5 ms·

Is working at one of those labs as much fun as it sounds?

by eli 12y ago

tptacek 12y ago
Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance software. It's the most fun I've had in my whole career. Not for nothing, but working at a software security consultancy is a close second; you lose the freedom to choose your targets (at least 80% of the time), but the work is the same.
- chrisfosterelli 12y ago
  That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.
  - tptacek 12y ago
    I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/ http://matasano.com/careers/
    - mikevm 12y ago
      What's "A Supposedly Fun Thing I'll Never Do Again" doing there?
      - tptacek 12y ago
        Each of those books has a paragraph explaining the recommendation.
      - Kiro 12y ago
        The list author says: "I had a CISSP book here as a joke, but then realized that someone who clicked "buy whole list" would end up accidentally owning a CISSP book. Far better that they accidentally end up owning David Foster Wallace's most accessible book. The state fair essay in particular, worth the price of admission."
    - freehunter 12y ago
      I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect. I don't know how long ago your list was made; would you still recommend Grey Hat Python?
      - m0nastic 12y ago
        I didn't think Grey Hat Python was a great book, but it serves a valuable purpose that I'm not aware of another book supplanting; which is that it shows you that you can use underlying programming to do security-related tasks, instead of being limited to just using tools. The widest chasm that separates security professionals is the one between those that can only use tools other people provide and those that can write their own tools. And more than just being able to write them, but being able to write them quickly enough to be of use during an engagement (which usually only lasts between 1-3 weeks). A lot of security testing at the non-entry level is putting together specific tools to accomplish an engagement-specific task. You don't generally spend a lot of time building giant edifices, it's usually lots of small things that you mostly throw away between gigs (minus whatever underlying libraries you favor using as construction components). In that regard, I think Grey Hat Python is still a good book to introduce you to the idea of using real programming to do hacking, even if you never write a line of Python on an engagement.
      - tptacek 12y ago
        I don't think it's an especially great programming book, but it is a great cross-section of the programming tasks you actually do when working in a vulnerability research lab (or software security consultancy, for that matter).
        droopybuns 12y ago
        Did you ever look at "Violent Python"? Any opinion as an alternative? http://www.amazon.com/Violent-Python-Cookbook-Penetration-Engineers/dp/1597499579 http://www.amazon.com/Violent-Python-Cookbook-Penetration-En...
    - fryguy 12y ago
      Thank you for doing the crypto challenge by the way. Was a lot of fun, and I'm looking forward to the next set :). Has anyone else finished it in c# yet?
      - tptacek 12y ago
        Yes. There is, to my knowledge, no popular language people haven't finished in. We'll have solutions in most of the languages on a public website in a couple weeks. :)
        danielweber 12y ago
        The challenges were published, right? Where are they? Googling for "Matasano Crypto Challenges" shows a bunch of old links.
        tptacek 12y ago
        Nope, the challenges have never been published. We've asked everyone who's done them not to share them.
        king_mob 12y ago
        slightly off topic but, like your appsec reading list above, are there any crypto resources you value for someone taking the self learning route into real world crypto?
        deleted 12y ago
        [deleted]

Is working at one of those labs as much fun as it sounds?

by eli 12y ago

Is working at one of those labs as much fun as it sounds?

Yes. Tim and I got something like 8 months to do this: http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf http://cs.unc.edu/~fabian/course_papers/PtacekNewsham98.pdf ... where we discovered (or were at least first to publish) two whole new attack classes, tracked down something like 6 different super expensive security products and got them up in a lab, designed and implemented a new programming language, and succeeded in giving a giant middle finger to surveillance software. It's the most fun I've had in my whole career. Not for nothing, but working at a software security consultancy is a close second; you lose the freedom to choose your targets (at least 80% of the time), but the work is the same.

chrisfosterelli 12y ago
That's fascinating! I'm curious what sort of education and experience you had to land a job like that, do you mind sharing? I'd love to work in a lab like that one day, but I'm not sure what is considered "good enough" to get a career in security rather than just a hobby.
- tptacek 12y ago
  I'm entirely self taught. I have a single semester of college. I took psych and political science. :) Here's two starting points: - a reading list: http://amzn.to/cthr46 http://amzn.to/cthr46 - how we hire: http://matasano.com/careers/ http://matasano.com/careers/
  - mikevm 12y ago
    What's "A Supposedly Fun Thing I'll Never Do Again" doing there?
    - tptacek 12y ago
      Each of those books has a paragraph explaining the recommendation.
    - Kiro 12y ago
      The list author says: "I had a CISSP book here as a joke, but then realized that someone who clicked "buy whole list" would end up accidentally owning a CISSP book. Far better that they accidentally end up owning David Foster Wallace's most accessible book. The state fair essay in particular, worth the price of admission."
  - freehunter 12y ago
    I've looking into buying Grey Hat Python as more of my job starts to require scripting, but I'm put off by that first review (and overall, the reviews aren't glowing). Interesting that it comes recommended from you, someone whose opinion I respect. I don't know how long ago your list was made; would you still recommend Grey Hat Python?
    - m0nastic 12y ago
      I didn't think Grey Hat Python was a great book, but it serves a valuable purpose that I'm not aware of another book supplanting; which is that it shows you that you can use underlying programming to do security-related tasks, instead of being limited to just using tools. The widest chasm that separates security professionals is the one between those that can only use tools other people provide and those that can write their own tools. And more than just being able to write them, but being able to write them quickly enough to be of use during an engagement (which usually only lasts between 1-3 weeks). A lot of security testing at the non-entry level is putting together specific tools to accomplish an engagement-specific task. You don't generally spend a lot of time building giant edifices, it's usually lots of small things that you mostly throw away between gigs (minus whatever underlying libraries you favor using as construction components). In that regard, I think Grey Hat Python is still a good book to introduce you to the idea of using real programming to do hacking, even if you never write a line of Python on an engagement.
    - tptacek 12y ago
      I don't think it's an especially great programming book, but it is a great cross-section of the programming tasks you actually do when working in a vulnerability research lab (or software security consultancy, for that matter).
      - droopybuns 12y ago
        Did you ever look at "Violent Python"? Any opinion as an alternative? http://www.amazon.com/Violent-Python-Cookbook-Penetration-Engineers/dp/1597499579 http://www.amazon.com/Violent-Python-Cookbook-Penetration-En...
  - fryguy 12y ago
    Thank you for doing the crypto challenge by the way. Was a lot of fun, and I'm looking forward to the next set :). Has anyone else finished it in c# yet?
    - tptacek 12y ago
      Yes. There is, to my knowledge, no popular language people haven't finished in. We'll have solutions in most of the languages on a public website in a couple weeks. :)
      - danielweber 12y ago
        The challenges were published, right? Where are they? Googling for "Matasano Crypto Challenges" shows a bunch of old links.
        tptacek 12y ago
        Nope, the challenges have never been published. We've asked everyone who's done them not to share them.
        king_mob 12y ago
        slightly off topic but, like your appsec reading list above, are there any crypto resources you value for someone taking the self learning route into real world crypto?
      - deleted 12y ago
        [deleted]