Programmers need to think like hackers(gexos.org) |
Programmers need to think like hackers(gexos.org) |
Btw, every section is numbered "1." on my Android's Chrome.
That got me too. Stop using hacker to mean criminals and vandals, please. The word has a very rich and positive history [0]: it's much better to draw peoples' attention to that:
> The act of engaging in activities in a spirit of playfulness and exploration is termed "hacking". The defining characteristic of a hacker is not the activities performed themselves (e.g. programming), but the manner in which it is done.
>> What they had in common was mainly love of excellence and programming. They wanted to make their programs that they used be as good as they could. They also wanted to make them do neat things. They wanted to be able to do something in a more exciting way than anyone believed possible and show "Look how wonderful this is. I bet you didn't believe this could be done."
But if I'm in a conference room, and I see some little embedded computer powering something, my mind immediately starts going "Oooo, wut that? Does it run something unixy? I wonder if it connects to the same network as the main office. I could probably borrow its little flash memory disk without anyone noticing for a day or so. I bet I could put a program to open a reverse shell for me so that I can just peacefully chill behind the firewall anytime I want."
Etc, etc etc. I can't help it. I'm curious! I'm also not very driven and highly nervous. But what if I were driven and brazen, but also very curious?
Put important things behind a firewall, and make sure that firewall is correlated to a physically secure location. Password protect systems that need protection. Encrypt things that are critical and confidential. Limit the number of people who have unrestricted access. Divide your network so that more public services only communicate with more secure backend service as little and as securely as possible. Don't hire people you don't trust. Compensate the people you hire well. Be ethical so that people generally won't delight in your downfall.
And then live your life! Lol.
Totally! I can't help it either. I dont' really think I'm that clever either, it's just a personality thing. You just want to know how things work, especially when they seem trivially flawed at first glance and you wonder if anyone has bothered to check! The thing that got me yesterday was my building's security gate.
When you swipe your prox card, it plays a tone pair that sounds exactly like a DTMF tone, and then the latch opens. I had one of those forehead-smacking moments where you can't believe you didn't notice that already, and then the rabit hole:
Any sound would do to alert the human that the gate was opening, so why are they using this one? Hey, there's totally a dial pad next to it! Is the security gate really made out of POTS telephone parts? Is it some wierd fake legacy compatibility thing that's just made out of software? If it actually listens to itself to open the gate, then is it subject to a trivial playback attack, like the dictaphone scene from Wargames? Does it have real phone number? IP?
No _way_ it could be that easy, right? Right??! That would be soooo dumb I'm sure that wouldn't work, but omg I have to go down there _right_ now and find out! Hmm, wait there's also a security camera and this is a really stupid reason to get arrested... <takes some deep breaths and tries to control self>
It's easy to think, naively, that someone should do something about this, I'm someone, and they would rather hear it from the good guys. But that often turns out not to be true.
Also, it seems like it's really hard to sell security mindset as a candidate for a dev job. I spent a fair amount of time on formal software and systems security coursework, but I couldn't really figure out how to market that to an employer. It seems like most management thinks of security as an IT or Devops task or something that isn't a developer's job, and other devs think of security a separate role, occupied by the person that just says "no" to all kinds of things.
I hope this isn't generally the case, because I think this stuff is really important and I want to help. I'm just not sure how get there from here...
Find a smaller company who has a more relaxed hiring process and sound smart. Be fluent in bash, python, and write at least one or two small programs in C so that you understand how to build such projects from source, how headers work, etc.
Then, work like hell to close the gaps in your knowledge. The job will provide you a constant drip of new things to frantically learn about, which is the thing I've appreciated the most about this opportunity. I really feel my skills growing just because I'm using them to feed myself.
Perhaps it's because of different terminology, but I'm already somewhat lost on the first sentence of the article. What does reporting mean in this context?
I’m speaking from experience.
Most of what this article talk about can be learned in a couple of days. Get familiar with ZAP, a proxy to replay and modify http request useful to test webapps for things like XSS, sql injections, Maltego, a fancy port and networks scanner, and some other tools you or a 12 year old can learn from youtube.
Seriously this hacking things is overrated and shift-left-security is a joke with the same punchline as DevOps, more best practices mandated by consultant that don't do the actual work, for engineers to follow instead of giving them the space to think about a good problem/solution fit.
even so, you have absolutely lapped me in this particular race. at any rate, i will reflect on these suggestions. this is one of those times i wish there was a PM feature here. oh well. do you mind if i ask who you work for and (approximately?) where you are? np if you don't wish to answer that, but it would be interesting to me. cheers.