But did you not purchase that content first?
5,858 karma · joined August 20, 2014
1. Security is more a mindset than anything else. Get used to finding the edge cases. Think "how can I break this..." or "how can I get around this restriction..." Many security folks I know started actually by exactly what you mentioned- figuring out how to bypass copy protection on games, how to bypass client-side checks in multi-player games, ... and so on.
2. Many pure security folks are very poor developers. You'll have a unique skillset here if you can apply it. Most security oriented folks use Python for quick scripts. If you already know python, great; otherwise, learn it and use that as a marketable skill.
3. I'm not sure about jumping head first into a consultancy. I'd recommend getting some experience in a security field first. It's hard to have credibility without some experience first.
4. Don't bother with security+. If you want creds, go and take your favorite cloud provider's security specialist exam. Cloud security is still relatively new, in high demand, and can get you immediate credibility with employers or clients.
5. I'm a big fan of real-world experience. Set up your own Linux server and try to attack it. Learn what some of the real world attacker techniques are. See some of the following:
Learn the Techniques, Tactics, and Procedures (TTPs) outlined in the MITRE ATT&CK matrix (https://attack.mitre.org/).
There are a LOT of "Capture the Flag" (CTF) events and writeups out there. Search for ones in a subfield you find interesting. Security is a HUGE topic. You'll need to specialize. Do you want to reverse engineer code? Secure cloud applications? Help companies define their identity and access management strategy? There's a CTF for all of those and then some. Do some googling around.
I have a lot more tips, so if you're interested just reply to this comment with a way I can get in touch and I'll reach out.
(Sorry couldn’t resist)
It doesn’t surprise me that organizations actively try to avoid it.
Yes, done correctly this is secure.
The first few times they call, I'll ask to be placed on the do not call list (and record that fact in my notes as well). Of course, they'll continue to call... so then it's on to social engineer the name of the company or beneficiary company (if a lead generator is calling you rather than the company itself).
Once I've figured out the name of the company, then I have to basically do the whole thing in reverse: I find a "legitimate" number for the company (off the website, whatever) and get a customer service associate to read off my fake customer information back to me.
It's important to keep receipts. The attorneys for these companies don't give up easily. They'll come up with all sorts of excuses - we don't make outgoing calls, its not us (OK then how did I get your company name?); how do you know it's XYZ company? (because Bob gave me the name when I received the call); how do you know that someone didn't falsely give our company name to defame us? (because I called the number for XYZ and Dave was able to look up my "customer" record)
Once you show that you have receipts and you're serious, they generally fold very quickly.
Basically once you’ve identified the caller or the business that benefits from the call, you write a demand letter that states the details of the calls and you intend to sue under the tcpa if they do not wish to settle for $$$ before a given date.
You’ll want to read the text of the tcpa first - basically you can be awarded up to $500 per call and ask the court for triple damages so you can allege damages for up to $1500 per call. Also research any state laws you may have (that have a “private right of action” aka you can bring the suit yourself). Those damages can be layered on top.
So while sometimes the information is legitimate - especially if you’re not opted out of the major internet people search engines (ref optery which is a yc graduate company) - but you can also “poison the well” enough to get your fake persona disseminated.
It was worth it to me at the time but the biggest issue is you don’t have control over when the calls come in- so you have to spend some time up front social engineering these people to get the information you need during inconvenient times of the day.
The last suit I filed against a telemarketer was against the “beneficiary” company as the lead generator who called me was of course overseas. They claimed that they could not be held vicariously liable for the calls but ultimately settled with me because litigating that would cost a lot more money than the settlement amount.
Some state statutes go further than the tcpa and address vicarious liability specifically, so if you’re in one of those states you have a stronger legal leg to stand on.
The most successful persona unfortunately is that of a slightly senile senior citizen. Senile enough that you seem gullible to the caller, but believable that you have enough money and sense to continue with the transaction.
I’ve found that many people are fascinated by the stories but nobody that I know of has gone on to actually take these people to court themselves.
It is difficult enough that there is a full on coalition dedicated to this (the trace back working group that’s mentioned by the fcc in this order)
Agreed with other commenters, this is a great article- thanks for posting!
Well, Ryanair, jokes on you - vomit ended up everywhere in the aircraft cabin due to you saving a few cents.
Does anyone even consider the monster layers of abstraction that these services require? It’s crazy to me to think someone actually thought using step functions and lambdas in this way was a good idea.
His machines memory was bad and corrupting the internal state of the application. Until I could prove that his machine was calculating the equivalent of 2+2=5, he wouldn’t believe us.
The Bitcoin paper was published in 2008. It’s been almost 15 years now - plus all of the advantages that you have with modern development practices that were unavailable in the early 2000s - and yet still nobody uses blockchain at scale for this use case.
If this worked better than existing options at a lower cost, then businesses would be rushing to adopt it.
We have tried to intervene, especially after he snuck an iPhone to his room and watched 22 hours of videos over the course of a week (while he was in bed) before we caught on. Nothing other than extreme measures of locking away devices keeps him from frittering away every waking hour on screens.
The other two kids don’t have similar issues.