Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Project Zero

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Announcing Project Zero

#61

Post by droopybuns »

tptacek wrote: post #58
freehunter wrote: post #51

Earlier quoted context omitted.

I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect. I don't know how long ago your list was made; would you still recommend Grey Hat Python?

I don't think it's an especially great programming book, but it is a great cross-section of the programming tasks you actually do when working in a vulnerability research lab (or software security consultancy, for that matter).

Did you ever look at "Violent Python"? Any opinion as an alternative?

http://www.amazon.com/Violent-Python-Cookbook-Penetration-En...

Re: Announcing Project Zero

#62

Post by r0m4n0 »

tptacek wrote: post #60
r0m4n0 wrote: post #59

Earlier quoted context omitted.

haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?

No, they would not. The equivalent of this scenario happens all the time . In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).

The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds

Re: Announcing Project Zero

#63

Post by tptacek »

r0m4n0 wrote: post #62
tptacek wrote: post #60

Earlier quoted context omitted.

No, they would not. The equivalent of this scenario happens all the time . In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).

The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds

The story you told about discovering SQLI in Drupal simply isn't covered by CFAA.

Re: Announcing Project Zero

#64

Post by meowface »

droopybuns wrote: post #61
tptacek wrote: post #58

Earlier quoted context omitted.

I don't think it's an especially great programming book, but it is a great cross-section of the programming tasks you actually do when working in a vulnerability research lab (or software security consultancy, for that matter).

Did you ever look at "Violent Python"? Any opinion as an alternative? http://www.amazon.com/Violent-Python-Cookbook-Penetration-En...

I'm not tptacek, but...

After lightly reading through both books, I think Gray Hat Python is a great book for more advanced security concepts, especially on the reverse engineering and exploit dev side of things, but isn't a very good book for learning Python or programming.

Violent Python on the other hand is a great book for beginners to Python and programming, and it teaches both pretty well, but it only goes into surface level security concepts for the most part.

Gray Hat Python is closer to a Windows API/x86 assembly book than a Python one. Violent Python is a real Python book and mostly covers general information security and network security concepts.

Gray Hat Python is also purely application security. Debugging, reversing, hooking, writing shellcode, exploiting... Violent Python is almost entirely network security, with one chapter on forensics. Exploit dev vs. exploit user.

It depends on your experience level and what you want to actually learn. If someone was brand new to Python, application security, and even programming, I'd recommend reading Violent Python first and then Gray Hat. If someone has more advanced security knowledge and has some decent programming skills already, I'd probably tell them to skip Violent Python.

Or if they wanted to focus on appsec vs. netsec, I'd direct them to one or the other based on that. If you want both, you should definitely read both.

Re: Announcing Project Zero

#65

Post by tptacek »

meowface wrote: post #64
droopybuns wrote: post #61

Earlier quoted context omitted.

Did you ever look at "Violent Python"? Any opinion as an alternative? http://www.amazon.com/Violent-Python-Cookbook-Penetration-En...

I'm not tptacek, but... After lightly reading through both books, I think Gray Hat Python is a great book for more advanced security concepts, especially on the reverse engineering and exploit dev side of things, but isn't a very good book for learning Python or programming. Violent Python on the other hand is a great book for beginners to Python and programming, and it teaches both pretty well, but it only goes into…

Wow, obviously not tptacek; you did way better on that comparison than tptacek could have. :)

Re: Announcing Project Zero

#66

Post by snowwrestler »

r0m4n0 wrote: post #59
tptacek wrote: post #53

Earlier quoted context omitted.

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have…

haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?

Look at it this way: what if Drupal's own security committee posted a description of a SQL injection vulnerability (as they often do when issuing patches), and another person takes that info and uses it to attack an unpatched Drupal government site? Would the security committee members be charged?

Re: Announcing Project Zero

#67

Post by fryguy »

tptacek wrote: post #43
chrisfosterelli wrote: post #42

Earlier quoted context omitted.

That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.

I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/

Thank you for doing the crypto challenge by the way. Was a lot of fun, and I'm looking forward to the next set :). Has anyone else finished it in c# yet?

Re: Announcing Project Zero

#68

Post by r0m4n0 »

snowwrestler wrote: post #66
r0m4n0 wrote: post #59

Earlier quoted context omitted.

haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?

Look at it this way: what if Drupal's own security committee posted a description of a SQL injection vulnerability (as they often do when issuing patches), and another person takes that info and uses it to attack an unpatched Drupal government site? Would the security committee members be charged?

I agree, this was probably a bad example because involvement seems a bit of a stretch (although posting on a known black hat forum might change some variables).

What if you had only told your friend of the particular vulnerability and he used that information to write an exploit?

Re: Announcing Project Zero

#69

Post by tptacek »

r0m4n0 wrote: post #68
snowwrestler wrote: post #66

Earlier quoted context omitted.

Look at it this way: what if Drupal's own security committee posted a description of a SQL injection vulnerability (as they often do when issuing patches), and another person takes that info and uses it to attack an unpatched Drupal government site? Would the security committee members be charged?

I agree, this was probably a bad example because involvement seems a bit of a stretch (although posting on a known black hat forum might change some variables). What if you had only told your friend of the particular vulnerability and he used that information to write an exploit?

Writing an exploit is also not illegal. Using the exploit is a problem.

If you tell your friend about a vulnerability, and he writes an exploit and then uses it to break into a retail chain and steal credit card numbers, then you have a problem. Not because finding the vulnerability is illegal, but because there is now a chain of evidence that might link you to something that is unambiguously illegal.

You won't be held liable for unwittingly enabling the crime; you'll be accused of sharing the vulnerability with the express purpose of enabling the crime (actually, maybe, technically, with the purpose of enabling any crime; conspiracy laws get weird). That intent will be something that needs to be proved in court.

That liability is still a stretch, doubly so if, the moment you find out that your friend is doing something crazy, you inform the authorities.

Post reply on HN