[HN Gopher] Ask HN: What do I need to learn to be useful as a ha...
___________________________________________________________________
Ask HN: What do I need to learn to be useful as a hacker to defend
my country?
The Ukrainians have called on the "hacker underground" to defend
against Russia: https://news.ycombinator.com/item?id=30462219
Everyone of us here has above average computer skills, but most of
us don't have offensive or defensive cyber warfare skills. We have
all seen how quickly war can break out. What does one need to know
to be of value to one's military, should the need ever arise? What
skills would they be looking for? How can I acquire those skills?
Author : axiosgunnar
Score : 95 points
Date : 2022-02-25 19:58 UTC (3 hours ago)
| enw wrote:
| Work for the government or a military contractor.
| willcipriano wrote:
| At the end of the day firearm training is probably more valuable
| than anything else in Ukraine right now. Taking pot shots from a
| distance at groups of troops can cause them to seek cover and
| slow down their progression. I think that's about the best you
| can do as 1 - 4 people. Look to the Vietnamese or Taliban on how
| to defeat a larger better equiped force with a smaller less
| equiped one.
| dragonsky wrote:
| Way to give advice that is guaranteed to get them killed. Bravo
| [deleted]
| explaingarlic wrote:
| The world is not an RPG video game, you likely can't just
| strictly "improve" yourself up to any given standard (no matter
| what any employer or teacher tells you - they're just trying to
| buy time as you sit in their classroom or accept a lower paycheck
| than you are worth). Experience is key, and it _ISN 'T_ best
| measured in years - you can likely put in more time than anybody
| on something given that you seem like a young kid who's eager.
|
| That being said, and now that it's clear that you aren't just
| going to push a number higher until you can send all of your
| cyber zerglings into the enemy's virtual mineral line, this is a
| good process to follow for finding serious vulnerabilities -
| exploiting them should be trivial if you have a good enough
| understanding of the system:
|
| - Think of a system in use, at any layer of the stack. This could
| be a specific web application in use by the enemy, a runtime
| that's used by some applications of theirs, or a memory/cache
| model on a CPU architecture that's flawed or anything like that
|
| - Learn enough about that system that you can understand any
| inner working of it
|
| - Painstakingly look through areas where you, just via inference,
| can tell that there could be some sort of vulnerability - key
| areas to focus on are something that is something downstream to
| user input, or something similar.
|
| All of that is to say that, if you aren't already "useful", your
| country is probably going to have a regime change before you can
| find anything strictly useful.
|
| If there's something simple enough that someone who's relatively
| unexperienced can do it, then it's probably automated.
|
| OR - use a bunch of stolen credit cards you bought online for $3
| each to rent a few VPS' (maybe come up with some consolidation
| solution to more easily make accounts and setup SSH boxes) and
| throw as much layer 4 traffic at Russian endpoints as you can
| :-).
| imwillofficial wrote:
| I laughed so hard at "cyber zerglings"
| dadlangia4 wrote:
| The "lower" you get down the stack the more valuble youll be. You
| have to understand the fundimentials of how software works in
| order to reverse engineer it and start "hacking"
| geofft wrote:
| If you're asking _in the general case_ , as opposed to "How would
| I respond to this call" - my opinion is that the most practical
| and effective thing you can do is to help secure code used by
| individuals - web browsers, the Linux kernel, image decoders,
| etc. I think there are a number of reasons for this:
|
| 1) There is a real asymmetry between offense and defense in
| (nominal) peacetime. Helping the defense generally helps the
| "good guys" much more than the "bad guys" (at least in my
| worldview). If you look through attempted attribution of 0day
| attacks in the wild, what you generally see is repressive
| governments attacking individuals - watering-hole attacks on news
| sites, targeted malware against lawyers and journalists, etc.
| Cases of attacks on governments (like the 2012 MD5 collision that
| took down an Iranian nuclear reactor) seem to be rarer, and in
| particular, cases that rely on bugs in mass-market software (as
| opposed to supply-chain attacks or DoSes or very targeted
| attacks) are rarer, and attacks from less powerful / "hacker
| underground" groups _towards_ governments are rarer still.
