3 ms·
Well, this is Project Zero, the security researchers working there are highly competent, but I do agree this guy is amazing. I wonder what kind of methodology d
by yeukhon 10y ago
Well, this is Project Zero, the security researchers working there are highly competent, but I do agree this guy is amazing. I wonder what kind of methodology do they use to even come up with these attacks.
- dsacco 10y agoHaving briefly interacted with a few of them, and following their work in general: 1. They have a phenomenal intuition for where developers get lazy, tired or simply incompetent in security-sensitive code, 2. They have, in aggregate, a vast knowledge and understanding of past vulnerabilities and how those might be repeated elsewhere or imperfectly patched, 3. They practice a lot and they read a lot (i.e. relevant research, etc). It might be more accurate to say that they have a lot of practice because of their work, not that they actively practice outside of work. 4. They are good at the general process of security research - long hours of mostly dull, complex research interspersed with brief eureka moments and bouts of euphoria. They're an extraordinary team, for sure.
- awirth 10y agoNatalie Silvanovich of Project Zero gave a talk at REcon last year about how she finds flash bugs, and she went into her methodology some: https://www.youtube.com/watch?v=JbvwCEOxyrA https://www.youtube.com/watch?v=JbvwCEOxyrA