Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Project Zero

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Announcing Project Zero

#51

Post by freehunter »

tptacek wrote: post #43
chrisfosterelli wrote: post #42

Earlier quoted context omitted.

That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect.

I don't know how long ago your list was made; would you still recommend Grey Hat Python?

Re: Announcing Project Zero

#52

Post by r0m4n0 »

tptacek wrote: post #50
r0m4n0 wrote: post #48

Earlier quoted context omitted.

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morphed into a wider spectrum). Most recent public security outcries have related to internet services so my assumption that would be their focus. Part of me hopes they tread in this gray area so that we are forced to address issues with the CFAA and how its presen…

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permi…

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there.

If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm...

If someone used the disclosure of the bug to do harm, you have assisted in unauthorized access of information.

Re: Announcing Project Zero

#53

Post by tptacek »

r0m4n0 wrote: post #52
tptacek wrote: post #50

Earlier quoted context omitted.

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permi…

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted i…

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them.

The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines".

Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have been prosecuted for disclosing the vulnerabilities. If you disclose a bug and someone unrelated to you breaks the law with it, CFAA does not say you're liable.

Re: Announcing Project Zero

#54

Post by [deleted] »

tptacek wrote: post #53
r0m4n0 wrote: post #52

Earlier quoted context omitted.

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted i…

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have…

[deleted]

Re: Announcing Project Zero

#55

Post by m0nastic »

freehunter wrote: post #51
tptacek wrote: post #43

Earlier quoted context omitted.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect. I don't know how long ago your list was made; would you still recommend Grey Hat Python?

I didn't think Grey Hat Python was a great book, but it serves a valuable purpose that I'm not aware of another book supplanting; which is that it shows you that you can use underlying programming to do security-related tasks, instead of being limited to just using tools.

The widest chasm that separates security professionals is the one between those that can only use tools other people provide and those that can write their own tools. And more than just being able to write them, but being able to write them quickly enough to be of use during an engagement (which usually only lasts between 1-3 weeks).

A lot of security testing at the non-entry level is putting together specific tools to accomplish an engagement-specific task. You don't generally spend a lot of time building giant edifices, it's usually lots of small things that you mostly throw away between gigs (minus whatever underlying libraries you favor using as construction components).

In that regard, I think Grey Hat Python is still a good book to introduce you to the idea of using real programming to do hacking, even if you never write a line of Python on an engagement.

Re: Announcing Project Zero

#56

Post by sneak »

tptacek wrote: post #50
r0m4n0 wrote: post #48

Earlier quoted context omitted.

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morphed into a wider spectrum). Most recent public security outcries have related to internet services so my assumption that would be their focus. Part of me hopes they tread in this gray area so that we are forced to address issues with the CFAA and how its presen…

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permi…

> This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities.

Scanning for heartbleed is a good example of why it may well be - through a normal, authorized connection, it becomes apparent if the implementation is vulnerable.

Or are you referring specifically to sending a malformed heartbeat in the context of an authorized connection?

It's certainly not black-and-white to me.

Re: Announcing Project Zero

#57

Post by tptacek »

sneak wrote: post #56
tptacek wrote: post #50

Earlier quoted context omitted.

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permi…

> This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. Scanning for heartbleed is a good example of why it may well be - through a normal, authorized connection, it becomes apparent if the implementation is vulnerable. Or are you referring specifically to sending a malformed heartbeat in the context of an authorized connection? It's certainly not black-and-…

So far as I know, Google didn't sweep the whole Internet for hosts vulnerable to Heartbleed. They found the software flaw on machines they ran.

Re: Announcing Project Zero

#58

Post by tptacek »

freehunter wrote: post #51
tptacek wrote: post #43

Earlier quoted context omitted.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect. I don't know how long ago your list was made; would you still recommend Grey Hat Python?

I don't think it's an especially great programming book, but it is a great cross-section of the programming tasks you actually do when working in a vulnerability research lab (or software security consultancy, for that matter).

Re: Announcing Project Zero

#59

Post by r0m4n0 »

tptacek wrote: post #53
r0m4n0 wrote: post #52

Earlier quoted context omitted.

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted i…

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have…

haha not to drag this conversation out but just a hypothetical scenario:

I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?

Re: Announcing Project Zero

#60

Post by tptacek »

r0m4n0 wrote: post #59
tptacek wrote: post #53

Earlier quoted context omitted.

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have…

haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?

No, they would not. The equivalent of this scenario happens all the time. In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).
Post reply on HN