8 ms·

How I started in web security

185 points by gkop 11y ago

daguava 11y ago
Neat article, interesting that suggestions for sane defaults in rails were more-or-less ignored until the problem was demonstrated to easily impact a wide user-base.
- venomsnake 11y ago
  That is how the world works. Proactive security is expensive and it brings no obvious value to the people that manage organization resources. "A problem is only a problem when it materializes" - that is the way some people think.
- jldugger 11y ago
  That was the source of lolz at the time it happened. If anything, the article demonstrates how little you need to know to break things. In a way, it's a miracle anything works around here.
  - jacquesm 11y ago
    "If engineers built buildings and bridges the way programmers write software the first woodpecker that would come along would destroy civilization."
    - chrisan 11y ago
      That is kind of unfair :) Typically infrastructure engineers get to (or rather have to) over-engineer things. When you build a bridge you don't build something that is _just_ good enough to hold X cars. You design it to hold X + Y% and/or have Z redundancy Most software doesn't put peoples lives in danger and thus doesn't get the budget/resources to put in NASA like engineering in software
      - jacquesm 11y ago
        That's why our motto is 'move fast and break things' right?
        simoncion 11y ago
        That's sure as fuck not my motto. ;)
        jacquesm 11y ago
        Thank you.
      - tonyarkles 11y ago
        A lot of engineering is about meeting requirements while keeping costs down. As the joke goes... "Anyone can build a bridge that stands; it takes an engineer to build a bridge that just barely stands"
        enraged_camel 11y ago
        I realize it's a joke, but even then it's not a good one. The reality is actually the other way around. Anyone can build a bridge that barely stands, but it takes an engineer to build one that still stands after an earthquake.
        tonyarkles 11y ago
        Uhhhh... see https://en.wikipedia.org/wiki/List_of_Roman_bridges https://en.wikipedia.org/wiki/List_of_Roman_bridges I'm not sure if the original designers intended for these to have multi-millenia design lives, but I bet that they could have been made much cheaper...
        enraged_camel 11y ago
        If they were made much cheaper, they likely would not be standing today.
    - wglb 11y ago
      Lots of folks chuckled at this when it was first said, but then in the late 90s, the were not chuckling at y2k.
      - jacquesm 11y ago
        As late as 1986 someone reprimanded me for 'wasting two bytes' in a record.
  - golergka 11y ago
    The more I learn about security, the faster I want to run away from anything related to it. Being a client-side developer in gamedev (i.e. a space that's not as sensitive to security as a lot of other industries) feels so good.
    - simoncion 11y ago
      > Being a client-side developer in gamedev (i.e. a space that's not as sensitive to security as a lot of other industries) feels so good. :( A buggy and/or vulnerable game client or server is generally just as hazardous as most any other buggy or vulnerable software.
      - golergka 11y ago
        Buggy game client can only be hazardous if the client/server architecture is built incorrectly — and at least that is not hard to avoid. (Screams "DON'T TRUST THE CLIENT" in the architecture meetings usually help.)
        simoncion 11y ago
        > (Screams "DON'T TRUST THE CLIENT" in the architecture meetings usually help.) Yeah, except that in many (most?) modern games you can't have a fully-untrusted client... for performance reasons you have to give the client too much information. From what I understand, getting that balance just right is rather tough. :( > Buggy game client can only be hazardous... Don't forget that the vast majority of games pass data to 3D graphics card drivers which are terrible, awful, and somewhere between hardly and not at all concerned with security. A bug in a game could hard-lock your system, [0] or lead to code execution in kernelspace. (Not to mention the usual host of problems a buggy program that has read/write access to everything that the system user it's running as, and generally full network access has.) [0] Despite Windows 7's graphics card driver fault isolation system, I've had a couple of graphics-related hard-lockups in the many years I've been using my gaming PC.
dkhar 11y ago
I remember when that whole snafu was on the HN front page! :) (This isn't the exact link I remember seeing, but https://news.ycombinator.com/item?id=3666564 https://news.ycombinator.com/item?id=3666564 )
kriro 11y ago
"""Use your own brain. After all any book is just a list of thoughts of another guy, who might be wrong.""" """The text above is preface to a little security book I write for newbie hackers and web developers.""" I chuckled.
- tbastos 11y ago
  Just goes to show his honesty :-) "One is not to trust my teachings implicitly but to test them oneself and evaluate their effects." — Buddha (thus making Buddhism perhaps the only "religion" not plagued by faith and dogma, and kind of disseminating the scientific method)
  - nsomaru 11y ago
    Buddhism is not the only religion not plagued by faith and dogma. Faith and dogma exist wherever people have outsourced their ability to think. 'Buddhists' do this too, just as some adherents to other faiths do too. On a side note, the intellectual portions of Vedic literature often emphasise the need for viveka (knowledge, discrimination) and prashnena (questioning) which are requisite qualities of a shisya (student). Arguably, much of Buddhist metaphysics is based on these Upanishadic texts (Vedanta).
    - tbastos 11y ago
      Buddha himself was clearly against faith and dogma, and also considered metaphysics irrelevant to the human condition. If you consider Buddhism to be the original teachings, then it's obvious dogma has no place in it, and a person afflicted by dogma could always be pointed to the original teachings. More religious branches of Buddhism exist, but they are blatant bastardizations of the original teachings. This is very different from the situation in other religions, where the original scriptures are the main sources of dogma galore.
deleted 11y ago
[deleted]
hamhamed 11y ago
Likewise, my story about how I got into and out of security: it really just takes basic programming knowledge, understanding reverse engineering concept, and constantly testing shit. When I got kicked out of college for my hack (rm https://news.ycombinator.com/item?id=5090007 https://news.ycombinator.com/item?id=5090007) all I did was spam URLs with different IDs and test if they returned 200 or 404.. and bam press coverage + job offers. Sometimes the simplest of stuff can lead to nirvana. I'm no longer in security since it was getting very addicted (I would start testing every website I'd visit for vulbs)..and I had to change and decided to jump into the startup world.
- jacquesm 11y ago
  > I would start testing every website I'd visit for vulbs That's a pretty bad idea if you don't have permission from the owners of the site.
  - hamhamed 11y ago
    Permission is the enemy of a hacker. Us enthusiasts don't mean any harm and almost never perform tests that break the software (or network). There's a reason why bounty programs exist.
    - jacquesm 11y ago
      Us enthusiasts might end up in court and/or trouble for that. Do not do pen-testing on systems you don't own or have explicit permission to work on (such permission might be a bug bounty program or something to that effect). Yes, there is a reason why bounty programs exist, they make it plain that testing is 'ok'. In absence of a bounty program or a relationship with the company you can't claim that you 'don't mean harm' and that your tests would never break the software or the network. It's going to be lumped in with actual attacks.
      - homakov 11y ago
        One caveat: client side attacks like XSS that don't execute or break backend part are rather ok 100% of time
ballsohardy 11y ago
Disagree with the avoid certs part, some are pretty useful like the OSCP, very hands on
hackaflocka 11y ago
I was very intrigued by "Oh, also avoid certifications." I'm planning to become a solo, freelance, contract worker in IT security. I have no certs. (I do have a PhD. in a computer related field, though.) So, how do I convince organizations to hire me in this cert obsessed world?