|
| 2) Structurally, it makes more sense. Cyberattacks aren't like
| physical attacks. When ammunition hits a target, there's a very
| classical-mechanics effect of the energy of the weapon versus the
| strength of the structure or shielding. Offense, at a very high
| level, is about more and stronger weapons, and defense is about
| withstanding or escaping attacks. Software, naturally, doesn't
| work that way. It's more mathematical; either the attack works,
| and is potentially completely compromising, or it doesn't. If you
| can make a system that robustly parses input without bugs (or
| sandboxes the parsing, or whatever), there is _no_ cyber-weapon
| that can get past it.
|
| 3) You can make a real impact. A huge number of the systems that
| ordinarily people use are open-source software projects that
| accept contributions. (And note that this includes a whole lot of
| security-sensitive code in system that are not open-source as a
| whole product - for instance, most of the attack surface on iOS
| is in WebKit, image parsers, or the xnu kernel.) A lot more is
| available free-of-charge and accepts security reports. And there
| is, unfortunately, a lot of relatively low-hanging fruit.
|
| Pick something you're interested in, go look at recent
| exploitable CVEs, and do some reading on how the exploits work
| and how they might be _systematically_ prevented. A little bit of
| your time spent making it easier to systematically prevent
| exploits has a real long-term benefit on the world.
|
| As a good historical example - most database libraries around
| 10-20 years ago made it most natural to construct database
| queries by appending strings together, which made SQL injections
| entirely too common. Since then, there's been a combination of a
| push for libraries to make it easier to do parametrized queries,
| a cultural / documentation push to get programmers to be aware of
| this, and a move towards database abstractions like ORMs that
| avoided the problem entirely.
|
| Someone who wrote some docs 10 years ago about these libraries
| probably helped hundreds of annoyed enterprise programmers get
| their system built in the right way when their boss was yelling
| at them about deadlines, and may well have prevented millions of
| people losing their data in a breach.
|
| When you think about attacks on secure messengers, etc., it's not
| hard to imagine that the same amount of effort could save
| countless lives just a few years down the line.
|
| I think memory safety is one of the highest-impact changes we
| could make in development that would help the cause of defense,
| and there's a lot of work to be done. Most of it, mind you, is
| _not_ merely showing up places and saying "I'll rewrite this in
| Rust" - it's helping people be able to integrate incremental
| rewrites and ship things in new programming languages, or perhaps
| helping them avoid memory-safety problems in their existing
| programming languages. Chrome has a good article on this
| https://www.chromium.org/Home/chromium-security/memory-safet... ,
| and "fuzzing," the technique of throwing generated inputs at
| libraries to see where they crash and then fixing those crashes,
| is also highly valuable.
|
| But there are a whole lot of other similar classes of problems to
| help with, too. The Linux Kernel Self-Protection Project
| https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...
| is working on eliminating classes of bugs in the upstream kernel.
| Some of these have already been addressed, to some extent, in
| security-focused forks of the kernel, but getting the fixes into
| the standard kernel is important for getting them in everyone's
| hands and also a good way to learn about things.
| abbassi wrote:
| amalcon wrote:
| The place I would start is not with offensive skills, but on the
| defensive side. Learn how to:
|
| - Know when you might be introducing software vulnerabilities
|
| - Find and repair bugs that might turn into vulnerabilities
| (things like static analysis and fuzzing, but also identifying
| code smells and where to inspect)
|
| - Identify and avoid phishing attempts
|
| - Identify (and, ideally, mitigate) places where resource
| exhaustion attacks are likely to be most effective
|
| - Identify (and, ideally, mitigate) places where a process is
| dependent on external infrastructure that is controlled by
| another party
|
| - Teach others how to do these things
|
| These things are of high value in the day to day life of a
| software developer anyway, and there are lots of reputable
| resources available to learn and practice. In the future, if it
| turns out that you need offensive skills, that will work out OK
| too -- there's quite a bit of overlap, though not 100% overlap.
