Blog of Endgame, a cybersecurity company, covering exploit mitigations, CTF challenges, malware detection, and job openings.
HN mostly links it through Endgame's hiring posts; commenters give little opinion on the blog itself, and the other comments are about fuzzing and exploits.
> wow....that is pretty interesting. how do you write your own fuzzer, seems like that's where the edge comes from? How much more of an effort is it to write an exploit? Is it necessary to build a Proof of Concept or is simply disclosing the vulnerability enough?
Dumb fuzzers can be written in anywhere from a day to a few weeks of work, smart fuzzers can take several years to write, also lots of fuzzers continually evolve over time because they have to. Its the Red queen effect[1], fuzzers keep finding bugs so they have to keep getting better to keep finding harder and harder to find bugs in a target codebase. So I would say an exploit is usually the harder task but some of the things smart fuzzers like SAGE[2] do would be incredibly hard to implement.
> If I buy ADA what software/API can I start tinkering with?
I'm not sure what ADA is. However for testable software I would go for programs that come installed on your operating system of choice. So in my case I was using MacOS at the time so I was targeting MacOS default applications.
> What you described seems like so much fun but scared of the writing exploit part. Now that seems really hard especially considering it needs to be fully undetectable for a long time until the buyer gets their return on investment.
Fuzzer development and exploit development are pretty different tasks. Fuzzer development is basically normal software development, while exploit development at least with security mitigations turned on is an…
______ __
/ ____/___ ____/ /___ _____ _____ ___ ___
/ __/ / __ \/ __ / __ `/ __ `/ __ `__ \/ _ \
/ /___/ / / / /_/ / /_/ / /_/ / / / / / / __/
/_____/_/ /_/\__,_/\__, /\__,_/_/ /_/ /_/\___(_)
/____/
Endgame – San Francisco, CA (AT&T Park)
Historically we've worked with customers in the Federal space, but we're aggressively moving towards building the next generation of security intelligence for private companies. Rock-solid security is usually not the _biggest_ priority for a startup, so we'd like to change that by making it easier and more accessible.
We're opening an office right across the street from AT&T Park in San Francisco and have a boatload of open positions.
We've got a lot of really smart people on our team. We're also very diverse, with a good mix of male and female hackers from all different cultures. We run our own copies of Github and Hipchat behind the firewall, enjoy the ocassional argument on which editor is best, compete at the ping pong table regularly, and like getting together outside of work to unwind.
Check out a recent article about our (radical) CEO Nate Fick: http://www.forbes.com/sites/andygreenberg/2014/02/12/inside-endgame-a-new-direction-for-the-blackwater-of-hacking/
If you're someone who likes building great products and you're in the SF area, definitely check out our careers page!
http://endgame.com/careers/
Feel free to…
Endgame, Inc - https://www.endgame.com/
Endgame, the Cyber Operations Platform, automates the hunt for adversaries in enterprise critical infrastructure. Built on our unique knowledge of the adversaries' tools, techniques, and tactics, our technologies detect and prevent malicious activity, ensuring your responders contain intrusions at the earliest phase of the kill chain.
Endgame is looking for exceptionally talented and motivated Back End and DevOps Engineers who loves working across the full spectrum of web technologies and get excited about developing an unparalleled, cutting edge, end-to-end solution for the enterprise and cloud. You will be working with the top minds in Cyber Security developing a scalable, intuitive, and multi-tenant data aggregation application allowing for rapid information discovery, correlation, and interaction in real-time.
If you are looking to work in a fast-paced, agile development environment creating new software components for game-changing data and security products, you’ve come to the right place.
Arlington, VA - Backend (http://app.jobvite.com/m?3dcHgiw9)
Arlington, VA - QA Automation (http://app.jobvite.com/m?3pdHgiwm)
San Francisco, CA - Backend (http://app.jobvite.com/m?39cHgiw5)
San Francisco, CA - DevOps (http://app.jobvite.com/m?3bcHgiw7)
San Francisco, CA - QA Automation (http://app.jobvite.com/m?3wdHgiwt)
San Antonio, TX - Services Software Engineer (http://app.jobvite.com/m?3jcHgiwf)
Yeah, I did a presentation at the DC Area Apache Spark meetup... slides: http://www.slideshare.net/RichardSeymour3/2015-0224-washington-dc-spark-meetup-pyspark-streaming?qid=7f55a910-ea78-48e9-8167-ca9733b6c0e3&v=qf1&b=&from_search=1 associated blog post: https://www.endgame.com/blog/streaming-data-processing-pyspark-streaming-0
I've done a bit of scala spark as well, and my initial thought was prototype in pyspark and then rewrite in scala if necessary. Just this week DataBricks announced they are working on changing some of the data structures behind RDDs to save on unnecessary java object creation hubbub https://databricks.com/blog/2015/04/28/project-tungsten-bringing-spark-closer-to-bare-metal.html
That and the SQL compiler thing seems pretty darn awesome. Spark has the nice benefit of being plug and play (w/ a joyful time of compiling and deploying) with legacy HDFS/Hadoop systems. That alone will keep it in toolboxes for a long time to come.
Endgame’s security platform enables organizations to hunt for adversaries within their networks and secure their most valuable assets. We are characterized by a high degree of autonomy and flexibility, intellectual engagement, and a competitive compensation structure that rewards performance. We work within a fast-paced, driven, and flexible work environment that allows for both professional growth, as well as unwinding through team events like weekend family brunches, happy hours, and outdoor activities. Endgame values engagement within the tech community. We provide opportunities for open source contributions, speaking at meetups or conferences, and participating in our technical blog.
Open Engineering positions: https://www.endgame.com/careers
Sr. Back End (Python)- SF and VA
Sr. Front End (React and node.js) Arlington, VA only
DevOps- SF and VA
Endgame is unable to sponsor H1-B or other visas at this time.
Email gsarria@endgame.com if interested
The comparison is cherry picked cargo cult. ASLR and a lot of these mitigations were obsolete when HBSD implemented them https://www.endgame.com/blog/technical-blog/rop-dying-and-your-exploit-mitigations-are-life-support. Their ASLR try was rejected by FreeBSD.org. Some of the bullets are completely asinine like xxx hardening, what does that even mean? The lead developer recently gave a conference talk where as far as I can tell he showed that you can root a box as.. root https://www.youtube.com/watch?v=bT_k06Xg-BE.
Can anyone point to a paper showing where HBSD successfully prevented an attack over FreeBSD?
So they generate a lot of noise. Instead of learning from the larger communities that are filled with extremely talented security people like Colin "cperciva" Percival, Robert Watson, Theo de Raadt, Maxime Villard, etc Shawn seems hellbent on being an exemplar of Dunning-Kruger effect. Unfortunately he is towing others along for the ride.