Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Ty Bross, Offensive Security Lead at Sidekick Security and a researcher on the Synack Red Team, started hacking as a teenager long before it became his career.
In this episode of WE’RE IN!, Ty traces that path from curious teenager to professional offensive security lead, and shares some of his favorite hacks along the way.
How does a teenage hobby turn into a full-time offensive security career? What makes a hack memorable enough to still talk about years later? What’s the one piece of advice Ty wishes someone had given him when he was starting out?
Don’t miss Ty’s take on turning a knack for breaking things into a career doing it professionally.
Listen to the episode
S4 E11 · Ty Bross on Getting Paid to Break StuffWE'RE IN! Podcast · 24 min
Key takeaways
Low technical impact can mean high business impact Ty found a flaw in a QR code feature used for identity verification that compromised no system but could have caused serious trouble and legal issues for the customer and its users.
Public material can unlock an exploit A CSRF on a federal application seemed unexploitable until Ty found a three-year-old PowerPoint deck with a sample ID that still worked in production.
Chaining is hard in bug bounty reports Low severity issues that only matter when chained get rejected on their own, so Ty explains the extra impact inside the report for an exploitable finding instead.
Focus on your strongest bug classes Ty advises new researchers to know which bug classes they are good at and focus there, especially while working toward higher SRT levels.
Expect a grind and watch for burnout He warns that bug bounty can mean a month without findings and recommends realistic expectations and taking breaks instead of chasing every new target out of FOMO.
Notable quotes
…my favorite part of my job is I get paid to break stuff.
If you don't enjoy it, you're not going to succeed.
Trying to spread too wide of a net, you're not gonna catch anything.
The intuition really is built up over years of experience and learning how to ask the right questions.
Questions this episode answers
What is a business logic vulnerability?
Ty describes it as flaws beyond classic OWASP Top 10 issues like XSS or SQL injection, such as missing authorization checks that expose other users' data, or manipulating what an application gives you to make it behave in unintended ways. Read this section
How do you join the Synack Red Team?
Ty joined in 2017 on a recommendation from a colleague who was already an SRT member. At the time, the process included an interview and a technical interview, even though SRT is not a full-time job. Read this section
What advice do you have for new bug bounty hunters?
Be passionate first, because bug bounty is a grind. Use the SRT Slack community for collaboration and mentorship, set realistic expectations, and focus on the bug classes you are strongest in. Read this section
Why do human pentesters still find bugs that scanners and AI miss?
Ty says humans understand the context of an application and the company's environment, which lets them find business logic bugs that a scanner or AI would likely miss, such as the QR code issue he described. Read this section
About the guest
Ty Bross has worked in penetration testing, security engineering, and security development pipelines for almost fourteen years and has been a Synack Red Team (SRT) researcher since 2017. He studied security informatics in graduate school in Indiana, where he wrote Android malware as a research project, and started his career as an intern at Cigital, later acquired by Synopsys. At the time of recording, the feed describes him as Offensive Security Lead for Sidekick Security, and in the episode he describes his day job as a staff engineer at a consulting company.
Hello and welcome to the latest episode of the WE'RE IN podcast brought to you by Synack. I'm Josh Mason, solutions architect, and with me today is one of our Synack Red Team members, Ty. Ty, welcome to the show.
Ty, you... Being on the Synack Red Team, you're constantly working on finding vulnerabilities for Synack clients. What should folks know about you and your background?
Well, I think primarily when it comes to my background, especially what's really relevant for the Synack Red Team, is that I've been working in the industry through a combination of penetration testing, security engineering, security development pipelines, all of that kind of stuff over the past almost fourteen years now. And so I've done a lot of different things, found a lot of cool different vulnerabilities. But also, one of the things that I'm really able to do is provide information on not just technical impact of a vulnerability, but also how the vulnerability will affect an organization. And finding vulnerabilities that outside of your standard cross site scripting bugs and things like that, I can find more like business logic things that are often overlooked by a lot of researchers because they're looking for those deep technical things.
And a lot of the stuff that I find is more I guess, a business logic and things like that that have maybe not as critical of a of a technical impact, but can have actually a significant impact on the organization as a whole.
Sure. So, you know Do have examples? When when people think of things like, you know, vulnerabilities that are reported to a bug bounty program, then think of your traditional OWASP top 10, right? Things like cross site scripting, things like SQL injection, SSRF, those kinds of technical bugs that allow people to get at sensitive data and things like that. And when I talk about business logic, I mean things like, I get authorization checks and things like that, accessing information of other users or companies that I'm not supposed to access, but also taking what an application gives me and manipulating it. So one of my favorite bugs that I found was a feature that allows... That basically takes input from the user's browser and their session and created a QR code up.