| itake wrote:
| All of 0 of these skills will help the current situation as
| this developer probably does not control any of the critical
| software himself. This sounds like a great list if you're CTO
| currently building software for critical infrastructure and
| have the power to enforce trainings across the org.
| jka wrote:
| It's increasingly difficult to tell what's going to be
| critical infrastructure and what isn't. The same is true in
| the real world; a defender or a belligerent alike might hope
| that the grain mill in the village will be functional when
| winter rolls in. Whether it is or not could depend on the
| work of someone who isn't even aware of the concept of a job
| title.
| amalcon wrote:
| I'd understood from the OP (though granted this is not
| explicit) that they are not so much looking to help Ukraine
| with their current conflict, as looking to learn skills that
| may be useful if they are asked to aid in some future
| conflict. Frankly, if you want to help the Ukrainian people
| right now, it would be better to use your computer skills to
| earn some money and donate it to a humanitarian NGO.
|
| If, on the other hand, you're looking to start down a path
| that might have you doing useful things in a similar
| situation in 2032, this seems to me like a reasonable place
| to start.
| robcohen wrote:
| Cyber defense is generally a joke. The people who know how to do
| it knew how before they ever joined the military. The bar is so
| low for security for pretty much everything that simply showing
| up to run a Nessus scan and patching basic firewall rules is
| considered advanced in most quarters. I don't see any path
| towards helping that isn't a giant waste of time.
| AdrianB1 wrote:
| I strongly believe that one needs several years to achieve the
| skill level to become useful in that field. Unless you are
| looking for a job for life, starting now is a few years too late.
| Other comments provided info on how to start.
|
| I also think that tanks, fighter planes and helicopters are
| pretty hard to defend via hacking; it's like defending a password
| against a 5$ wrench used to hit you repeatedly.
| sharkster711 wrote:
| Look at CSPM (cloud security posture management) solutions, it
| ensures there aren't any silly holes in your cloud like open S3
| buckets etc, as well as ensuring pretty advanced organization
| specific custom policies. Look at Prisma, Wizio, Crowdstrike
| Horizon, etc.
| ushakov wrote:
| learning Metasploit would be a good start
| motohagiography wrote:
| - opsec (your neighbors will rat you out as a bargaining tool to
| save themselves)
|
| - python, C, and assembler
|
| - Gnuradio / HackRF (direction finding, spoofing/replay, jamming,
| etc)
|
| - basic electronics
|
| - basic model rocketry / pyrotechnics
|
| - basic lock picking, escapes, first aid and wound care etc
|
| - some off the shelf malware / botnet / RAT kits and usb
| installers, metasploit, etc.
|
| From nothing to developing new zero day probably isn't going to
| happen during this conflict, and best hack will be using skills
| to get out of the country.
| cdiamand wrote:
| I have seen this recommended - https://overthewire.org/wargames/
| _wldu wrote:
| Find a system or a piece of software, use it a lot (look at
| source code if you have it) and then ask yourself how you can
| break it. That's the key to becoming a great hacker.
|
| If you don't understand a piece of software (and I mean really
| understand it) you probably can't break it in a meaningful way.
| You may accidentally break it, but your lack of understanding how
| it actually works will prevent you from further exploiting it.
|
| Just my 2 cents. Hope it helps.
| devoutsalsa wrote:
| How to stay anonymous.
| munk-a wrote:
| ... Including never posting this question to HN!
| Friday_ wrote:
| Cyber warfare attack is when you damage critical infrastructure
| of enemy
|
| And cyber defense:
|
| "... in cyberspace, it is much easier to attack than to defend.
| The primary defense we have against military attacks in
| cyberspace is counterattack and the threat of counterattack that
| leads to deterrence."
| machiaweliczny wrote:
| Play capture the flag games to get hang of vulns but I hope that
| military has firewalls written in Ada/Rust and formally verified
| or fuzzed hard. In comercial setting defence works by updating DB
| of viruses and network monitoring (basically watches all open
| ports and inspects tcp/ip packets).
