3 ms·
I work for White Ops, which could reasonably be considered a verification vendor, though we prefer to be known as a security company. As you can imagine, speci
by ryan-c 8y ago
I work for White Ops, which could reasonably be considered a verification vendor, though we prefer to be known as a security company.
As you can imagine, specific techniques used for detecting fraudulent monkey patching (or even whether we attempt to do so) aren't generally something I can talk about.
That said, there are a few slides about the cat-and-mouse games of .toString() here (starting about page 20): https://rya.nc/shmoo17 https://rya.nc/shmoo17 [PDF]
In short, using .toString() will find naive monkey patches, however it can be overridden to varying degrees of cleverness.
- dillondoyle 8y agoOf course they already thought of that lol. I really love the cleverness of this 'game.' I probably spend far too much time tinkering with our own js measurement script for how small we are but it's kind of addictingly fun. Are you involved with sales or just engineering? My work email is in my profile I might drop you a note though I am just guessing your product is too expensive for our clients (mostly political campaigns).
- ryan-c 8y agoI'm a researcher - I don't actually see your email in your profile, you have to include it in the about text if you want it to be seen. I can put you in touch with the right person in sales if you contact me (my personal email is publicly visible).
- dillondoyle 8y agoit's dillon @ 4degre.es