And this QR code was scanned by certain by by the company and the agency that was a Synack customer. And it would be used to perform like identity valid identity verification checks on the person presenting the QR code. And if the information in there wasn't right, the person could get into some serious trouble. Technically speaking, there wasn't really a significant impact, right? It wasn't compromising a system, but it could have a very serious impact on the customer, but also their customers and potential legal issues that kind of surround it. And those are the things that I like to look for because they're often overlooked. People can't scan for them and things like that. And so those are really fun for me to try to dive into and figure out.
Yeah. So I'm glad you asked. My... I can pull the thread pretty far back. I think as a lot of people my age can do. So I was in high school in the in the in the late nineties to kinda date myself. And one of the things that I figured out kind of early on was ways to break out of the the boot sequence on our Windows lab machines and our computer labs, and to access things that I wasn't supposed to access, like administrative boot menus and things like that. Now, I was always a little bit too scared to do things like change grades. I didn't wanna get into kind of trouble like that. So I never did that, but it was always very exploratory trying to see what I could get to and things like that. And that kind of was an interest throughout my life. Like when I was a teenager in my parents' house, I got in trouble for spending too much money on long distance phone calls.
And my parents couldn't, they didn't want to go through the trouble of calculating how much I owed them every single month. And so I we got a second phone line, but they told me that they wouldn't pay to have an install. I was a teenager, didn't have a lot of money. I figured out how to actually just run a phone line myself from the phone box to my bedroom where I could actually hook up the phone and figure all that kind of stuff out on my own. And so tinkering has always been kind of a thing that I really enjoyed. And then when I was an undergrad, I was going just for a bachelor's degree in, I think, was general information systems at school in Michigan. And they had one security class. And they did registration based on your last name. And it would rotate every year, every semester, I think maybe where like, my last name starts with a b. So one semester, I would be at the front of the line for registration.
The next semester, I'd be at the back of the line. And by the time that I was able to register for this class, I was in the back of the line, and it filled up very quickly because it was one session once a year. And once you got a senior standing, you'd take it. So by the time I got a chance to register for it, I didn't have a chance. So part of what I wanted to do also was teach. I love teaching and sharing knowledge. And so I thought, why not teach in a college and go to grad school? And so I went to grad school in Indiana and studied security informatics. And a big part of what I did there was my my research project was writing Android malware. And basically, I what I did was I wrote an app that just masqueraded as a score tracking app for different games that you play, like card games and things.
But I built some hidden functionality into it that would take all of your contact information. So like, names, email addresses, stuff like that from everybody in your contact list and send it to me over a WebSocket. And at the time, I don't know if it does anymore, but using a WebSocket didn't require any extra permissions in the app. So they would never get a notification that this thing's requesting permissions. Jeez. So it was a very sneakily do this. So that that really kind of like triggered something in me because I was on track to go into a PhD program there.
And I was like, oh, you know what? Maybe I don't wanna do a PhD. And then I got an internship at a company called Cigital that was bought out by a company called Synopsys, which a lot of people are familiar with. But I was an intern there for about six months before I hired on full time. And I just decided that a PhD isn't for me. I'm... I love the technical stuff and tinkering and and breaking things. And I, you know, a lot of the times I would tell people, you know, my favorite part of my job is I get paid to break stuff. That's pretty neat. Right? It it just kinda started from there. That was back in 2012 while I was an intern there. And so it's just been taken off ever since.
Nice. I very much understand that and can relate to a lot of shared experience. And I I'm sure a lot of people are. For those who are curious, if you get an app from the App Store, it is checked that it doesn't run malicious things in the background. We can build things in development that don't actually make it to your phone unless you have it unlocked, and that's why you have to give permissions now for anything like sharing contacts. Because of the things that folks like Ty found in academics, hopefully. Or on the Synack Red Team, how did you end up coming and joining the Synack Red Team?
Sure. Oh, back in 2016, I was working at a healthcare company in West Michigan. And we hired who would end up becoming another SRT, his name is Adam Loeb, goes by Loeb on the platform. We hired him as a pentester and he just kind of took off. But he was always happy to share his knowledge and he still is. He came to me one day and he said, you know, we've got this this platform. I've done some bug bounty stuff with him on HackerOne. And he said, you should check out this Synack company. There. You you have to like interview for the for the it's not a full time job, but you have to interview to be an SRT. So at the time, we had to do like a Google Meet interview with somebody and then do a technical interview, all kinds of stuff. And I was like, sure, that sounds like fun. Know why not make some extra money on the side.
