Bugs