185 points by gkop 11y ago

Neat article, interesting that suggestions for sane defaults in rails were more-or-less ignored until the problem was demonstrated to easily impact a wide user-base.

venomsnake 11y ago
That is how the world works. Proactive security is expensive and it brings no obvious value to the people that manage organization resources. "A problem is only a problem when it materializes" - that is the way some people think.
jldugger 11y ago
That was the source of lolz at the time it happened. If anything, the article demonstrates how little you need to know to break things. In a way, it's a miracle anything works around here.
- jacquesm 11y ago
  "If engineers built buildings and bridges the way programmers write software the first woodpecker that would come along would destroy civilization."
  - chrisan 11y ago
    That is kind of unfair :) Typically infrastructure engineers get to (or rather have to) over-engineer things. When you build a bridge you don't build something that is _just_ good enough to hold X cars. You design it to hold X + Y% and/or have Z redundancy Most software doesn't put peoples lives in danger and thus doesn't get the budget/resources to put in NASA like engineering in software
    - jacquesm 11y ago
      That's why our motto is 'move fast and break things' right?
      - simoncion 11y ago
        That's sure as fuck not my motto. ;)
        jacquesm 11y ago
        Thank you.
    - tonyarkles 11y ago
      A lot of engineering is about meeting requirements while keeping costs down. As the joke goes... "Anyone can build a bridge that stands; it takes an engineer to build a bridge that just barely stands"
      - enraged_camel 11y ago
        I realize it's a joke, but even then it's not a good one. The reality is actually the other way around. Anyone can build a bridge that barely stands, but it takes an engineer to build one that still stands after an earthquake.
        tonyarkles 11y ago
        Uhhhh... see https://en.wikipedia.org/wiki/List_of_Roman_bridges https://en.wikipedia.org/wiki/List_of_Roman_bridges I'm not sure if the original designers intended for these to have multi-millenia design lives, but I bet that they could have been made much cheaper...
        enraged_camel 11y ago
        If they were made much cheaper, they likely would not be standing today.
  - wglb 11y ago
    Lots of folks chuckled at this when it was first said, but then in the late 90s, the were not chuckling at y2k.
    - jacquesm 11y ago
      As late as 1986 someone reprimanded me for 'wasting two bytes' in a record.
- golergka 11y ago
  The more I learn about security, the faster I want to run away from anything related to it. Being a client-side developer in gamedev (i.e. a space that's not as sensitive to security as a lot of other industries) feels so good.
  - simoncion 11y ago
    > Being a client-side developer in gamedev (i.e. a space that's not as sensitive to security as a lot of other industries) feels so good. :( A buggy and/or vulnerable game client or server is generally just as hazardous as most any other buggy or vulnerable software.
    - golergka 11y ago
      Buggy game client can only be hazardous if the client/server architecture is built incorrectly — and at least that is not hard to avoid. (Screams "DON'T TRUST THE CLIENT" in the architecture meetings usually help.)
      - simoncion 11y ago
        > (Screams "DON'T TRUST THE CLIENT" in the architecture meetings usually help.) Yeah, except that in many (most?) modern games you can't have a fully-untrusted client... for performance reasons you have to give the client too much information. From what I understand, getting that balance just right is rather tough. :( > Buggy game client can only be hazardous... Don't forget that the vast majority of games pass data to 3D graphics card drivers which are terrible, awful, and somewhere between hardly and not at all concerned with security. A bug in a game could hard-lock your system, [0] or lead to code execution in kernelspace. (Not to mention the usual host of problems a buggy program that has read/write access to everything that the system user it's running as, and generally full network access has.) [0] Despite Windows 7's graphics card driver fault isolation system, I've had a couple of graphics-related hard-lockups in the many years I've been using my gaming PC.

