MonkeHacks #102
It seems that MonkeHacks has become a monthly publication. I’ll try to post more frequently, but this hacking season (September to December) has been very busy so far. I just returned from Singapore after taking part in Google’s Bugswat LHE.
Bug bounty has been changing so frequently that it’s hard to know where the frontier is. In my opinion, the frontier sits roughly around where rez0, gr3pme and Ads Dawson are - you should listen to their episode here. They go into great detail about their hackbot setups, benchmarking, local AI rigs, and so on.
Edinburgh is bursting with muted colours right now, with the trees fully in autumn shades, and the weather taking a marked turn for the worse. The preparations for the Christmas Market (which goes up around mid-November) have started around the city. I bought a bicycle recently (not an e-bike, just a normal one) to get around the place, although Edinburgh is quite hilly so it’s a hell of a workout to get anywhere.

The flower gardens, cooled to 23 degrees near the Marina Bay Sands in Singapore. I went here with some hacker friends to relax after the event.
Weekly Ideas / Notes
Bugswat Singapore
I took part in Bugswat Singapore. I (somehow) won Best Chrome VRP Researcher there (and Best Meme!) which I’m very grateful for. I reported a mix of AI bugs and client side bugs in the event, and it was a very enjoyable experience (although the flights were not so enjoyable). It was, as usual, great to catch up with my friends, and I made a few new friends as well. I developed some new techniques, which I’ll be presenting in NahamCon next month.
Singapore is an interesting city. It has all of the hallmarks of a city in Asia, but everything is written in English. We rarely saw the sun because of the pollution and smog from the neighbouring Indonesian fires. The Gardens of the Bay are beautiful, and they had this huge glasshouse that was maintained to 23 degrees Celsius with low humidity at all times, which is very impressive considering that it was 29 or 30 outside and stickily humid.
Budapest
I received an invitation to a LHE in Budapest in December. I’ve never been to Hungary. That event takes place shortly after NahamCon, so that solidifies my travel for the rest of the year. Between now and then I have a number of projects that I’d like to work on, so I have a pretty clear plan for the rest of the year now.
Budgeting, Part 2
I’ve continued working on optimising my finances - this is a form of hacking, in a way. Or at least, an application of the hacker mentality. I made a Telegram bot that has read-access to my bank account transactions, and messages me if it needs to categorise transactions or recommend me improvements. I can also upload my receipts to it and have it track my spending patterns.
I’m fighting my old landlord at the moment to get my deposit back. They are a built-to-rent scheme, so they like to extract as much money from tenants as possible. It’s important to know your rights and to spot when someone is screwing you over unjustly. AI is a really powerful tool for anything involving paperwork - frontier models rarely make mistakes when you provide the full documents and prompt very specifically.
Resources
Agents are going upstream. Ask the mathematicians: Lupin talks about depth.
Inside the Sandbox: How pwn Escaped Google kvmCTF (Before the Watershed): A Google KVM escape! This is absolutely wild.
do we still enjoy software engineering in the age of AI?: Shubs answers a question posed by one of his engineers.
Auditing in the age of (good enough) AI: Trail of Bits looks at the speed-up in tool development through the example of auditing Miden.
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!: What a bug. This might be the greatest unassisted bug chain in the AI age. And of course, it’s Orange Tsai who found it.
How I Found a $90,000 Remote Code Execution Vulnerability in Google: The simplicity of it is remarkable.
Cache Me If You Can: Some elegant client-side work (again) from Kevin Mizu at Assetnote.
