Also, in a relatively open ended project, llike Google Zero, how do people there decide upon a course of research?
Ask HN: How do security researchers know where to look for vulnerabilites?
1–10 of 31 posts
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#2They look everywhere, I think its a case of survivor bias where we only see when they succeed (via published bugs). We don't hear about the thousands of times that they failed to find anything.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#3One approach is to think of a class of bug (like SQL injection, command injection, XSRF, ...), and look for that class of bugs in a large number of software products.
Another is to focus on components that are of high impact because they are used everywhere: standard UNIX tools, compilers, shells, OpenSSL and friends, BIOS, CPUs, common network controllers, disk firmware etc. and analyze them for anything you can think of, run a fuzzer on them etc.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#4No one here, but I am assuming they have number/List of things they go through and if they encounter something strange they dig deeper.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#5Disclaimer: I have been working as a security researcher for +5 years (web and mobile apps).
I personally use tools that report all the activity that a software produces, most of that is TCP or UDP connections. Among the tools that I use are WireShark, Burp Suite and mitmproxy. I also keep myself updated with techniques used by other researchers in other areas by collaborating on different forums and networking events. I also have several hundred honeypots distributed around the planet powered by OSSEC to collect and analyze bad traffic.
Less than 3 years ago I switched to do vulnerability research on mobile and desktop software and a whole new world opened in front of me. Debugging HTTP connections is one of the most common tasks and there are plenty of tools available out there, I have a small set of tools to do network sniffing and analyzing. Going deeper into the software, I frequently do black-box penetration testing (which basically means, I don't have access to the source code) and so tools like IDA, Hopper Disassembler, Binary Ninja, Cutter are first hand in my toolset.
> How do people there [Google Zero] decide upon a course of research?
• Someone tips you some information about suspicious activity,
• You are using the software as a regular user and notice something weird,
• You are interested to know how a software works and diving into it reveals secrets,
• One of your honeypots and/or network sniffers alerts you about unwanted connections,
• The author of that software requests you to do some penetration testing for an audit,
• Someone found a small problem in the software and you dive into to try to find more,
• And more commonly, you are bored and want to pass the time doing something more boring :D
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#6I'm still an intern in the industry but have worked for a few places, you normally start by poking around/recon, look at where things get complicated and where systems are connected because those are often the breaking points.
During recon, if you can find what tech is being used you can see if it's outdated at all or where vulnerabilities were found in the past. If you're doing penetration testing/vulnerability assessment you're not inventing new exploits, just using what's already out there and tweaking it. Research on new exploits is more rare as a job I think.
See [0] for the steps of pentesting and OWASP [1] for everything regarding security.
[0] https://www.cybrary.it/2015/05/summarizing-the-five-phases-o...
[1] https://www.owasp.org/index.php/Main_Page
Also there is a big security community on twitter where you can see researchers tweet about a lot of the stuff they're working on right now.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#7This is a deep topic. Here's an answer to it, which might not be everyone's go-to answer:
Consider the case where you know either the software or the system which is the target. Consider also the case where your goal is "get a reliably exploitable vulnerability while coming in under budget" as opposed to e.g. "enumerate a sufficiently broad swathe of vulnerabilities such that a stakeholder is pleased with your diligence." You will probably prioritize vulnerability classes which, in your experience and/or that of the industry, are numerous and high-severity. You will probably also prioritize "the joints" of the system, because (if you've done software development professionally) you know that handoffs between scripts, teams, servers, processes, etc etc are never as well-implemented or well-tested as something which is deeply within a particular set of borders.
Thomas has posted a list of features which are high-probability candidates for game-over vulnerabilities several times on HN; see second half of this comment: https://news.ycombinator.com/item?id=7936921
Research prioritization in a wide open space is research prioritization in a wide open space, and is broadly a hard problem. Broadly speaking you look for leverage: how does the set of things you are capable of causing get to a disproportionate (potential) impact? If I were hypothetically in Google Zero, I'd be looking primarily for widely deployed software which sits in poorly-understood places, operates at least part of the time on user-supplied data, and is colocated with terrifyingly sensitive systems. Bonus points if that software is boring and so hasn't had anyone take a serious look at it in a while, like e.g. png rendering libraries or request parsing libraries.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#8Maybe they have specific targets or categories of software in mind.
Or maybe the individuals focus on a specific theme or pattern.
They can often use the experience if they follow a similar pattern.
For example someone might focus on password manager applications.
If they find one family of weaknesses they can often go test other similar applications to see if they have made similar mistakes.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#9I recommend "The Art of Software Security Assessment" (Dowd, Mcdonald, Schuh) if you want a exhaustive book on the subject.
Re: Ask HN: How do security researchers know where to look for vulnerabilites?
#10I like to use GitHub to find vulnerabilities.
I mostly do cryptographic engineering, so when hunting for issues, I search for things that are usually problematic. For example, searching for something like "XOR encrypt" and you might find someone doing something they shouldn't.
You can also try to find problematic implementations of standards by searching for those standards and trying to find comments or similar code. You might find some interesting stuff by searching "ECIES" or "NIST SP 800".
If your goal is to begin research, typically you'd find a problem, exploit technique, or vulnerability class that interests you. Then you start looking for places where you might be able to see how people defend against it (if at all). This is when you start finding issues pretty quick since you develop some sort of custom heuristics on code you examine.
Best tip from me would be to get to know some standards and see if they are being implemented correctly.