I followed a couple of courses at the VU University Amsterdam. I'll tell you what I've learned about security, it gives you a couple of terms to type into a search engine at least. There are 3 courses they give for it: 1) Computer & Network Security 2) Binary and Malware Analysis 3) Hardware Security The lower level it gets, the better they are at it. Each course costs 1200 euro's for non-EU students. I recommend it.…
I know it is that way, but I don't understand it. It always seems to me like it just indicates that the exchange rate is wrong: clearly I can buy more stuff if I convert my money to pesos and spend them there, so the peso is just worth less than the amount we get per euro. Could someone recommend some a website or blog post that explains this? (Or is it a simple enough explanation to fit in an HN comment without goin…
It's related to Purchasing Power Parity [1] and a good example of that is the Big Mac Index [2]. Basically, even if you adjust for exchange rate, the same amount of currency can buy 2 apples in one country and 4 in another. This should not be possible in a globalized market because of the Law Of One Price [3]. However, that only really applies in the long term, for buyers with perfect information (i.e. full knowledge…
Interestingly enough, I have seen gas stations very close to each other with very different prices. This was close to an airport so I assume the idea is to rip off tourists who don't have time to search for cheapest fuel before returning the rented cars. At least that was the only explanation I could find that didn't involve conspiracy theories (Catania, Sicily, Italy).
I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.
Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done. It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper si…
You could focus on links that aren't in Google's cache, or links that match some numerical pattern in a set cookie, etc. Cookies are probably a whole thing on their own in this space too.
I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.
That is indeed a lot of money.
Not sure why there are not more people doing it. I thought about it as well for years but still don't do it.
What does the second part of that sentence have to do with the first?
Mx Armamut is perhaps not a native English speaker. Let us suppose that the first part of the sentence is a statement, and the second part is the rationale - then, by way of conjunction, a native speaker would probably choose something like "because", or similar. I expect there are languages where a word that translates neatly into "while" would be most appropriate, while actually meaning something more like "because…
I’d say ‘while’ is perfectly fine for a native speaker in place of ‘because’. You could leave ‘while’ out of the sentence, the comma alone implies ‘because’. The reason for the statement is implied by the two clauses sitting side by side, many connective words would do equally well, right? The only thing that suggests a non-native speaker to me is ‘respect to’, which is still sometimes correct. Respect to charitable interpretations, and respect to multi-lingual people.
I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.
I have never once heard of a bug bounty being paid to a former employee let alone to the same person who wrote the code. It strikes me as something that is likely to do damage to ones reputation far out of proportion the few thousands of dollars one might hope to gain.
This is similar to Katie Moussouris's argument from the article: > Moussouris, who created the bug bounty at Microsoft, warned that if badly implemented such programmes could see talent leaving organisations in favour of pursuing bug bounties, and thus damage the talent pipeline. I've seen her argue this on Twitter before - the argument IIRC is that bug bounties should always pay less than getting a job helping the b…
Step one: Work at a company with a bug bounty program Step two: Introduce subtle vulnerabilities Step three: Claim bug bounty under a pseudonym (or just get someone else to claim it)
That's actually a great spin on old concept of subversion. I wonder if anyone is doing it. It should be easier for C apps where someone could say they didn't know about a specific kind of undefined behavior.
I wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.
I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.
I don't do web apps. So, all I could do is DuckDuckGo for some terms that might get results. Found claim about using automated, open-source scanners to find IDOR and a lot of other stuff here:
They do note that IDOR poses some difficulties with it needing heuristics that might have high, false positives. The tools are in the references section toward the bottom. Try them out.
Someone showed me this strip ~10 years ago when the place I was working briefly instituted a similarly counterproductive incentive policy. I just Googled "Dilbert code me a minivan"