211–220 of 224 posts
As an aside question for web developers: How many web developers encrypt/checksum all fields on the client-side?
Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…
Don't fret. The author is correct, but it's mostly true for the upper ladder of the skilled workforce. I would chuckle if I saw a senior engineer list certifications on their resume (apart from maybe advanced CCNA/NP/IE cert for a networking specific role). At that point in your career your experience and knowledge will show for itself, and you won't be proving anything with paper. Right now, however, it's vital you…
What are your opinions on colleges/Universities with degrees focusing on Cybersecurity?
Such as Utica and there Bachelor/Master degree in Cybersecurity. [1][2]
[1] Program info: http://programs.online.utica.edu/programs/online-cyber-secur...
Curriculum: http://programs.online.utica.edu/programs/bachelor-cyber-sec...
[2] Program info: http://programs.online.utica.edu/programs/masters-cybersecur...
Earlier quoted context omitted.
Unfortunately I can't get into too much detail because I had to sign an NDA (to prevent cheating). But the process was similar to when I have found them in the wild: identify the app, install it locally, fuzz various parameters (it was a real application, albeit an old one), find the crash, figure out stack space, figure out bad characters, find the right JMP ESP or equivalent instructions in a loaded library, write…
In what way did the exploit they had you write differ from the kind we wrote in 1997?
That being said, the nice thing about OSCP imo is that it gives you some structure and a well set up environment to play in. I think OSCP is a great entry-level certificate and serves as a good filter to interview junior candidates.
Does this help at a more elite level, nope, but that's also not the purpose of it.
Earlier quoted context omitted.
It's difficult to believe that anyone who can claim to really know computers thinks they aren't based on a series of interacting rules. That's basically all they are. Understanding how those rules interact, how to trigger certain interactions others didn't intend, and the best practices to not get bit by those interactions is what security is all about. It's much like law or medicine in that you are looking at unexpe…
Computers follows rules the same way a football player follows physics. Those are not the rules GP is talking about.
The individual NAND, AND, NOR, OR, and/or XOR logic? Rules - tabular even. The base IA? Rules. The microcode? Rules. The VMM? Rules. The TLB? Rules. The assembly? Rules. The OS kernel? Rules. The C library? Rules. The ABI calling convention? Rules. The application language? Rules - syntax and semantics. The libraries under the application - rules. The application itself is a list of rules for how data is processed. If it's Turing complete it's basically equivalent to the lamda calculus.
Every security issue is some misapplication of these rules due to someone not understanding the implications of the interactions of the rules. Every single one. Smashing the stack? It's applying a set a rules in a way the code author didn't anticipate. Overflowing a buffer? The code author didn't anticipate more data being stuffed in than the buffer was made to hold. Rowhammer? There are rules of semiconductor electronics interacting with the programming language, the IA, and the logic layout. SQL injection? Someone's applying the wrong rules to sanitize the input and someone else is giving input that takes advantage of the underlying rules of the programming language and the RDBMS that they were allowed to invoke because proper sanitization wasn't in place.
Earlier quoted context omitted.
Computers follows rules the same way a football player follows physics. Those are not the rules GP is talking about.
No. Computers are rules. They are multiple, complex, partially abstract and partially concrete rules systems with messy and often poorly defined interactions among those systems. The individual NAND, AND, NOR, OR, and/or XOR logic? Rules - tabular even. The base IA? Rules. The microcode? Rules. The VMM? Rules. The TLB? Rules. The assembly? Rules. The OS kernel? Rules. The C library? Rules. The ABI calling convention?…
The rules under discussion are policy, and the question is how to define policy for evaluating people's skill at running roughshod over policy. The fact that there are underlying "hard" rules is literally universal and therefore uninteresting in this context.
Earlier quoted context omitted.
Don't fret. The author is correct, but it's mostly true for the upper ladder of the skilled workforce. I would chuckle if I saw a senior engineer list certifications on their resume (apart from maybe advanced CCNA/NP/IE cert for a networking specific role). At that point in your career your experience and knowledge will show for itself, and you won't be proving anything with paper. Right now, however, it's vital you…
What's so special about CCNA? I've acquired it as a backup plan few years earlier, but never used it nor worked in networking. Pretty much anyone with basic knowledge in networking, few weeks of spare time and and few hundreds of $ could obtain it.
Earlier quoted context omitted.
No. Computers are rules. They are multiple, complex, partially abstract and partially concrete rules systems with messy and often poorly defined interactions among those systems. The individual NAND, AND, NOR, OR, and/or XOR logic? Rules - tabular even. The base IA? Rules. The microcode? Rules. The VMM? Rules. The TLB? Rules. The assembly? Rules. The OS kernel? Rules. The C library? Rules. The ABI calling convention?…
There is not a single person on this forum who needs your lecture about how, in one sense of the word , computers are based on rules. The obviousness of this fact should indicate that the disconnect is elsewhere. The rules under discussion are policy , and the question is how to define policy for evaluating people's skill at running roughshod over policy. The fact that there are underlying "hard" rules is literally…
Lawyers and doctors deal in interacting complex systems of rules. So do information security people.
If you can make a certification that works for one expert in dealing with interacting complex systems of rules, you absolutely can make a certification for another expert in dealing with interacting complex systems of rules.
The details of what you test are different, but the fact that it's been done for law, medicine, medical specialties, dentistry, mechanical engineering, electrical engineering, civil engineering, and many other fact and rule based fields means it can most likely be done in general for people looking at how different systems of rules intersect.
Earlier quoted context omitted.
There is not a single person on this forum who needs your lecture about how, in one sense of the word , computers are based on rules. The obviousness of this fact should indicate that the disconnect is elsewhere. The rules under discussion are policy , and the question is how to define policy for evaluating people's skill at running roughshod over policy. The fact that there are underlying "hard" rules is literally…
I really don't think you're following the point. Lawyers and doctors deal in interacting complex systems of rules. So do information security people. If you can make a certification that works for one expert in dealing with interacting complex systems of rules, you absolutely can make a certification for another expert in dealing with interacting complex systems of rules. The details of what you test are different, b…
On the defense side, they simply do not work. Everybody gets hacked. The best companies with the biggest security budgets employing people at the cutting edge of security research still get hacked. Security experts get hacked. If the best in the industry still haven't solved this problem, you can't even begin to make the framework that you're proposing.
The discipline cannot be described as experts dealing with interacting complex systems of rules.
Earlier quoted context omitted.
Describe the overflow exploit you wrote. What was the vulnerability, and what did the exploit look like?
Unfortunately I can't get into too much detail because I had to sign an NDA (to prevent cheating). But the process was similar to when I have found them in the wild: identify the app, install it locally, fuzz various parameters (it was a real application, albeit an old one), find the crash, figure out stack space, figure out bad characters, find the right JMP ESP or equivalent instructions in a loaded library, write…