And so the basis is a recommendation from REM sold back in 2017. I think Mark 2017, I onboard. So it's been nine years. Nice. And so it's it's been my focus ever since. If I do any kind of bug bounty work, it's just been on Synack and and it's been a a great experience.
Nice. So you've kinda said it. You don't do Synack full time yourself. I know some Synack Red Team members who who do, and they love it. But you've... You do it on the side. Is it for the sake of the challenges or some extra cash or a combination of both?
It's it's definitely a combination of both. I... So in my current employer, I work for consulting company and I'm a staff engineer. And so most of what I do is strategy and things like that. Do technical work, but it's much higher level and different kinds of assessments than pentests. Now we have a team that does that. But I do it to keep my skills sharp and kind of help me keep up to date with what's going on. But also, like the challenge of finding things and getting oftentimes first crack at an application that people haven't really tested before and and trying to find some fun stuff. But, you know, the the money is great. You know, I I... I've got two little kids and and trying to save up for college for them and try to buy a house and and all of that kind of fun stuff that goes into to being a a parent and things like that.
And so, you know, and I've got, like, student loans like everybody else does and getting those paid down and just all that kind of stuff goes into my motivation behind my my work with the SRT.
I understand. At our sales kickoff earlier this year, had an SRT member who was local, and they came by. And the last time they jumped on the platform was because they needed he's a farmer. He needed a new tractor, and he knows cybersecurity as well. But he spends a lot of his time just on his farm. And hit up three or four missions, found bunch of bugs, and was able to pay cash for a tractor.
That's that's a fantastic feeling when you don't have to dip into your savings or anything like that to be able to to pay for things that you need. It's just... It's a it's a great thing to have.
What has been your favorite part of being on SRT? Are there any missions or any clients or any bugs that you found that were, I don't know, just really made it a lot of fun?
So the the collaborative aspect of of the Slack workspace, stuff like that that Synack has is is great. It's a great way to provide mentorship to people, but also find people who are looking to collaborate with others to find bugs and things like that. And so that is a huge selling point to me. The fact that I can get somebody can reach out to me and say, Hey, I found this, What what could be a CSRF? It's kinda like where I where I live is CSRF land.
don't know how to exploit. I can't figure this out. And I'll help them work through it, figure it out, and dig it from what they think is probably just not exploitable to an exploitable bug that they can then submit and get paid for. And that to me is fun. One of my... I know I mentioned the business logic bugs earlier, but one of my favorite kinds of overall bugs that I've ever submitted was on a federal target. And this this agency had an application where you basically could submit different kinds of financial information. And it was... I knew by looking at it that it was vulnerable to CSRF. But I couldn't find data that I needed to actually exploit it because it wasn't provided in the app. And they wouldn't give it to us because the only way to get a valid value was to be assigned one by the agency.
And they're like, we're not gonna give you one. There's a whole bunch of issues that that can arise from that. And so what I ended up doing was I tried to find the format and try to brute force one, but it was like 64 characters long. It was crazy and like, there was no way to brute force it. But during my research, I found a PowerPoint deck and a presentation from like three years before that, where a developer was showing off this new feature that I happened to be tested. And in this PowerPoint deck, they had a sample ID. And it was... I'm just like, there's no way they have this thing from dev. That's a sample ID valid in production. And they did. So they were to use that to create all the data that I needed to discover and fully exploit CSRF on this application.
And I ended up... I think I... It was only like two different two different instances. One was the creation of some data and then one was deletion of data, which was interesting because when you deleted data, it was assigned a numeric sequential ID. So I was able to demonstrate that not only could I delete a particular one, I could brute force through all the numbers with JavaScript and delete them all. And, you know, it took me probably three or four days to find this information and get and get the reports in for now, what what would be like a few hundred hours worth of payouts. But to me, the the research and the diving in and the experience of figuring this out, putting the puzzle together and getting all put together and maneuvered the way I needed to, that was a big part of the payoff. And so that opportunity to really dive in and work with information that is occasionally hard to find, but then collaborate with others to help them figure these kinds of things out is a huge selling point for me.
Yeah, I get it. One of the things that I work on the sales end, I talk to opportunities and clients about is the fact that they don't have to parse a whole PDF document to try to pull out the gems of what vulnerability researchers have found or what pentesters have found. What is your take on the vulnerability process, going... Sending your, you know, report to VulnOps, and then not having to do up a whole PDF. I imagine you like it, but is it a pain in the butt sometimes? Or...