dkhar 11y ago

I remember when that whole snafu was on the HN front page! :) (This isn't the exact link I remember seeing, but https://news.ycombinator.com/item?id=3666564 https://news.ycombinator.com/item?id=3666564 )

kriro 11y ago

"""Use your own brain. After all any book is just a list of thoughts of another guy, who might be wrong.""" """The text above is preface to a little security book I write for newbie hackers and web developers.""" I chuckled.

tbastos 11y ago
Just goes to show his honesty :-) "One is not to trust my teachings implicitly but to test them oneself and evaluate their effects." — Buddha (thus making Buddhism perhaps the only "religion" not plagued by faith and dogma, and kind of disseminating the scientific method)
- nsomaru 11y ago
  Buddhism is not the only religion not plagued by faith and dogma. Faith and dogma exist wherever people have outsourced their ability to think. 'Buddhists' do this too, just as some adherents to other faiths do too. On a side note, the intellectual portions of Vedic literature often emphasise the need for viveka (knowledge, discrimination) and prashnena (questioning) which are requisite qualities of a shisya (student). Arguably, much of Buddhist metaphysics is based on these Upanishadic texts (Vedanta).
  - tbastos 11y ago
    Buddha himself was clearly against faith and dogma, and also considered metaphysics irrelevant to the human condition. If you consider Buddhism to be the original teachings, then it's obvious dogma has no place in it, and a person afflicted by dogma could always be pointed to the original teachings. More religious branches of Buddhism exist, but they are blatant bastardizations of the original teachings. This is very different from the situation in other religions, where the original scriptures are the main sources of dogma galore.

deleted 11y ago

[deleted]

hamhamed 11y ago

Likewise, my story about how I got into and out of security: it really just takes basic programming knowledge, understanding reverse engineering concept, and constantly testing shit. When I got kicked out of college for my hack (rm https://news.ycombinator.com/item?id=5090007 https://news.ycombinator.com/item?id=5090007) all I did was spam URLs with different IDs and test if they returned 200 or 404.. and bam press coverage + job offers. Sometimes the simplest of stuff can lead to nirvana. I'm no longer in security since it was getting very addicted (I would start testing every website I'd visit for vulbs)..and I had to change and decided to jump into the startup world.

jacquesm 11y ago
> I would start testing every website I'd visit for vulbs That's a pretty bad idea if you don't have permission from the owners of the site.
- hamhamed 11y ago
  Permission is the enemy of a hacker. Us enthusiasts don't mean any harm and almost never perform tests that break the software (or network). There's a reason why bounty programs exist.
  - jacquesm 11y ago
    Us enthusiasts might end up in court and/or trouble for that. Do not do pen-testing on systems you don't own or have explicit permission to work on (such permission might be a bug bounty program or something to that effect). Yes, there is a reason why bounty programs exist, they make it plain that testing is 'ok'. In absence of a bounty program or a relationship with the company you can't claim that you 'don't mean harm' and that your tests would never break the software or the network. It's going to be lumped in with actual attacks.
    - homakov 11y ago
      One caveat: client side attacks like XSS that don't execute or break backend part are rather ok 100% of time

ballsohardy 11y ago

Disagree with the avoid certs part, some are pretty useful like the OSCP, very hands on

hackaflocka 11y ago

I was very intrigued by "Oh, also avoid certifications." I'm planning to become a solo, freelance, contract worker in IT security. I have no certs. (I do have a PhD. in a computer related field, though.) So, how do I convince organizations to hire me in this cert obsessed world?