4 ms·

How does someone learn this skill? I get that it obviously takes a ton of work, but how do you even prepare/study for (whatever it takes work to do) in the firs

by pizza 10y ago

How does someone learn this skill? I get that it obviously takes a ton of work, but how do you even prepare/study for (whatever it takes work to do) in the first place? The intuition required seems so different from what my intuition of computer systems would allow even imagining.

CalChris 10y ago
A good security class will give you the principles. Look at CS 161 at Berkeley: http://www-inst.cs.berkeley.edu/~cs161/sp16/ http://www-inst.cs.berkeley.edu/~cs161/sp16/ Any bug is a potential exploit. That exploit may not get you very far but it can be chained with another which will get you further. The principles are almost elegant. The details are mind numbing. Luckily, common exploits get collected into metasploit: https://www.metasploit.com/ https://www.metasploit.com/ Script kiddies (Annoyingly Persistent Teenagers to quote Nick Weaver) generally use toolkits like metasploit.
9erdelta 10y ago
I too would like to know. One recommendation I saw in regards to learning to hack stuff like the Nintendo Switch is, first learn to write a kernel, and also learn about compilers. Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox".
- toomuchtodo 10y ago
  > Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox". Do so. It was the first Bunnie book I purchased, and now I'm a lifelong fan owning all of his work. If you haven't read his most recent book, "The Hardware Hacker", it's a must read.
  - pizza 10y ago
    Just finished reading "Hacking the Xbox," per your suggestion - agree that it's quite good at explaining the process. The actual presentation does a good job of condensing what I imagine was an arduous adventure. Thanks for the recommendation.
    - toomuchtodo 10y ago
      So glad you enjoyed it!
astrodust 10y ago
Look at all the historical claims and the techniques involved. It takes a lot of tenacity and trying things that shouldn't work but on extremely rare occasions somehow do. A lot of them publish source code that demonstrates how the exploit worked, plus when paired with an open-source project that has a vulnerability you can see how that matches up to the target. There's a large toolbox of techniques to learn, but in this fashion they're surprisingly well documented. Using these techniques you can find other exploits if you're creative.
homero 10y ago
You don't learn, you gain experience for decades
chickenbane 10y ago
I recently watched and enjoyed this: https://www.youtube.com/watch?v=xkdPjbaLngE https://www.youtube.com/watch?v=xkdPjbaLngE where he describes the hack of the Nintendo Switch, because they shipped an old version of Webkit. It's pretty impressive to see how "just" Javascript can jump from browser to native.
- pthreads 10y ago
  Thank you. I enjoyed it too.
- raphar 10y ago
  Really excellent video. The material is good but also the guy shows an amazing teaching technique . I wish commercial tutorials producers would put such care to their courses.
fragmede 10y ago
> How does someone learn this skill? Broadly, the basis for this is an understanding of how computers actually work - if you learned about it in school, the class would have started with Von Neumann vs Harvard architecture graduating to building a CPU from scratch (well, logic gates, anyway, possibly with Verilog), and followed by another class about writing an operating system; kernel, drivers, then a (rudimentary) user land - basic implementation of syscalls, a glibc-type library to make syscalls, basic shell on top of that. That knowledge and a perseverant attitude (getting exploits to work can involve trying to debug code with zero feedback). As far as this hack goes, broken down into three separate pieces, the exploits should be understandable as being sandbox escapes, but for three different sandboxes (Browser, OS, VM). Sandboxes are implemented in code, the code is going to have bugs, and exploits are "merely" a case of figuring out how to use the bugs to your advantage. No one's made a totally hack-proof sandbox. Not Apple (this year's contest featured a touchbar takeover), not Google (Chrome's fallen in years past), apparently not Microsoft or VMware (nor Linux/Canonical/Ubuntu, either). If you're interested in learning about this stuff, microcorruption is an online security CTF "game" that starts off fairly easily. https://microcorruption.com/login https://microcorruption.com/login The contest part of SANS' holiday hack challenge is over, but the game itself is still up. https://holidayhackchallenge.com/2016/ https://holidayhackchallenge.com/2016/ Rootme is another one. https://www.root-me.org/ https://www.root-me.org/ (I'm sure there are many more out there, those are just the 3 that came to mind.)
- H4CK3RM4N 10y ago
  Can you show me where the touchbar takeover is? That seems really interesting, especially if they took over the watchOS chip in the touchbar.
z3t4 10y ago
an experienced programmer can simply read through the code and see edge cases that migt be explotable. often decompiled/asembled code and use debuggers.
staticassertion 10y ago
I have two recommendations that anyone with a CS degree or equivalent knowledge should be able to jump into with 0 other training, and come out with a solid understanding of how to find vulnerabilities and exploit them. * Hacking: The Art Of Exploitation This is an excellent book. It's lab-oriented, so you will be getting hands-on experience with reverse engineering and exploiting software. And: http://opensecuritytraining.info/ http://opensecuritytraining.info/ They have a graph of classes somewhere, and you can see "Oh I want to get to advanced exploitation, what should I take?" and you just follow along. Start with intro to x86, intermediary x86, then move on to the software vulnerability classes, life of a binary, etc. Really, with only these skills alone, you can self-teach the rest of the way. There's a book called The Art Of Kernel Exploitation, if I'm remembering right, that would take you into a more advanced but more niche area, and it's really up to you where to go after you get the basis (just like with programming).
magpi3 10y ago
Hacking, 2nd Edition is a great introduction. https://www.nostarch.com/hacking2.htm https://www.nostarch.com/hacking2.htm

by pizza 10y ago

CalChris 10y ago

A good security class will give you the principles. Look at CS 161 at Berkeley: http://www-inst.cs.berkeley.edu/~cs161/sp16/ http://www-inst.cs.berkeley.edu/~cs161/sp16/ Any bug is a potential exploit. That exploit may not get you very far but it can be chained with another which will get you further. The principles are almost elegant. The details are mind numbing. Luckily, common exploits get collected into metasploit: https://www.metasploit.com/ https://www.metasploit.com/ Script kiddies (Annoyingly Persistent Teenagers to quote Nick Weaver) generally use toolkits like metasploit.