|
| Still def is hard as weakest chain loses and this means phishing,
| sms, email.
|
| If I were Russian I would have agents working in FB/Twitter and
| bomb/stalk people based on that.
|
| IMO best software engineers can do to maintain power balance are
| temper proof communication tools that are easy to use. Best if
| work also without internet - so called mesh-networking.
| themodelplumber wrote:
| You should connect with your country's leadership to put the
| pressure where it belongs here. You are a citizen showing
| interest in supporting your nation. So they need to be able to
| offer you training starting from the basic frameworks, usually
| the "why" and "what" and later down to the "how" and "when".
|
| As part of that training, they should be showing you which skills
| they want, how they can be acquired, and so on.
|
| This is also important because you need institutional legal
| support and an objective ethics framework to affiliate with.
| Otherwise one misstep and you can end up looking like a vigilante
| even though you had the best intentions. Or you could end up
| ready to take action yet without the infrastructure or other
| resources that would be needed to carry out your work in a
| wartime environment.
|
| If they can't meet that minimum bar it's a non-starter IMO. You
| are left to your subjective estimations of what is needed and are
| without formal support. Contact your representatives and hold
| them to it.
|
| Edit: Is op from UKR? I can't tell--if so the first priority is
| connection with community of experts no matter how small.
| vanattab wrote:
| I mean his countries leadership is a little busy at the
| moment...
| qnsi wrote:
| Consider joining intelligence agency and working there for some
| time to learn.
|
| Probably the best education you can get anywhere.
|
| Other than that, working as a pentester. Again, you can learn
| from online sources, but if you are a competent programmer, why
| not cold approach asking you would like to work in cyber security
| munk-a wrote:
| It is extremely useful, if you have the time to spend on it, to
| investigate and help repair any open source vulnerabilities you
| can. The cleaner underlying libraries are the better all of our
| defenses get - it's not as glamorous as being a 1337 h4x0r but
| contributing to a core library provides an immense amount of
| value.
| birdyrooster wrote:
| The time to start a campaign against Russia on behalf of Ukraine
| was weeks ago. It's too late now, like calling up the national
| guard hours before a massive shock and awe blitzkrieg campaign.
| Zelensky should have been making these appeals a long time ago
| but was delusional.
| dathos wrote:
| That seems harsh, Russia was actively looking for any excuse
| and those might be good enough. The fact they still attacked
| could look obvious now but that's hindsight.
| willis936 wrote:
| Was Zelensky delusional 10 months ago when he requested NATO
| speed up Ukraine's membership plan?
|
| https://youtu.be/admHGiHGnYY
|
| NATO has decided it was fine with letting Russia have Ukraine
| with the expectation that Russia would not invade other
| countries. I swear I've heard this before in a history class.
| birdyrooster wrote:
| Yes, 10 months ago and the time surrounding it, Ukrainian
| membership has never been viable politically or militarily so
| Zelensky should have seen the writing on the wall. What is
| sad is that NATO would allow war to happen in order to
| maintain the hypothetical capacity to admit a country that
| may no longer exist. If NATO appeasement wouldn't have
| contained Putin it would be nice to at least have him on
| record saying he is invading for other reasons.
| ericfrazier wrote:
| Everything.
| giantg2 wrote:
| Best thing is probably just to secure your own devices so that
| your stuff isn't used as a zombie and you don't become part of
| the mess that needs to be cleaned up (taking resources away from
| other things).
|
| Otherwise, maybe try to join your country's cyber warfare group
| or cyber security in a company. You could try reading up on cyber
| warfare and practicing on an self-owned network that is not
| connected to other devices (so you don't accidentally impact
| anyone else). But I don't think this will be that helpful in most
| circumstances.
| lhorie wrote:
| I'm going to be brutally blunt. If you have to ask in a forum,
| you're not hacker material. A better option for someone eager but
| skill-less would be to enlist in one of the branches of armed
| forces in your country.
