Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Project Zero

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Announcing Project Zero

#41

Post by spacefight »

viraptor wrote: post #20
spacefight wrote: post #16

Earlier quoted context omitted.

That fibers have been tapped by state actors was well known pre-Snowden (I recall reading a story about how subs were used in Russia etc), yet Google only completed encrypting their private fibers post-Swnoden.

Sure, but as far as we know Google was not aware of it (it = US internal taping) and introduced encryption of private traffic to counteract it. I'm not aware of articles proving they knew about the taps. Are you? (yes, we can speculate they did, but let's say it like that)

So the US tapped overseas cables for at least a couple of centuries (http://en.wikipedia.org/wiki/Operation_Ivy_Bells) and people still feel amused by the MUSCULAR relevations...

Re: Announcing Project Zero

#42

Post by chrisfosterelli »

tptacek wrote: post #40
eli wrote: post #38

Earlier quoted context omitted.

Is working at one of those labs as much fun as it sounds?

Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance…

That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.

Re: Announcing Project Zero

#43

Post by tptacek »

chrisfosterelli wrote: post #42
tptacek wrote: post #40

Earlier quoted context omitted.

Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance…

That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :)

Here's two starting points:

- a reading list: http://amzn.to/cthr46

- how we hire: http://matasano.com/careers/

Re: Announcing Project Zero

#45

Post by mikevm »

tptacek wrote: post #43
chrisfosterelli wrote: post #42

Earlier quoted context omitted.

That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

What's "A Supposedly Fun Thing I'll Never Do Again" doing there?

Re: Announcing Project Zero

#46

Post by tptacek »

mikevm wrote: post #45
tptacek wrote: post #43

Earlier quoted context omitted.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

What's "A Supposedly Fun Thing I'll Never Do Again" doing there?

Each of those books has a paragraph explaining the recommendation.

Re: Announcing Project Zero

#47

Post by Kiro »

mikevm wrote: post #45
tptacek wrote: post #43

Earlier quoted context omitted.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

What's "A Supposedly Fun Thing I'll Never Do Again" doing there?

The list author says: "I had a CISSP book here as a joke, but then realized that someone who clicked "buy whole list" would end up accidentally owning a CISSP book. Far better that they accidentally end up owning David Foster Wallace's most accessible book. The state fair essay in particular, worth the price of admission."

Re: Announcing Project Zero

#48

Post by r0m4n0 »

tptacek wrote: post #34
meritt wrote: post #32

Earlier quoted context omitted.

Good to know, thank you. What in your opinion is the best way for someone to submit a security vulnerability (the sort which could land them into legal trouble, they don't have permission to be penetration-testing, could be viewed as malicious, etc) or is it simply not worth the risk?

You need to clarify. Are you talking about submitting a vulnerability in someone else's website, or in a product you installed on your own computer? In the latter case, it's pretty straightforward. Your legal liabilities in that situation are (so long as you don't demand money) civil (you many have violated a click-wrap that will probably prove toothless against security research). You can tell the vendor directly if…

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morphed into a wider spectrum). Most recent public security outcries have related to internet services so my assumption that would be their focus.

Part of me hopes they tread in this gray area so that we are forced to address issues with the CFAA and how its presently enforced.

It doesn't matter if you are sitting on a bean bag chair at a google lab, you have no defense in criminal court if you are unauthorized to test for a vuln in someone's system. Disclosing a flaw is sufficient grounds for a felony.

Re: Announcing Project Zero

#50

Post by tptacek »

r0m4n0 wrote: post #48
tptacek wrote: post #34

Earlier quoted context omitted.

You need to clarify. Are you talking about submitting a vulnerability in someone else's website, or in a product you installed on your own computer? In the latter case, it's pretty straightforward. Your legal liabilities in that situation are (so long as you don't demand money) civil (you many have violated a click-wrap that will probably prove toothless against security research). You can tell the vendor directly if…

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morphed into a wider spectrum). Most recent public security outcries have related to internet services so my assumption that would be their focus. Part of me hopes they tread in this gray area so that we are forced to address issues with the CFAA and how its presen…

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets:

(a) Web apps run by other companies but which are available for download to run on one's own machines

(b) Web apps run by other companies that have published bug bounties or other forms of permission for testing

(c) Web apps tested carefully and, at first, usually anonymously (or, if not, then by researchers working from jurisdictions where CFAA is hard to enforce)

Post reply on HN