Climb the infosec skill tree by revisiting past CVEs

Presented at THOTCON 0x9 (2018), May 4, 2018, 4 p.m. (25 minutes)

In order to improve our skills, we can revisit past CVEs and create our own exploits, and compare with existing exploits. By practicing in this manner, we can eventually contribute to the wider security community. The part of this exercise that is the most useful is when we find a difference with our own developed exploit compared against a current existing exploit. We must practice our critical thinking skills to determine the discrepancies, and determine if any unstated assumptions exist. This talk will consist of looking at a specific CVE (CVE-2013-5576) to explain: The general strategy and thought process for practicing by revisiting past CVEs; The vulnerability, its context, and why the code that is responsible for the functionality produces the vulnerability.; A technique for determining the code responsible for the vulnerability.; The differences found when running a current known exploit against the vulnerability, and the debugging methods used.; The differences between our developed exploit and a current known exploit.


Presenters:

  • Sandra Escandor-O'Keefe
    Security Engineer ~ 2 yrs. Software Dev - 5 yrs. Likes: Anything about software, English Bulldogs

Similar Presentations: