3 ms·

This article might be handy for someone interviewing at that firm (Red Balloon) that sends you a "weird" hard drive as the interview CTF? I still have it sittin

This article might be handy for someone interviewing at that firm (Red Balloon) that sends you a "weird" hard drive as the interview CTF? I still have it sitting around but it arrived around finals season so I never really looked at it, but since they bothered to send a whole drive and SATA-USB adapter, it obviously must have something to do with the drive itself. If someone had a ton of money, it would be funny to just send the thing to a data recovery lab, have them swap the platters onto an unmodified model and get a raw image of the data to work with. (Or maybe the key is hidden inside the drive firmware chip itself?)

red_balloon 5mo ago
Appreciate the (unaffiliated) shout out! No comment on the drive recovery idea... The fundamentals in the article are all relevant to the hard drive challenge, though the actual multi-step solution to our CTF is rather different. If hacking hard drives sounds intriguing to you, we're hiring reverse engineers and security researchers! See our whoishiring posts and careers page for details: - https://news.ycombinator.com/item?id=47977643 https://news.ycombinator.com/item?id=47977643 - https://redballoonsecurity.com/careers/ https://redballoonsecurity.com/careers/ Be sure to mention Hacker News if you apply.
- busterarm 5mo ago
  I'm glad you all are still doing this challenge. Ang handed one to me at Defcon 6 or 7 years ago and it's one of the most interesting challenges I've ever attempted. Didn't finish it but learned a ton. For anyone reading, Red Balloon is a great place with great people and I highly recommend anyone remotely interested give them a look.
  - HDBaseT 5mo ago
    The Red Balloon website looks AI generated.
    - busterarm 5mo ago
      1) so what? 2) evidence? 3) it's very obviously a wordpress site using elementor 4) the content really hasn't changed a ton in the last 10 years or so as far as I can tell 5) again, so what?
- dmitrygr 5mo ago
  May I have a challenge drive just for the challenge (not interested in switching jobs)?
- justinclift 5mo ago
  As a data point for anyone curious, they're US based ("Midtown West in New York City") and their careers page mentions the roles are all in-office ones. Ah well. ;)
  - busterarm 5mo ago
    They opened/are-opening a northern virginia office, according to their HN posts. But yeah, as much as I would love to work with them, I have zero desire to ever move out of the southeastern US and especially back to NY. The nature of what they do does kind of require in-office work though.
    - justinclift 5mo ago
      Heh, I'm not even in the US. ;)
- superxpro12 5mo ago
  Lol the careers page is itself a candidate screener. Love it.
jareklupinski 5mo ago
i still have mine too! managed to talk to the microcontroller and dump its firmware, but didn't know enough about how to make it arbitrarily run code without worrying about ruining it all

red_balloon 5mo ago

Appreciate the (unaffiliated) shout out! No comment on the drive recovery idea... The fundamentals in the article are all relevant to the hard drive challenge, though the actual multi-step solution to our CTF is rather different. If hacking hard drives sounds intriguing to you, we're hiring reverse engineers and security researchers! See our whoishiring posts and careers page for details: - https://news.ycombinator.com/item?id=47977643 https://news.ycombinator.com/item?id=47977643 - https://redballoonsecurity.com/careers/ https://redballoonsecurity.com/careers/ Be sure to mention Hacker News if you apply.

busterarm 5mo ago
I'm glad you all are still doing this challenge. Ang handed one to me at Defcon 6 or 7 years ago and it's one of the most interesting challenges I've ever attempted. Didn't finish it but learned a ton. For anyone reading, Red Balloon is a great place with great people and I highly recommend anyone remotely interested give them a look.
- HDBaseT 5mo ago
  The Red Balloon website looks AI generated.
  - busterarm 5mo ago
    1) so what? 2) evidence? 3) it's very obviously a wordpress site using elementor 4) the content really hasn't changed a ton in the last 10 years or so as far as I can tell 5) again, so what?
dmitrygr 5mo ago
May I have a challenge drive just for the challenge (not interested in switching jobs)?
justinclift 5mo ago
As a data point for anyone curious, they're US based ("Midtown West in New York City") and their careers page mentions the roles are all in-office ones. Ah well. ;)
- busterarm 5mo ago
  They opened/are-opening a northern virginia office, according to their HN posts. But yeah, as much as I would love to work with them, I have zero desire to ever move out of the southeastern US and especially back to NY. The nature of what they do does kind of require in-office work though.
  - justinclift 5mo ago
    Heh, I'm not even in the US. ;)
superxpro12 5mo ago
Lol the careers page is itself a candidate screener. Love it.

jareklupinski 5mo ago

i still have mine too! managed to talk to the microcontroller and dump its firmware, but didn't know enough about how to make it arbitrarily run code without worrying about ruining it all