By: tan

tan — Sun, 15 Nov 2009 23:18:29 +0000

Just some after thoughts about that dumb-ass hacker challenge from Wiresoft.

It’s not just that $24k is “chump change” – the problem is that when you see “24 hours to beat our firewall”, anyone who has any experience will read between the lines where it says:

a) When you find something, we’re going to do everything in the world to deny it was an issue with our product. So, you should video tape your 24 hour attack under the supervision of a notary public because once the window is closed, everything is going to be heresay.

b) If you use an 0day, it’s going to die because when you read “24 hours to hack in” you realize that everything is going to be sniffed, kernel logged and anything else you can think of. There is also a good chance the vendor will then take credit for “discovering” your bug and killing it, passing no credit on to you.

Another point would be that when you see one of these challenges, you can rest assured that you’re dealing with SNAKE OIL SALESMEN. Someone who is just “discovering” computer security and thinks they have this great solution already. But when you see a challenge like this you KNOW they don’t see the bigger picture and whatever their product is has to suffer from that same ignorance.

Investors and Universities need to stop trying to turn student works into commercial product. Or, if they do, they HAVE to understand that computer security is an industry that suffers MOST from initial impressions and knee jerk reactions. Things are almost NEVER what they seem at first glance in this game and any great idea that may come out of a University needs a “Sherpa” – not just to give a luke warm “thumbs up” to the high level idea, but to dive into the nitty gritty details of HOW things are done.

Universities teach students programming that solves problems without concern for security. Security complicates the solution and it’s the solution that is the lesson objective – so we leave it out. For example, a “secure” code snippet might have 2-3 lines of code for every 1 line of “insecure” code – perhaps more than that even. So of COURSE these students think they can implement their own ideas – without any clue of how dangerous it is for them to take their classroom coding mentality into an actual production environment.

Heh, so if I were a betting man, I’d say, “I see your $24k and… all in”.

Comments on: HNNCast 111309

By: tan

By: tan