9erdelta 10y ago

I too would like to know. One recommendation I saw in regards to learning to hack stuff like the Nintendo Switch is, first learn to write a kernel, and also learn about compilers. Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox".

toomuchtodo 10y ago
> Also, personally I've been considering working through Bunnie Huang's "Hacking the Xbox". Do so. It was the first Bunnie book I purchased, and now I'm a lifelong fan owning all of his work. If you haven't read his most recent book, "The Hardware Hacker", it's a must read.
- pizza 10y ago
  Just finished reading "Hacking the Xbox," per your suggestion - agree that it's quite good at explaining the process. The actual presentation does a good job of condensing what I imagine was an arduous adventure. Thanks for the recommendation.
  - toomuchtodo 10y ago
    So glad you enjoyed it!

astrodust 10y ago

Look at all the historical claims and the techniques involved. It takes a lot of tenacity and trying things that shouldn't work but on extremely rare occasions somehow do. A lot of them publish source code that demonstrates how the exploit worked, plus when paired with an open-source project that has a vulnerability you can see how that matches up to the target. There's a large toolbox of techniques to learn, but in this fashion they're surprisingly well documented. Using these techniques you can find other exploits if you're creative.

homero 10y ago

You don't learn, you gain experience for decades

chickenbane 10y ago

I recently watched and enjoyed this: https://www.youtube.com/watch?v=xkdPjbaLngE https://www.youtube.com/watch?v=xkdPjbaLngE where he describes the hack of the Nintendo Switch, because they shipped an old version of Webkit. It's pretty impressive to see how "just" Javascript can jump from browser to native.

pthreads 10y ago
Thank you. I enjoyed it too.
raphar 10y ago
Really excellent video. The material is good but also the guy shows an amazing teaching technique . I wish commercial tutorials producers would put such care to their courses.

fragmede 10y ago

> How does someone learn this skill? Broadly, the basis for this is an understanding of how computers actually work - if you learned about it in school, the class would have started with Von Neumann vs Harvard architecture graduating to building a CPU from scratch (well, logic gates, anyway, possibly with Verilog), and followed by another class about writing an operating system; kernel, drivers, then a (rudimentary) user land - basic implementation of syscalls, a glibc-type library to make syscalls, basic shell on top of that. That knowledge and a perseverant attitude (getting exploits to work can involve trying to debug code with zero feedback). As far as this hack goes, broken down into three separate pieces, the exploits should be understandable as being sandbox escapes, but for three different sandboxes (Browser, OS, VM). Sandboxes are implemented in code, the code is going to have bugs, and exploits are "merely" a case of figuring out how to use the bugs to your advantage. No one's made a totally hack-proof sandbox. Not Apple (this year's contest featured a touchbar takeover), not Google (Chrome's fallen in years past), apparently not Microsoft or VMware (nor Linux/Canonical/Ubuntu, either). If you're interested in learning about this stuff, microcorruption is an online security CTF "game" that starts off fairly easily. https://microcorruption.com/login https://microcorruption.com/login The contest part of SANS' holiday hack challenge is over, but the game itself is still up. https://holidayhackchallenge.com/2016/ https://holidayhackchallenge.com/2016/ Rootme is another one. https://www.root-me.org/ https://www.root-me.org/ (I'm sure there are many more out there, those are just the 3 that came to mind.)

H4CK3RM4N 10y ago
Can you show me where the touchbar takeover is? That seems really interesting, especially if they took over the watchOS chip in the touchbar.

z3t4 10y ago

an experienced programmer can simply read through the code and see edge cases that migt be explotable. often decompiled/asembled code and use debuggers.

staticassertion 10y ago

I have two recommendations that anyone with a CS degree or equivalent knowledge should be able to jump into with 0 other training, and come out with a solid understanding of how to find vulnerabilities and exploit them. * Hacking: The Art Of Exploitation This is an excellent book. It's lab-oriented, so you will be getting hands-on experience with reverse engineering and exploiting software. And: http://opensecuritytraining.info/ http://opensecuritytraining.info/ They have a graph of classes somewhere, and you can see "Oh I want to get to advanced exploitation, what should I take?" and you just follow along. Start with intro to x86, intermediary x86, then move on to the software vulnerability classes, life of a binary, etc. Really, with only these skills alone, you can self-teach the rest of the way. There's a book called The Art Of Kernel Exploitation, if I'm remembering right, that would take you into a more advanced but more niche area, and it's really up to you where to go after you get the basis (just like with programming).

magpi3 10y ago

Hacking, 2nd Edition is a great introduction. https://www.nostarch.com/hacking2.htm https://www.nostarch.com/hacking2.htm