Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was asked to crack a program in a job interview

erenyagdiran.github.io

Post reply on HN
Print view View original

281–290 of 309 posts

Re: I was asked to crack a program in a job interview

#281

Post by bubblicious »

FLUX-YOU wrote: post #198
bubblicious wrote: post #162

Earlier quoted context omitted.

I would really suggest purchasing a good book about it. From my point of view, I would go for "Hacking: The Art of Exploitation, 2nd Edition" from Jon Erickson which goes in depth about how to crack programs using gdb and other tools. It's really a wonderful book if you want to learn more about the world of cracking in general, and it doesn't require much prior security experience. Quick link to Amazon: http://www.am…

I've done some of this book. It's good, but you're better off knowing the basics before trying to really learn from it I think. I only knew a little C when I started, so I only got about 4 or 5 chapters after much googling before I drowned. Learn some ASM and get familiar with gdb before attempting

It's definetely out there if you have only done a little C. It doesn't require any previous security knowledge though as I stated. But like you realized, it does require you to know your way around low-level programming.

Re: I was asked to crack a program in a job interview

#282

Post by warrenm »

aaronharnly wrote: post #266
Fuxy wrote: post #253

Earlier quoted context omitted.

If you're not changing your tests on every interview batch you're doing it wrong. You're asking a potential candidate to spend hours cracking your program but you can't be bothered to change it for each batch? I expect any company applying this interview technique to at least put some effort into it and even then it pays off since a batch could contain hundreds of candidates and you only have to build the program onc…

What do you mean by "batch"? Most companies have rolling hiring.

this is true - but you're [generally] going to have a batch of candidates for any given position

Re: I was asked to crack a program in a job interview

#284

Post by scott_karana »

jfoster wrote: post #234
eyeareque wrote: post #90

Earlier quoted context omitted.

You could also attack the VM: http://www.cvedetails.com/vulnerability-list/vendor_id-93/pr...

Given this, what is the best first step? Best we can tell, he was running root in a VM that was running as an ordinary user. What more can be done, aside from running it on a throwaway machine? Running on a cloud instance, perhaps?

Perhaps a LiveCD/LiveUSB, with a VM inside of it?

Then a compromise would need to be:

Local VM user -> root VM user -> local LiveCD user -> root liveCD user -> hardware exploits

Re: I was asked to crack a program in a job interview

#285

Post by RevRal »

icelancer wrote: post #150
michaelchisari wrote: post #107

Earlier quoted context omitted.

> Real-life tests are THE best thing to send job candidates I agree, but only if you're allowed to use references/google/etc and given a reasonable amount of time to accomplish it. I've had a "real-life" test where I wasn't allowed to verify or look up information, or where I'm giving a very short time to execute, and I've always thought those were absurd. The idea that you would ever have to do something like this i…

>I agree, but only if you're allowed to use references/google/etc and given a reasonable amount of time to accomplish it. I've had a "real-life" test where I wasn't allowed to verify or look up information, or where I'm giving a very short time to execute, and I've always thought those were absurd. Employers that do this are ridiculous. As are educators, too. What is this, preparation for when coders are kidnapped by…

>Employers that do this are ridiculous.

Unless they are trying to hire a mentat.

Re: I was asked to crack a program in a job interview

#286

Post by com2kid »

pkaye wrote: post #45
dllthomas wrote: post #31

Earlier quoted context omitted.

What kinds of positions are you interviewing for?

Firmware engineers. Basically C programming and working close to the hardware.

I have had great luck hiring game devs and cross training into embedded.

"Oh I have to stream data into my processing routines with not nearly enough bandwidth? No problem."

I've also had smiles of delight when devs got 100% raw access to every little bit of hardware. Discovering DMA controllers is /fun/ for them. We came super close to getting a decompression routine running completely by our DMA controller!

Re: I was asked to crack a program in a job interview

#287

Post by qdog »

pkaye wrote: post #45
dllthomas wrote: post #31

Earlier quoted context omitted.

What kinds of positions are you interviewing for?

Firmware engineers. Basically C programming and working close to the hardware.

Most people in this area are now older. I'm approaching 40 and I was recently at a tech demo and everyone around me seemed to be older than me. I remember taking Assembly in college and our professor explicitly telling us that we would not need to know any of it, but it was a good foundation to build on. As far as I know, of the people in that class I'm the only one that ended up actually writing a ton of assembly after joining a semiconductor company. Most of the embedded people were from EE, but didn't actually have as much of a programming background. I had approx. 2 college courses dealing with hardware in undergrad and that was not enough.

So, it seems you need to either accept a recent CS grad who seems adept at programming and can learn, or pony up the 200k+/yr to poach someone if you want to hire quickly. Most people I know that have done embedded work tend not to move around a bunch and aren't motivated by small amounts of money to move jobs, so you'd have to offer a large incentive to find the good people.

Re: I was asked to crack a program in a job interview

#288

Post by jpindar »

UrMomReadsHN wrote: post #213
davidgerard wrote: post #117

Earlier quoted context omitted.

Totally. YMMV. That's why you look for stuff on the CV like willingness to experiment, play with OSes at home, "describe your home network", etc. This doesn't replace the interview, it just verifies claimed competence and helps show thinking ability.

"Describe your home network" is an interview question now? Jeez, guess I shouldn't leave my job, I'll never get another one. I am going to go ahead and challenge the assumption that your willingness and eagerness to learn on the job is not really correlated with how you spend your time outside your working hours.

I think it's an excellent question. Not because a candidate needs to have something special about their network (although if they do, that's a plus and a chance for them to talk about their interests) but because if they can't describe something they own, why should anyone think they will have the communications skills to describe something they're going to be working on?

Re: I was asked to crack a program in a job interview

#289

Post by dllthomas »

harry8 wrote: post #174
pkaye wrote: post #22

I don't know where you find candidates that can even approach this level of skill or desire to solve puzzles. Most people I interview struggle with a few lines C program coding.

You want experts? Try paying them like they're in the top 1% of their field and their work is worth at least 10 times if not 100 times the average salary to many employers. Make an effort to actually, you know, compete to get them. The market for programmers is really inefficient for pay. Google has exploited that to the max and succeeded hiring a lot of very talented engineers at rates you pay for average tax accoun…

It doesn't take experts - and shouldn't take top 1% salary - to know how to count the set bits in a word or reverse a string in place.

Re: I was asked to crack a program in a job interview

#290

Post by na85 »

twosheep wrote: post #274
sillysaurus3 wrote: post #92

Earlier quoted context omitted.

Could you change the jmp into a nop, then xor every nth byte of the program with jmp xor nop, where n = whatever offset the jmp was at in the key? The result should be a valid decryption.

I understood some of those words.

Maybe go back to reddit.
Post reply on HN