5 ms·
This really takes you into the mind of a hacker(the malicious kind). Judging from what I saw it seems they combine a ton of small exploits to produce a major se
by moistgorilla 14y ago
This really takes you into the mind of a hacker(the malicious kind). Judging from what I saw it seems they combine a ton of small exploits to produce a major security breach. The amount of understanding of the underlying system you need to have in order to put these exploits together is mind boggling.
What do we do against people like this?
- TheBoff 14y agoPay them to find the bugs!
- skeletonjelly 14y agoJust don't let them run out of bugs to find, or get bored :P
- wtracy 14y agoWhat's the problem if they run out of bugs to find? Would that not imply that there are no exploits left to be made?
- skeletonjelly 14y agoBecause if they get bored, they'll find other things to exploit/break. It's in their nature.
- saurik 14y agoThen, by definition, you would not have run out of bugs.
- JamesLeonis 14y agoIMHO, as Pinkie demonstrated, there isn't anything foolproof that you can do against a malicious hacker. Having sponsored and/or incentives for white hat hackers to find and report exploits seems to be the best answer. If this stance were adopted into the wider software development community, would it turn more black hat hackers into white hats? EDIT: grammar
- lucian1900 14y agoThe term you're looking for is "cracker".
- lawnchair_larry 14y agoNo, crackers defeat software protections. No one in the security industry (legitimate or otherwise), uses the term cracker for anything other than that, despite what Eric S Raymond et al would like you to believe.
- lawnchair_larry 14y agoI don't like how you vilify him and call him malicious. Nothing about this was malicious. He even gave it to google for far less than it was worth. This was a legitimate audit and demonstration and it is wrong to associate anything negative with it. What do we do against people like this? You're asking the wrong question. Remember, he didn't put those bugs there. He didn't break anything. It was already broken. He just found the hole by reading exactly what you gave him. What you should be asking is, how do we stop making software with vulnerabilities. The goal is to make it so that there is no hole to find, not to get rid of the hole-finders.
- shmageggy 14y agoJust to play angel's advocate, your parent could have been referring to an abstract malicious hacker, who would probably think the same way and use the same techniques as Pinky. The "mind of a hacker (the malicious kind)" is probably very much like the mind of Pinky, except for the parts governing ethics. And he asks what to do "against people like this", not what to do against Pinky himself. But you are right, and it is valuable to point out that neither Pinky nor Homakov nor any other talented whitehat are in no way malicious.
- rgoddard 14y agoHonestly, the overall process reminds me of what I do some days trying to automate processes which were not designed to be automated. I know what I want to do, I just have to figure out how, step by small step, using things not in the way they were intended to be used.