<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Trainings tend to be about the past. They are more war stories
than distilled wisdom. Like when we teach you how to do a <a
href="http://infiltratecon.com/training.html#click-here-for-ring0">client-side
and then a kernel exploit</a>, that's because that's the attack
path that's been most successful for us in the past.</p>
<p>But a lot of hacking is less brute force than that - a lot of it
is just knowing where to look, or gaining expertise in some
strange lore than nobody else wants to study. For example, there's
a talk at INFILTRATE on DCOM. DCOM is the devil - a dark mine of
legendary horrors. But I know there are untold bugs in it.
Limitless new bug classes. Actual remote code execution. <br>
</p>
<p>After enough hacking you get a nose for where to look, in theory.
I don't know how to quantify this in a way that you can put
metrics on it and maybe write something for a policy blog. But
it's institutionalized, this sense of smell. Groups evolve a
consensus on targeting.<br>
</p>
<p>I'm annoyed because I didn't ask anyone to look at the Webex
plugin for Chrome and Tavis owned it in fifteen seconds by
trusting his nose. Immunity is a bit resource constrained, is what
I tell myself, because we are the kind of computer that is
excellent at rationalization. We can't hunt every new smell. But
how can any company trust Webex again? Isn't Cisco supposed to
have a team on this sort of thing? <br>
</p>
<p>I guess my question is: Between this bug, and the issues on their
routers from the EQGRP leak, clearly Cisco has no "nose". What
does that mean for them?</p>
<p>-dave</p>
<p>P.S. Come to our <a
href="http://infiltratecon.com/training.html">trainings </a>this
April and hear our war stories and learn from our exploit writers.
It's super fun. :)<br>
</p>
</body>
</html>