5 ms·
I was asked to crack a program in a job interview, part 2
- pranayairan 12y agoIt is sad to know that even after this much worked he did, he was asked to switch and work on something he was not hired for !!
- atmosx 12y agoI find it hilarious, I'm happy for him. He seems to be working on things he likes now.
- pranayairan 12y agoyaa, and sharing his experience :)
- Fuxy 12y agoYes... All that for writing java and doing CSS. Laughable.
- enraged_camel 12y agoCould be a great meme. "Got the job as a security software engineer, ended up writing CSS"
- wnevets 12y agothe inverse would be funnier in a scary kind of way.
- bithush 12y agoThe inverse is true in a lot of technology companies sadly. I once worked with a "network security expert" who got the job after 2 years as a front end web dev and zero real training in network security. He knew what SSL was so got promoted...
- antocv 12y agoI was a Java Web Gui developer, typical stuff, so the architect of the project asked me to implement better security by reversing SHA512. Specifically SHA512 he said, dont use SHA1 or SHA256 thats not good enough. And he explained several times how the security solution work, it would be based on reversing a hash function. As I shrugged it off, people say weird things sometimes, and offered a real solution he kept pushing for his solution. Weird but anyway maybe he just means what I mean but is using different words, so I implement a real solution, and then days later he questions my judgement and the solution because I didnt use his. Thats when I said "you cant reverse a hash function, in fact thats the point of it" and then point to the diagram he made see there, thats not mathematically possible. His title was Security Architect.
- drblast 12y agoI don't know what to call it, maybe the contrapositive, but if you do this for a living it's kind of surreal when you interview for a dev position and fail because you go too in-depth with underlying details. I've been told, "you're a bit too paranoid about security, we'd recommend you memorize some of the answers to interview questions on StackOverflow if you're really interested in this."
- psaintla 12y agoIt's pretty accurate for most software engineering roles out there. You whiteboard code to solve theoretical problems with algorithms you learned in college. The real job typically involves trying to get code from various languages, frameworks and platforms to work together. There may be one or two times where you actually use some obscure algorithm but that's it.
- driverdan 12y agoDoes Google still do this too? Last thing I knew Google would stick you wherever they decided, not necessarily where your strengths were and where you wanted to be.
- danpalmer 12y agoI was under the impression (possibly wrongly) that you could relatively freely change teams at Google assuming you weren't entirely unsuitable for the job, and were reasonable about not changing team too frequently and actually getting stuff done.
- rhc2104 12y agoFrom what I have heard, "not too frequently" means once every 18 months, so some people have complained about sticking on a team they don't like for a year and a half.
- diminish 12y ago> I'm not working for that company now , I moved to Barcelona. > i live in Barcelona and have a great life In both cases living in Barcelona is positioned as the contrary of working -for that company-, so I'm confused. Are you working? Is it a security-related position?
- deleted 12y ago[deleted]
- jarek 12y agoJ2EE+CSS company was in Turkey, he quit and got a different job in Barcelona
- earlz 12y agoStuff like this deeply fascinates me. However, I can't help but feel like a lot of it could be improved with the help of some automation tooling. Is there anything out there for like a "language" of sorts (or API, etc) that can automate some of the debugging things required? Like I imagine very "active" debugging and code modification like "When we are at this location, and the past few instructions exected were X, Y, and Z at addresses A, B, and C, pop this item off the stack and push this hard coded value on the stack" Things that would take forever to do manually, especially when called in a loop, but would be fairly trivial to formalize into a programming language
- AustinDizzy 12y agoA lot of debuggers and disassemblers do exactly that. They're getting smarter every day, but they still take some knowledge of assembly and lower-level computer science concepts. IDA Pro [0] is a good example of an excellent debugger with plentiful features and productive disassembling tools. [0]: https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/
- tptacek 12y agoMost people here (and people I know in the industry) use programmable debuggers --- Ruby and Python libraries that implement the OS debug hooks. If you're on a Mac, like most people who do software security, Hopper.app is a fantastic alternative to IDA.
