These Scars Must Be Worth Something

By Anonymous -


These Scars Must Be Worth Something

A summary of wisdom from years of learning the hard way. Excerpted from a keynote I gave at Rochester Institute of Technology to the RC3 Security Club.


Is Anyone Going to Die? I learned this one in the Army where it was a real question. In the civilian world, overused military metaphors notwithstanding, not so much. The point is perspective. It’s easy to get caught up in the moment and let the stress get to you. At the end of the day, what is really at stake?
No Plan Survives First Contact. Ok, ok, so overused military aphorisms notwithstanding… whatever you plan, you’re not going to think of everything and reality is a harsh mistress. Plan to execute with the expectation that you will need to adjust. On the other hand, you can’t be stuck in analysis paralysis. The key is to balance 80/20 thinking.

It’s a Small World. When you’re young, the world seems so big. There is so much you don’t know and so many of other random people populating it. As you meet more of them, you start to establish a reputation. The lady that annoys you at work, the boss that you’re still not sure is actually literate; you’ll see them again somewhere in some capacity. They might even be a potential customer.
Do The Right Thing. You Always Know What It Is. We always know what the right thing is. It’s just hard. Sometimes really hard. Sometimes we have to say or do things that are going to upset others. If you have to rationalize your choices, then you already know where you’re at.
Ask Questions. Many people are afraid that if they ask questions, then others will think they’re dumb. How can that be worse than actually being dumb? Better to be thought a fool than to open your open mouth and remove all doubt. Questions are a part of active listening.

Be Kind. This is an elective choice. No one can make you do anything. No one can make you be mean or make you be nice. It’s up to you. If someone snaps at you or is rude, maybe they’re just having a bad day. A smile and some kindness goes a long way when you’re feeling down. Did you know that kindness is infectious? Really. It’s called moral elevation. Here’s the science.
Take a Break. Everyone wants to be of value. Yes, there are the laziest of the lazy, nothing in life is absolute. But, fundamentally, everyone wants to be a respected, contributing member of the team. However, this desire to succeed can come at the cost of ourselves. On a daily basis, work in a few physical and mental breaks (the two go hand in hand). Make this a habit. You only have one life and it’s up to you to take care of yourself.

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more