This year, I had the incredible opportunity to speak at BlueHat IL-Microsoft’s premier security conference that brings together some of the most brilliant minds in offensive and defensive security. The event, held in Tel Aviv, Israel, was packed with technical depth, thoughtful discussions, and meaningful connections.
Sharing My Research
My talk, titled “Vesta Admin Takeover – Exploiting Reduced Seed Entropy in $RANDOM,” focused on how low-entropy randomness used during the password reset process can be exploited to compromise the admin account.
Vesta uses the bash $RANDOM variable as a seed when generating password reset tokens. This pseudo-random number generator implemented in bash, suffers from multiple issues as I explained during my talk. I demonstrated how the $RANDOM algorithm behavior could be exploited by an attacker to perform and optimized brute-force of the generated tokens, ultimately leading to full administrative compromise.
The vulnerability is a good reminder of how critical entropy is in system design-especially when it forms the basis for secrets, tokens, or temporary passwords. I appreciated the audience’s engagement during and after the talk. It’s always rewarding to see the community discuss real-world implications of these edge-case bugs that turn out to be surprisingly practical.
Favorite Talks
Outside of my own session, BlueHat was packed with exceptional technical content. A few talks that really stood out for me:
From Day 1:
- Ori David’s “Now You See Me, Now You Don’t” was a sharp dive into abusing VBS enclaves for malware evasion. The level of stealth achievable using VBS is impressive-and concerning. Basically attacker could use the BYOVE (Bring Your Own Vulnerable Enclave) concept to hide their own malware from AV/EDRs. I’m sure we’ll be hearing more about this in the near future 😉
- Maor Abutbul’s “Let’s be Authentik: Your Identity is Mine” touched on real vulnerabilities and misconfigurations in Authentik, showing just how fragile identity systems can become without rigorous testing. Cool web hacking talk on ORM Leaks and race conditions to exploit identity providers such as KeyCloack and Authentik. Race conditions are everywhere 😉
- Inbar Raz’s “Reversing a Pay Phone for Fun but No Profit” was a refreshing throwback-less about CVEs and more about curiosity-driven reverse engineering. It brought a great balance to the lineup and it was extremely entertaining as well. If you like RE then this one is for you.
- Benjamin Delpy `gentilkiwi` “Mimi what? Little retrospective on mimikatz and what happened since passwords and spies” As the title says, it was an interesting retrospective on mimikatz and another very entertaining talk. Struggled a bit with the french guy’s accent, but really good overall.
From Day 2:
- Netanel Ben Simon and Meir Bloya’s “Boot Camp” offered a deep and well-structured look into Windows boot security. Complex, but very well presented. Not enough time to cover everything they do to secure the boot process, but really interesting in terms of attack surfaces, snapshot fuzzing and manual auditing.
- Avi Lumelsky and Gal Elbaz’s “0.0.0.0 Day” made a compelling case for rethinking what “localhost” actually means in the context of modern browsers and local APIs. A bug that has been plaguing the browsers for the past 2 decades and can be used to exploit servers listening on 0.0.0.0 by visiting a malicious website. Seems Edge is the only browser safe to this as Microsoft has mitigated this in the kernel.
- Arad Cohen’s “Breaking TLS with LLMs” was one of my favorite talks of the event, diving into how large language models can actually assist in fuzzing by improving code coverage. The speaker fuzzed OpenSSL, hit some roadblocks, and then introduced an LLM into the feedback loop to help overcome execution blockers. On top of that, he used Frida to hook signature verification functions and bypass them, unlocking deeper coverage. Since I’ve done some fuzzing myself, including as part of my own research, I had to check it out. Very cool work.
Finally, Efim Hudis delivered a keynote that was both philosophical and deeply relevant: “The Three Laws of Robotics and How (not) to Build Secure AI Agents.” It hit all the right notes around responsibility, autonomy, and the evolving attack surface of AI systems.
Community & Conversations
Beyond the talks, BlueHat IL was an incredible platform for connecting with other offensive security researchers, red teamers, and engineers. Whether it was over coffee, in the Q&A sessions, or at the after-hours hangouts, the conversations were insightful and energizing.
Final Thoughts
Speaking at BlueHat IL was an unforgettable experience. A big thanks to the organizers for putting together such a well-run and deeply technical event. And shoutout to everyone I met-I appreciated all the discussions, feedback, and laughs.
Until next time! ✌️
I’ve uploaded my BlueHat slides here, in case you’re interested:
🔗 https://github.com/FORTBRIDGE-UK/conferences
You’ll also find my recent slides from BSides Kent, where I presented our research on Concrete CMS.
If you enjoyed this, check out our reflections from DEF CON 33 as well.
About Post Author