| sergiomattei wrote:
| What kind of BS elitist attitude is this?
| lhorie wrote:
| It's not elitism, I'm being fairly realistic here. Hackers
| are curious self-driven people that go poke and find things
| for themselves, it's pretty much a hard requirement for the
| trade. Asking for things on a silver plate in a forum whose
| name has "hacker" on it is frankly pretty lazy.
|
| If you think dropping some "helpful" links here will help the
| dude actually "defend his country", I'm sorry to have to be
| the one to say that that's all delusional feel-good theater.
|
| The other comment above talking about zergling rushes also
| caught on to the misguided motivation for this thread. If
| this was about being of service, my recommendation stands:
| join the army, that makes a material difference, especially
| when there are literal tanks physically invading your
| territory. Dreaming up fantasies - and not following through
| when you eventually realize that cybersecurity is hard - is
| stupid.
|
| People are dying out there.
| comboy wrote:
| If you are in EU, then I would say building wireless mesh
| computer networks, maybe also creating longer range low bandwidth
| wireless links.
| mettamage wrote:
| hackthebox.eu provides good training
|
| Not sure if it'll be enough
| jl6 wrote:
| Here's the UK's cyber reservist list of desirable skills:
|
| https://www.gov.uk/government/organisations/joint-forces-com...
| FastEatSlow wrote:
| The current cyber reservist page is:
|
| https://www.gov.uk/government/organisations/strategic-comman...
| bambataa wrote:
| Are any of those listed qualifications valuable? I already know
| that Prince2 isn't going to be the bulwark against an invasion.
| gtirloni wrote:
| I see many security certifications in that list that are
| useful (e.g. OSCP). You focused on the least useful of those.
| HstryrsrBttn wrote:
| AXELOS has a very bad track record.
|
| Learning and getting certified by a company that botched ~80%
| of their projects... indeed not a good idea.
| pc86 wrote:
| I have an ITIL certification and I can honestly say it was
| the most useless 3 or 4 days (I don't even remember) of my
| entire professional life. Absolute rubbish, it was either
| completely made up / false, or such a basic level of common
| sense it makes you wonder how anyone got paid to write it
| down in the first place. The certification never expires but
| I haven't had it on my resume since I left that job.
| throwaway888abc wrote:
| from past
|
| https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon
| easterncalculus wrote:
| A lot of people are mentioning software security vulnerability
| scanning, patching bugs quickly, etc - all extremely important
| but these measures are better executed continuously and hard to
| do quickly.
|
| The quickest way to block cyberattacks with measurable security
| benefit is probably through network controls. ACLs, segmentation,
| firewalls, IDS/IPS, etc. You can deploy these and block a lot of
| attacks right off the bat. Looking into AD security, GPO,
| anything that can deploy configuration to your entire environment
| is common to exploit and important to lock down. Those are the
| kinds of measures that have really measurable impact and help
| prevent the kind of catastrophe that state-sanctioned operations
| create.
| throwaway_4988 wrote:
| Do not underestimate the power of open source intelligence
| gathering and well executed social engineering.
| maerF0x0 wrote:
| Lots of great things being shared here. We never know if OP is
| actually Russian and aiming to do the opposite of claimed --
| nevertheless let's share what we'd normally share anyways.
|
| Adding on to what others have said I would say start with this.
| To be a useful "hacker" to *defend* your country start with
| ensuring you are not immediately exploitable yourself & then
| repeat for others close to you. A incomplete shortlist off the
| top of my head
|
| 1. Ensure all your devices are secured including great passwords,
| updates applied, minimal/no ports expose
|
| 2. Secure your financial instruments w/ great passwords and
| multifactor options. physical devices like yubikey is (afaik) top
| of the line, other styles are an improvement over nothing.
|
| 3. Create backups of important things so you're unlikely to be
| blackmailed by ransomware
|
| (others, what am I missing?)
| [deleted]
___________________________________________________________________
(page generated 2022-02-25 23:02 UTC)