Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was asked to crack a program in a job interview

erenyagdiran.github.io

Post reply on HN
Print view View original

71–80 of 309 posts

Re: I was asked to crack a program in a job interview

#71

Post by fsniper »

The post started very well but with the first screen shot, my mind started tingling: What the heck a security engineer is doing in a root shell? An unknown binary sent via an email is run in a root shell. There is also no mention of email source tracking.

Hey you are a security engineer you know about weakness of smtp right?

Even if this is a virtual machine, I would really reconsider employment of him or sit down and do a serious talking about this blog post if I were the employer.

I could not continue reading the post before ranting about it.

Re: I was asked to crack a program in a job interview

#72

Post by fsniper »

squidfood wrote: post #18
freehunter wrote: post #5

Really nice overview of the process. I was hoping to get into debugging and breaking code, but my career took a wild turn away from that part of the job. It's still something I would like to learn, so I'm reading as much about it as I can. I'm going to take this way off topic here, but it's a curiosity of mine. Please don't take this as an insult; it seems to be very common and as a language learner myself I'm just w…

Assuming OP's native language is Turkish, that uses the same punctuation as English.

Aside from, Turkish do not use commas before conjunctions.

Re: I was asked to crack a program in a job interview

#73

Post by pkaye »

dllthomas wrote: post #55
pkaye wrote: post #45

Earlier quoted context omitted.

Firmware engineers. Basically C programming and working close to the hardware.

Hmm, as andrewljohnson said, I expect that the posting impacts who applies, but I would expect that to disproportionately turn up applicants who can write C. Another dynamic at play is the fact that those who don't have useful skills apply more often as they continue to be out of work, that doubtless accounts for some of it. Still a bit strange.

Some examples of coding questions I've asked in the past: reverse a string in place. Ones count of an integer. I'm testing if they understand pointers and bit manipulations for example. These should be answerable in 5 minutes max in 5 lines of C code. The incorrect answers candidates generate surprise me.

Re: I was asked to crack a program in a job interview

#74

Post by freehunter »

kamilafsar wrote: post #70
freehunter wrote: post #5

Really nice overview of the process. I was hoping to get into debugging and breaking code, but my career took a wild turn away from that part of the job. It's still something I would like to learn, so I'm reading as much about it as I can. I'm going to take this way off topic here, but it's a curiosity of mine. Please don't take this as an insult; it seems to be very common and as a language learner myself I'm just w…

> In this case, Spanish The OP is Turkish. Ankara is the capital of Turkey. His name is Turkish. Punctuation is the same as in English.

Sorry, I saw the "Barcelona,Spain" on his about page and incorrectly assumed that is where he was originally from.

Re: I was asked to crack a program in a job interview

#75

Post by dllthomas »

pkaye wrote: post #73
dllthomas wrote: post #55

Earlier quoted context omitted.

Hmm, as andrewljohnson said, I expect that the posting impacts who applies, but I would expect that to disproportionately turn up applicants who can write C. Another dynamic at play is the fact that those who don't have useful skills apply more often as they continue to be out of work, that doubtless accounts for some of it. Still a bit strange.

Some examples of coding questions I've asked in the past: reverse a string in place. Ones count of an integer. I'm testing if they understand pointers and bit manipulations for example. These should be answerable in 5 minutes max in 5 lines of C code. The incorrect answers candidates generate surprise me.

Yeah, certainly stuff one should be able to manage if they're going to be working on firmware. Could you link to a posting you've got up somewhere?

Re: I was asked to crack a program in a job interview

#76

Post by josh33 »

davidgerard wrote: post #46

Real-life tests are THE best thing to send job candidates. It scales well (you don't have to spend personal hours on them) and you get real information. This applies even to sysadmins. We have a favourite: set up a VM with a slightly-broken application in a slightly-broken Apache and Tomcat, and get them to ssh in and document the process of fixing it. Even people who aren't a full bottle on Tomcat will give useful i…

The risk is if someone publishes a tutorial with the secrets on the web.

