Nah, it isn’t that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That’s a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of “the rest of the fucking owl” here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I’m gonna dumb this down for people like me:
if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn’t.
Most software nowadays is incredibly attuned to this so there’s truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you “hack” some software, you only need to find out how to use it the wrong way. That’s why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.
Nah, it isn’t that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That’s a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of “the rest of the fucking owl” here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I’m gonna dumb this down for people like me: if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn’t.
Most software nowadays is incredibly attuned to this so there’s truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you “hack” some software, you only need to find out how to use it the wrong way. That’s why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.