O hacker que invadiu a NASA: entenda a mente de Hacker Ofensivo | Starti Cast #10

O hacker que invadiu a NASA: entenda a mente de Hacker Ofensivo | Starti Cast #10

The hacker who invaded NASA: understand the mind of Offensive Hacker | Starti Cast #10

by Starti Cast (host: Mirian Fernandes, guest: Kadu Zambelli) · View the channel on PSI

Humanities, Social Sciences & Thought Computing & Cybersecurity URComputer securityURHComputer fraud and hacking
🎙 Starti Cast (host: Mirian Fernandes, guest: Kadu Zambelli) 👥 34K 📅 September 17, 2026 ⏱ 48 min 👁 1 📄 expert opinion 🧭 2026-09-17
Available in: English (current) Français

Keywords

ethical hackingbug bountyNASAvulnerability disclosureSME security

Summary

Mirian Fernandes hosts Kadu Zambelli, a cybersecurity specialist with over 20 years in IT, who shares his experience as an ethical hacker. He explains how he found 26 vulnerabilities in NASA’s systems through their Vulnerability Disclosure Policy (VDP), of which two were validated and recognized. The conversation covers the process of bug bounty programs, the importance of reporting vulnerabilities ethically, and the challenges faced by small and medium-sized enterprises (SMEs) in Brazil. Kadu emphasizes that any company, regardless of size, is a potential target due to automated scanning by attack bots. He highlights common security flaws such as exposed ports, weak authentication, and poor authorization practices. The discussion also touches on the role of Red Teams and the need for a ‘security by design’ approach. Kadu shares his journey in building the Alquymia community to educate others. He advises SMEs to incorporate security from the start and to view bug bounty programs as a collaborative opportunity. The episode concludes with insights on how to build a career in offensive security and the value of real-world experience.

176 words

Critical Evaluation

Value of the Information & Strength of the Argument

VALUE OF INFORMATION: The video provides rare first-hand insights into a successful VDP engagement with NASA, demystifying the process and highlighting the effort required. It also offers practical advice for SMEs on common vulnerabilities and the importance of security fundamentals. The argumentation is based on personal experience, making it credible and relatable. SOLIDITY OF ARGUMENTATION: Kadu supports his claims with concrete examples, such as the P2 vulnerability that allowed editing a scientific document, and explains the methodology behind vulnerability research. He also addresses misconceptions about hacking and emphasizes collaboration between offensive and defensive teams. The reasoning is coherent and grounded in real-world practice.

Scientific Rigor, Source Quality, Title Accuracy

RIGOR AND SOURCES: The video does not cite external scientific sources but relies on the guest’s expertise and real-world cases. It mentions recognized frameworks like OWASP Top 10 and bug bounty platforms (HackerOne, BugCrowd) in passing, which aligns with industry standards. The quality of sources is limited to personal testimony, which is informative but not independently verified. TITLE ADEQUACY: The title accurately summarizes the core topic—the NASA hack experience and the offensive hacker mindset—and does not overpromise. The content matches the title well.

201 words

Title / Content Match

The title accurately reflects the main topic: the guest's experience with NASA and insights into the offensive hacker mindset.

Quality & Reliability

8/10

The content is based on the expert's real experience with NASA's VDP, providing concrete examples and practical advice. However, the discussion is mostly anecdotal and lacks external verification.

Chapters

Cited Sources

Concurring Sources

  • OWASP Top 10 — Common vulnerabilities mentioned in the video align with OWASP's recognized list.
  • Bug bounty program (Wikipedia) — General description of bug bounty programs, consistent with the video's explanation.

Contribution & Novelties

APPORT: The video contributes an authentic case study of NASA’s VDP, highlighting the role of ethical hackers and the potential benefits for both researchers and companies. It bridges the gap between advanced hacking examples and everyday SME security practices.

Pour aller plus loin :

  • Bug bounty program — Official Wikipedia overview of bug bounty programs and how they work.
  • OWASP Top 10 — The standard awareness document for web application security risks, relevant to the mentioned vulnerabilities.
  • HackerOne — A leading bug bounty and security platform, where many companies host their programs.
  • Vulnerability disclosure — Explanation of responsible disclosure and VDP frameworks.
  • Security by design — The principle of incorporating security throughout the development lifecycle.

115 words

Radar Profile

The radar profile shows high scores in information quantity and quality, moderate technical level, and strong reliability. This indicates a well-rounded but not deeply technical discussion, ideal for a general audience interested in cybersecurity.

Reliability 7/10