Re: I was asked to crack a program in a job interview

#77

Post by runamok »

fsniper wrote: post #71

The post started very well but with the first screen shot, my mind started tingling: What the heck a security engineer is doing in a root shell? An unknown binary sent via an email is run in a root shell. There is also no mention of email source tracking. Hey you are a security engineer you know about weakness of smtp right? Even if this is a virtual machine, I would really reconsider employment of him or sit down an…

Is it really that probable that an email was sent to him from the company he is applying to and someone spoofed that to send him malware?

I agree with the root point only because the company could have easily done something like `echo "I just rm -rf'ed your / because you ran me as root"` as part of the test.

Why would you consider it still an issue if it was a VM he used only for this purpose?

Re: I was asked to crack a program in a job interview

#78

Post by SEJeff »

general_failure wrote: post #59
SEJeff wrote: post #36

Earlier quoted context omitted.

Afraid you're woefully incorrect. The root user is no more contained inside a default docker image than they are inside a chroot, which is, not really at all. It isn't difficult to break out of a container if you have uid 0 aka root. This will change when the userns stuff lands, but it hasn't yet, so that doesn't count yet. https://opensource.com/business/14/9/security-for-docker Or as solomon hykes, the docker creat…

Well, so far I have only heard a lot of FUD and nothing concrete. http://opensource.com/business/14/7/docker-security-selinux seems to have some information. But to refuse the points there, on my system: a) docker containers do not have a /dev/mem b) /sys/fs is mounted read-only c) /dev/sd* is not visible And so on. What's the thing with cgroups? Can a container delete the host's cgroups? Can it overwrite it's own cg…

http://blog.docker.com/2014/06/docker-container-breakout-pro...

But nothing is stopping you from creating a binary and running it as root that perhaps mounts those filesystems, or sends ioctls / badness to the kernel.

I'm just shooting from the hip here and might be wrong, but I'm almost certain devices aren't namespaced. If you were to mknod a block device with the right major / minor numbers as the host's sda/sdb/etc, what would stop you from mounting the host's root filesystem and making changes?

Granted the "work around" is to drop the privileges of the containers as much as possible, use sVirt (via SELinux), drop as many capabilities as possible, don't run untrusted containers, etc. But this isn't a theoretical security problem, it is a real big attack surface.

Edit:

http://www.projectatomic.io/blog/2014/09/yet-another-reason-...

Re: I was asked to crack a program in a job interview

#79

Post by peterwaller »

josh33 wrote: post #76
davidgerard wrote: post #46

Real-life tests are THE best thing to send job candidates. It scales well (you don't have to spend personal hours on them) and you get real information. This applies even to sysadmins. We have a favourite: set up a VM with a slightly-broken application in a slightly-broken Apache and Tomcat, and get them to ssh in and document the process of fixing it. Even people who aren't a full bottle on Tomcat will give useful i…

The risk is if someone publishes a tutorial with the secrets on the web.

But presumably that happens some time down the road long after you have made your decision. Either that, or said secrets are published and heard about by an audience which are tuned to hear about interesting things quickly, who may also be what you're after.

Re: I was asked to crack a program in a job interview

#80

Post by mappu »

ryan-c wrote: post #65
general_failure wrote: post #59

Earlier quoted context omitted.

Well, so far I have only heard a lot of FUD and nothing concrete. http://opensource.com/business/14/7/docker-security-selinux seems to have some information. But to refuse the points there, on my system: a) docker containers do not have a /dev/mem b) /sys/fs is mounted read-only c) /dev/sd* is not visible And so on. What's the thing with cgroups? Can a container delete the host's cgroups? Can it overwrite it's own cg…

You should be assuming Docker is insecure until proven otherwise. Fully isolating a root user with a shared kernel is very difficult.

OpenVZ is very widely deployed and manages to do this safely.
Post reply on HN