chris wysopal brucon ‘17files.brucon.org/2017/008_chris_wysopal_how_hackers_changes_s… · chris...
Post on 27-May-2020
5 Views
Preview:
TRANSCRIPT
Chris Wysopal BruCON ‘17
22
How did we get here?
We made trouble.
3
4
The Seminal Event
“Improving the Security of Your Site by Breaking Into It”
By Dan Farmer and Weitse Venema, 1993
55
Hackers Made Information Security a Participatory Sport
66
The First Hacker Tools
Crack – Alec Muffett - 1991Targets guessable passwords
SATAN – Dan Farmer & Weitse Venema - 1995Targets misconfiguration
Netcat – Hobbit - 1996Network swiss army knife
77
Hacker Information Resources
Bugtraq
8
Hackers Write Commercial Security Software
99
Improve the Security of Your Productby Breaking Into It
10
Product companies selling security features
Identity & Access ManagementEncryptionFirewalls
Accountancies selling compliance
SAS 70NIST 80-153
11
12
In 2000 Launched @stake security consultancy
• We conducted our own vulnerability research
• We built our own attack/testing tools
• We secured applications by breaking into them
• Others soon followed:
– Guardent (acquired by Verisign)
– Foundstone (acquired by McAfee)
The L0pht+
Dan Geer
13
Remember the Microsoft SDLC
14
What did we teach them?
• How to threat model• How to exploit heap overflows• How to fuzz software• Built their first fuzzer – SPIKE• How to use SysInternals Process Explorer
to find attack surface• Now Microsoft SDLC is the reference for
the industry – literally, ISO 27034
15
Modern Security Era Is Born 2003 -
Penetration testing is a requirement.
Companies have a product security response team.
Development teams use hacker techniques for security Testing. Look to Microsoft as a model.
And later came Bug Bounties!
16 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
Fast forward to
2017
17
•Nation States pretend to be criminal hackers
1818
Stripe Veracode IBMGrandIdeaStudio
And Hackers are now Insiders
1919
But we are OLD insiders
We need the next generation to keep making trouble
2020
Make me nervous!
2121
Security Champions
top related