Journey Of My First Bug Bounty (Nov 2018)

2 min readOct 2, 2020

Hello everyone,

This is my first writeup

To people who don’t know me I Harsh, a 4th year Engineering student in Information technology and a bug bounty hunter.

This is the story when i’m in a 2nd year and summer holidays going on, as a daily routine i'm sitting in my room and scrolling my phone, and suddenly i noticed that there is some misconfiguration in my phone then i tried the same procedure 2–3 times and notice the same and i came to a conclusion that this is a bug but as a noob that time i don’t know where to report this so i search on google and i saw official Samsung Mobile Security vulnerability reporting website https://security.samsungmobile.com/main.smsb

After this i create an account on a website and started looking for instructions how to report a bug to samsung and you won’t believe it guys that time i even don’t know about Poc, report making, but i keep things simple that time so i made a simple report and as you all know this is my first report so forget about professional report writing skills but anyway i make a Poc video and send it to the samsung.

Next morning, I received an email

Vulnerability

Attack Scenario

User locked their Whatsapp with S Secure application
User add second whatsapp from dual apps feature by samsung it as a parallel space application does
When we open second whatsapp sometimes it open without any authentication means without pin, fingerprint and this bug unlock our first whatsapp also. So anybody can enter in our locked apps.