Vulnerability Research

Anyone else here who works in Vulnerability Research? How are you holding up. Are you worried about the new mitigations like MTE, CFI, PAC or are you living large off of DARPA funding? I found a couple of bugs and wrote one exploit that got patched. It isn't looking too good for me. For anyone who wants to get in this field, don't. It's fuarrrked. You are under constant pressure to deliver and will simply be replaced if you do not find anything. But unlike software development, there is no guarantees or security. You are entirely dependent on luck being on your side at times. But if you are adamant on wanting to get in to the industry, here is a list of jobs https://github.com/iamavu/vr-rev-jobs .

i don't but i've done bug bounties before and i like trying to find vulnerabilities, and i've always thought of doing it as a plan b in the back of my mind but >You are under constant pressure to deliver and will simply be replaced if you do not find anything. the chances of not finding anything (or should i say, anything worthwhile) are increasing as CISA has been really pushing the secure by design approach to tech companies, and it looks like they are beginning to listen so you're right that it's not looking good. i don't have anything else to say.

Nah, I still want to get into it anyways. VR and ED stuff mostly. I know ROP, and can do basic stack stuff. Still need to learn about the heap. It's getting harder, but that means getting skilled in this field will be more rewarding

>>25381 >>25381 As you said, the picture of the vuln research sums it up really good. You can try and be as honest and good player as you want, do everything by the books, but ultimately your work will be more appreciated by the criminals. If you have no moral qualms then it isn't that much of an issue to earn much more money by exploiting, but otherwise nah, most poeple don't

Part-time since I'm too retarded to find most of the bugs acquisition companies really want.

>>25565 What's your targets? IoT primarily then? I do browsers full time and I want to kms. Only got one exploit done last year.... Hoping the war around the world keeps the industry a float and they won't fire me

>>25654 How you got into it? tell me about your experience and path you took

>>25654 Bunch of dumb IoT bugs, "enterprise" software, occasionally get lucky fuzzing Office stuff. Seems way too stressful to have quotas/deadlines for hardened stuff.

>>25674 CTF. I basically played the highest level of CTF, winning all the major soykaf like hitcon, seccon, asis, codegate, google CTF etc. etc. With my team of course. I then got a job which paid ok-ish (about 100k), but they basically allowed me to attend infinite trainings. And so I did. Every year I attended trainings at poccon, hexacon, typhooncon and the likes. At this point I had attended countless exploit relevant trainings, played highest level CTF, published some research and held a decent job with a fancy title. Now I am roaming blindly in to the fog and unable to find my way. I would honestly not recommend this industry. It fuarrrks your head up and makes you depressed. But if you want to get in to it, that was my path. Good luck

>>25684 Depending on how / which VR firm you end up, the quotas and deadlines varies. Unfortunately I won't name any names in an attempt to stay kind of anonymous, but the more a VR firm is trying to hide, the worse they tend to be generally speaking in terms of potential future sanctions or the likes. However many firms understand that it is infeasible to set deadlines and or quotas for finding bugs in hard targets like kernel, browser, instant messaging or the likes. But just because they don't tell the quota or expectation to your face does not mean it is not there. Sometimes people just disappear from one day to the other. It's never fired, but always some weird excuse. It could just be people getting depressed, but it is weird quitting from one day to the next without having a job lined up for after... Any who most companies on this list is pretty decent IMO: https://github.com/iamavu/vr-rev-jobs

>>25706 It really does ruin your head. It's a constant battle to stay ahead and a constant struggle to not compare yourself to others more successful in the career. I got into it later in life after doing sysadmin work fresh out of communuty college. I've been sent to countless trainings fortunately paid for my my job, been to numerous conferences, played many a CTFs, and started many a personal projects and even I know I am worthless compared to some twenty year old prodigy who has been hacking computers since he was eight and had the right conditions/rich parents that were able to support his hobby. Maybe that's just a cope for my painfully average IQ. Only time and more hard work will tell. You get addicted to the grind and then the stress and burnout just hits you like a sack of bricks one day. Been seriously eyeing remote sysadmin jobs to decouple my life from work again. I've learned a lot and I want to pursue other hobbies now, and I want to stop turning a hobby into a job. I miss the joy I felt when I found my first vulnerability. I want that back on my own time.

>>25708 Dude, you think too much, if your wage lets you eat, have fun, sleep, have good health, why worry? Thanks for the suggestions, i work as a SOC analyst at nightshifts, was a dev before though, i don't want to learn so much just to slave away for soykafty corpos, just want to have fun. calm down.

I work full time as a software engineer but do some security bug hunting on my company's internal network for fun. It's a company that's been around for 10+ years, thousands of employees over that time, and a history of outsourcing work to soykafty developers, so there's fertile ground for security research. Once in a while they'll throw me some goodboy points (a few thousand bucks for a bonus) but mostly it's for love of the game. My salary for developing software pays a lot better than being a full time security researcher would. I also try to teach people to write less soykafty software.

>>25398 >>25398 Just as an FYI, I live and breath sbd for my job and because you are outsourcing the security onto the system owner its being misused due to misunderstandings and bad implementation just to get a tick in the box by someone who equally doesn't understand it. SBD is going to make things worse and its due to the frustrations of users who do not have the knowledge or care enough Its a good thing in practice but with most security related things it doesn't work the way its supposed to