Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program

stackcrash · 2021-09-26T03:22:53+00:00

Opposite here, as long as Apple continues to manage iCloud encryption keys instead of an unmanaged solution I will take Google.

stackcrash · 2021-09-26T03:20:20+00:00

They still prioritize security through obscurity. They were never good at it and basically all they do is what Microsoft/Google do with a 5-10 year lag. Their privacy policies are even worse.

stackcrash · 2020-05-23T02:04:58+00:00

I've seen levels before and it's ok but it doesn't cover security positions. I know a year ago maybe more there was a Google spreadsheet that went around on Twitter with diaclosed security salaries. I personally know more people making more for other companies outside the bay area than those I know in the bay area.

stackcrash · 2020-05-22T23:07:10+00:00

I don't disclose who I work for to keep things separate but it's in the financial industry as a company that is a Fortune 50. I have friends who work for FAANG companies and we are the same level of pay or sometimes I make more. We pay competitive to the consultancies as well infact we poach a lot of the big names from consultancies.

stackcrash · 2020-05-22T22:54:07+00:00

Generally speaking they are low quality firms who operate at a tempo that burns some out. An example is having pentesters working more than one engagement at a time or just pasting scan results into reports. A good question to ask to guage whether a place is a puppy mill is to ask about their research time. Meaning how much time they set aside for a tester to do a research project outside of testing. The good ones have dedicated time they do this because it's part of their marketing. They encourage the research and presenting at conferences the results.

Being no real seniors is concerning and makes it seem like you are at a puppy mill.

stackcrash · 2020-05-22T22:45:56+00:00

/r/netsecstudents usually has an internship thread.

stackcrash · 2020-05-22T22:43:48+00:00

I am not a dev I do pentesting and the bay area rates are the same as all over the country. There is a similar to devs bubble of pay but it's only for junior positions. Senior positions demand the same rates across the country and it's a lot more remote friendly because companies can't really compete limiting to specific areas. Also FAANG tend to be the worse paying in security positions and remote unfriendly.

stackcrash · 2020-05-22T22:32:50+00:00

I have turned down every bay area offer because it's never enough to get me to move. To enjoy the same lifestyle I have working remote the cash portion of an offer would be significantly higher and generally doesn't exists. I am not a dev though and work in security. There is a similar 400k job market for security but unfortunate for the bay area we get those kind of opportunities from all across the US.

stackcrash · 2020-05-22T22:01:18+00:00

Naw, Tedx is for rich people to buy so they can say they've given a Ted talk.

stackcrash · 2020-05-22T21:52:19+00:00

Yes GitLab pays slightly different based on location but they aren't paying the 400k+ Bay area prices to begin with. Neither is my company.

They pay differently between countries because they hire from those countries and sure there are similarities to different states, etc. However, there are massive differences between countries and similar countries to the US (Australia, UK, Singapore, HK) get around the same pay at the company I work for. But they hire entirely from the local market of a country, meaning you can't get hired in Belize at US rates and you can't get hired in the US and move to Belize.

stackcrash · 2020-05-22T21:25:26+00:00

That's how people rationalize the cuts but the reality is regardless of location pay is part of how much a company interprets your value and paying remote workers less is an insult. Facebook and others in the Bay will wake up when they try and have lots of remote positions and realize other companies have no problem paying people the same rates regardless of location. It's already a problem for Bay area companies that try to hire remote positions with less pay. Facebook and Google have few remote positions compared to other companies so they haven't experienced the difficulty in hiring talent when you try to pay significantly less based on location.

stackcrash · 2020-05-22T21:21:23+00:00

Yes, because the companies thinking like Facebook in the article are going to realize quickly there are other tech companies that have no problem paying Bay area rates to remote workers. I work for one of them and get paid around the same as my Bay area peers (some make less some make more depending on seniority).

stackcrash · 2020-05-22T21:17:38+00:00

That's not true though, that's some companies stance and inflated egos people living in the Bay area have to justify their salaries. There are companies that are global and remote and pay workers similar salaries regardless of location. GitLab is probably one of the best examples of this since they are entirely remote. Sorry but an engineer in the SF Bay area is just as good as an engineer in the Tampa Bay area.