- SEJeff 12y agogdb actually has amazingly good python scripting built in if you're using a reasonably new version of it. Redhat lead the charge[1] with what they called 'Project Archer', which was merged into gdb mainline as the python scriptability. [1] http://sourceware.org/gdb/wiki/ProjectArcher http://sourceware.org/gdb/wiki/ProjectArcher
- earlz 12y agoThat's pretty interesting. I'll have to look at that more
- neom 12y agoDropped you some digitalocean credit for being awesome. Totally great read! :)
- tjbiddle 12y ago"$5 plan - you know the company" "I can redeploy another droplet in seconds." Well, I wonder what company that is? :p
- taylorscanlon 12y agoAre there any positions in the industry where this is part of the average work day? It seems awesome and I really want to get into it.
- wging 12y agoAre there any positions in the industry where this is part of the average work day? It seems awesome and I really want to get into it. (the above is copied from a dead post on this thread, possibly by a hellbanned user. i'm reposting it because it's a reasonable question)
- nekitamo 12y agoI imagine this sort of reverse engineering is common for malware analysts and people who work in the AV/security industry. Personally I work at a software security shop, where we aim to prevent this sort of reverse engineering. So we also end up doing a lot of this to be familiar with attacks, test our own protection, debug issues etc... If people want to learn more about this kind of stuff, tuts4you is great: https://tuts4you.com/ https://tuts4you.com/ Specifically, the lena151 tutorials are great for beginners with 0 experience: https://tuts4you.com/download.php?list.17 https://tuts4you.com/download.php?list.17
- xorcist 12y agoExcept for the security industry where I guess this would really be your day job, any job with embedded programming close to the metal is not really far from this. Granted, you don't have an adversary so you won't find any anti-debugging tricks dropped into the code, although at times you'd be forgiven for thinking they had.
- tptacek 12y agoYes. http://www.matasano.com/careers http://www.matasano.com/careers.
- shijie 12y ago> My English is not that bad. I'd say it's quite good. However, I'd quit it with the space after the comma thing, and the no space after the period thing you're doing: >But I'm sorry , i would like to correct some misunderstandings. Should look like But I'm sorry, I would like to correct some misunderstandings. > And finally , please read the end of the post.I'm sure you will like it. Should look like And finally, please read the end of the post. I'm sure you will like it. Great article though! Really enjoyed reading it. Edit: formatting
- dllthomas 12y agoYou mean space before the comma. There should be a space after both commas and periods and no space before either.
- shijie 12y agoBah, yes. That's what I meant. Thanks for catching that.
- deleted 12y ago[deleted]
- nobotty 12y agoHis english is almost as bad as his ability to reverse engineer things.
- metacorrector 12y agomy comments are not appreciated by the mob, so I'll remove them. you sheeple can all return to thinking the same thing while you wait in line for a new iphone. But I do think this is a serious issue and I'm astonished at the sheer number of you who cannot allow discussion of it and will not allow your beliefs to be questioned. I would engage the debate but after all the downvotes I'm barred from posting so it's not much of a debate. The system here is designed to reinforce groupthink.
- mattmanser 12y agoI have no idea why you think a security researcher shouldn't know how virtual locks work and be able to penetrate them, in my mind it seems a reasonable skill test, and so why you think this is immoral is completely beyond me. Would you have the same objections if the test was a complicated SQL injection?
- metacorrector 12y ago
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- genofon 12y agoyou do realize that he was not cracking a normal program but one made to be cracked right?
- metacorrector 12y ago
- nobotty 12y agoReally wish baby-level software analysis posts would stop hitting the top.
- scott_s 12y agoThe "Computer Systems" course that was started at CMU has a similar project commonly called the "bomb lab": http://csapp.cs.cmu.edu/public/labs.html http://csapp.cs.cmu.edu/public/labs.html I TAed a Computer Systems course at a different university, and it was a great exercise to get the students to really understand what was going on in their programs - and to force them to use the powerful tools (disassembler, debugger) available to them.