4 ms·

Is it really that probable that an email was sent to him from the company he is applying to and someone spoofed that to send him malware? I agree with the root

by runamok 12y ago

Is it really that probable that an email was sent to him from the company he is applying to and someone spoofed that to send him malware? I agree with the root point only because the company could have easily done something like `echo "I just rm -rf'ed your / because you ran me as root"` as part of the test. Why would you consider it still an issue if it was a VM he used only for this purpose?

fsniper 12y ago
Well, email is the primary threat distribution medium right now. So If a security engineer do not show scepticism about an unsigned, unencrypted email from an unverified source, I get picky. Looking from probability perspective, yes you are right, this is a low threat vector. Also I consider working root in a vm an issue because security 101 lesson 1 is "avoid privileged accounts as much as possible". Why not work in a unprivileged shell account and use sudo whenever needed? VMs are not bullet proof and they can leak memory, can make host machine unstable or even crash it. There are hardly any poc's out there but VM's may be exploited to switch context to host machine. Aside from these low probable threats, while working with unknown originated binaries, losing your whole work is a big probability. In this case it would not matter if you are inside a vm or not. VM's can be recovered but lost time can not be.
- claar 12y ago
  "Security 101" isn't all that relevant when you actually understand the threat vectors. If you can't create a clean, isolated, snapshot'd VM for this sort of playing, you have no business applying for this sort of job.
  - fsniper 12y ago
    You are absolutely right. But what about screw up vectors or being careless stack up in this? People are sloppy. It's easy to do mistakes and loose everything. Working with crackme binaries needs more attention.

4 ms·

Is it really that probable that an email was sent to him from the company he is applying to and someone spoofed that to send him malware? I agree with the root

by runamok 12y ago

fsniper 12y ago
Well, email is the primary threat distribution medium right now. So If a security engineer do not show scepticism about an unsigned, unencrypted email from an unverified source, I get picky. Looking from probability perspective, yes you are right, this is a low threat vector. Also I consider working root in a vm an issue because security 101 lesson 1 is "avoid privileged accounts as much as possible". Why not work in a unprivileged shell account and use sudo whenever needed? VMs are not bullet proof and they can leak memory, can make host machine unstable or even crash it. There are hardly any poc's out there but VM's may be exploited to switch context to host machine. Aside from these low probable threats, while working with unknown originated binaries, losing your whole work is a big probability. In this case it would not matter if you are inside a vm or not. VM's can be recovered but lost time can not be.
- claar 12y ago
  "Security 101" isn't all that relevant when you actually understand the threat vectors. If you can't create a clean, isolated, snapshot'd VM for this sort of playing, you have no business applying for this sort of job.
  - fsniper 12y ago
    You are absolutely right. But what about screw up vectors or being careless stack up in this? People are sloppy. It's easy to do mistakes and loose everything. Working with crackme binaries needs more attention.