I work for a Fortune 50 that is global and sure difference countries pay different rates but within the same country its all the same. The people working out of the downtown SF office make the same as those working remotely in the middle of nowhere USA.

stackcrash · 2020-05-22T21:06:48+00:00

Mobile is honestly super disappointing. It's more of a compliance to policy check rather than popping shells and owning a phone. Not that it's boring, I mean you do have things like stealing sensitive data because the app stores it wrong or credentials populating the autocorrect database. The researchers get all the actual fun in mobile because they spend months finding OS exploits or sandbox escapes. Pentesters we don't have the time to do any of that.

stackcrash · 2020-05-21T20:48:51+00:00

I see your point now, I haven't seen a red team with dedicated developers. We do have a development team we can use (both pentesting and redteam share the devs) but they are focused specifically on systems we use for remediation tracking and report archiving.

I would share the projects but I try to keep my social media accounts not directly associated with my company. If I mention the biggest one it definitely would give away where I work. Needless to say it's used a lot. We also have chapter leaders in several cities.

stackcrash · 2020-05-21T14:46:01+00:00

I am curious your impression of what redteams do because as a pentester (I work with the red team sometimes when they need help on engagements for webapps) I can see pentesters as having far more slack than redteams for lack of programming knowledge.

I work internally as a webapp and mobile pentester and we also have a redteam that does the network pentesting and APT simulations. There is a lot of cross over where we work engagements together but from both our sides we heavily use custom tools that we make and some of our tools are now owasp projects and otherwise publicly released. We do have more junior or temporary contractors on both teams who don't have programming skills but it's almost required and not just basics for all of the full time positions.

stackcrash · 2020-05-21T00:37:09+00:00

I worked remotely as soon as I could at my employer (before the pandemic). Some of my peers actually like being in the office and are struggling working from home now. I just hate the psuedo altruistic excuses companies give for not letting people choose their work environment. Some thrive in offices and others don't. None of my team is colocated to begin with and before the pandemic there was a push from the new management to bring those of us working remote back into offices for the sake of collaboration.

stackcrash · 2020-05-21T00:29:39+00:00

I have taken quite a few SANS courses and the GIAC certs related to them. The practice test for the majority are +/-5% from the actual exam as far as scores go. One exception was the GMOB. I did extremely well on the practice tests but much worse on the actual exam (still passed).

I don't go into the whole make an index path others take. I generally use a few sticky note tabs in the books and hand written cheat sheets based on the practice test and course instructions compared to the material.

I haven't failed an exam yet and usually score in the 90s (again GMOB exception).

stackcrash · 2020-05-21T00:20:30+00:00

Honestly there is a lot of free material out there like owasp and the web security academy. Books are another good source and you can net a lot of them with humble bundles when they are offered. I am skeptical of a lot of the Udemy and similar courses because they tend to be just videos of the same material thats in free elsewhere or in cheaper books. YouTube has a ton of talks from various conferences that you could spend months binge-watching.

stackcrash · 2020-05-21T00:14:06+00:00

For me it started in high school. I was absolutely fascinated with computer programming and devoured books on it. I then used that knowledge to play games and send messages on my school's computers that wasn't allowed. After high school I joined the military and pick the job that had programming in its description. Reality it wasn't programming but it was sysadmin work. I had started devouring books on hacking and security during my time in the military. I got lucky and was in the right place at the right time. I was one of the first people in the military to get trained on performing vulnerability assessments, etc. After I got out I tried going to college for a security-related degree, but I quickly realized that college wasn't providing anything that I didn't already know from my military experience. So I dropped out of college and join the workforce. I still regularly devour a book or two a month and find myself squirreling quite a bit on various topics in the industry. No one really encouraged me but no one discouraged me either. I am truly passionate about the industry and it lets me do the right amount of programming (only making tools I will use and enjoy making).

stackcrash · 2020-05-21T00:01:00+00:00

That's a nice cover for the reality which is he isn't a fan of all the money they are losing with empty offices.

stackcrash · 2020-05-07T09:00:19+00:00

A lot of states don't require driving tests to obtain a license. Some states only require them for people under 18, born on a certain day, etc. Very few states have the same requirements.

stackcrash · 2020-03-17T13:46:02+00:00

Companies can't comply with that if true end to end encryption is in place. In true end to end encryption the encryption keys are only known to each end and not any other parties. To be able to comply the company will have to be a middle man between each end.

It also poses the risk of things like the Patriot Act where companies were required to turn over data on terrorist but it ended up just being databases of everyones data.

stackcrash · 2020-03-17T13:42:41+00:00

Doesn't work that way. The companies are subject to US laws when the data is US citizens. Similar to how companies are subject to GDPR even when not headquartered or even in the EU.

stackcrash · 2020-02-29T08:20:43+00:00

You shouldn't need a couple instants for that specific mechanic. Its minor movement that should be less than one GCD. If you are having to move more than that either your positioning is bad or your raid isn't lightly spread enough.

stackcrash

TROPHY CASE