I mean, no. So I definitely find it easier than having to put together a full PDF. There are some limitations to that one. You know, VO are humans, and they can make mistakes. They can have questions, make make judgment calls I don't agree with. But, you know, when that happens, the appeals process is very easy and straightforward. And they also understand, they may just miss context that I have that maybe I didn't do a good job of explaining the report. And so, in general, I have a very positive experience with VO and they listen to those kinds of things. Rarely, I don't think I've ever had a problem with VO from that perspective. One of the things that I really like to do is chain things together, And that really doesn't work in a bug bounty perspective, especially on Synack.
And so the reporting process makes it a little more challenging to really elevate a bunch of low severity issues to a critical because the low severity ones would get rejected because in themselves, they're not exploitable. And so there's challenge there, but that you can't really explain very well in a single bug report. But you can mention those things if you get an exploitable vulnerability, you can then explain those things in your report to demonstrate the additional impact and that's fine. That really works out. But no, there's this challenge with that that you can't really fit into a a non PDF situation.
Yeah. Yeah. That's an interesting point. It does have its limitations. You've been at this for a bit now working with... You've known Adam and he's... I've gotten the opportunity to interview him. What advice would you have for anyone who is hearing this and thinks, wow, I wanna be on the SRT. How do I how do I do that?
So, you know, I've given this a lot of thought because I I... We actually referred somebody to to become a new SRT in February, I think is when he got on board in, and he just got to level five just like recently. So he's really shot up there and taken to it. But my recommendation for people coming in is to be passionate first and foremost. Bug bounty is a grind. I can go a month without finding anything else, spend hours and not find anything. And so, you need to enjoy what to do first and foremost. If you don't enjoy it, you're not going to succeed. You're not going to push those hard times where you're not finding stuff. And so that to me is like the most critical piece, but also really taken the collaborative aspect of the Slack workspace that we have. Because there's a lot of really, really, really, really, really smart people on the platform that can help you figure something new out or give you some guidance on different types of things to look for and things like that.
Taking advantage of those resources and doing the proper collaboration and stuff like that with them can go a long way to help you learn new things, but also become a contributing member to community as well, to where people are seeking you out for mentorship opportunities and things like that, if it's something that you wanna do. But understand that it's a grind. It's not always easy. It's not always fun. With few exceptions, you're not gonna jump in and make a million dollars in a year. That's just not how it works. And having, you know, setting real real expectations for yourself so you don't get disappointed, don't get burned out. You know, those kinds of things are very important to understand and understanding when you're getting close to burnout, taking a break, taking a step back. Don't let FOMO hits you so hard that like, I've done it before where I'm just like, see these new targets coming in.
I'm burned out, but I don't I don't wanna miss these things. And I just... It's not a good time to take take a step, you know, and and really understand yourself. And I think one final thing that I recommend is understanding what bug classes you're good at finding. Are you good at cross site scripting? Are you good at SQL injection? Are you really good at oxybugs? And focus on those. Trying to spread too wide of a net, you're not gonna catch anything. You might find one or two things here, but you're gonna miss really obvious stuff that you would have caught had you just focused on stuff that you are strong in. And then take time to learn new stuff, but especially starting out and to get it to the higher levels like level three, level four, focusing on what you're good at, what you're strong at can get you a long ways.
I I think that... So to to answer that question, I I think that it's important for customers to understand that we're people who can understand the context of an application or the company and the kind of environment they're operating in better than a lot of automated tools. Like, you can point, you know, burp scanner at something and try to find some things. You can point AI different parts of application and find some things. But where SRT and the human side of pentesting really takes hold and wins out over those technologies, is our ability to understand and contextualize the application and the way things are behaving and find those kinds of bugs that a program really has a hard time understanding.
The business logic bugs. If you ran all that stuff through a scanner, like, the QR code stuff that I mentioned earlier, it probably wouldn't find it. Yeah. But
Very much so. The the the intuition really is built up over years of experience and learning how to ask the right questions. Now, like I said, can I break this? Okay. It's taking these kinds of data. What can I do with this data? Can I I get the QR code to send someone to a random website? Now, what does that look like? How can I exploit what looks like a pretty benign type of functionality in the application? And really make it do what I want it to do from an attacker perspective. And that's the kind of value that SRT brings to the pentesting process.
That's a great explanation. Ty, really honored to have you on the show with me today and to have you as part of the Synack Red Team. Really appreciate you. And we'll see you out there at a conference or meet up sometime. Folks, if you enjoyed this, like, subscribe, and join us again next time. And send us your questions. What are you curious about from the SRT? Have a good one.
