Ask HN: What do I need to learn to be useful as a hacker to defend my country?
55 comments
A lot of people are mentioning software security vulnerability scanning, patching bugs quickly, etc - all extremely important but these measures are better executed continuously and hard to do quickly.
The quickest way to block cyberattacks with measurable security benefit is probably through network controls. ACLs, segmentation, firewalls, IDS/IPS, etc. You can deploy these and block a lot of attacks right off the bat. Looking into AD security, GPO, anything that can deploy configuration to your entire environment is common to exploit and important to lock down. Those are the kinds of measures that have really measurable impact and help prevent the kind of catastrophe that state-sanctioned operations create.
The quickest way to block cyberattacks with measurable security benefit is probably through network controls. ACLs, segmentation, firewalls, IDS/IPS, etc. You can deploy these and block a lot of attacks right off the bat. Looking into AD security, GPO, anything that can deploy configuration to your entire environment is common to exploit and important to lock down. Those are the kinds of measures that have really measurable impact and help prevent the kind of catastrophe that state-sanctioned operations create.
The world is not an RPG video game, you likely can't just strictly "improve" yourself up to any given standard (no matter what any employer or teacher tells you - they're just trying to buy time as you sit in their classroom or accept a lower paycheck than you are worth). Experience is key, and it ISN'T best measured in years - you can likely put in more time than anybody on something given that you seem like a young kid who's eager.
That being said, and now that it's clear that you aren't just going to push a number higher until you can send all of your cyber zerglings into the enemy's virtual mineral line, this is a good process to follow for finding serious vulnerabilities - exploiting them should be trivial if you have a good enough understanding of the system:
- Think of a system in use, at any layer of the stack. This could be a specific web application in use by the enemy, a runtime that's used by some applications of theirs, or a memory/cache model on a CPU architecture that's flawed or anything like that
- Learn enough about that system that you can understand any inner working of it
- Painstakingly look through areas where you, just via inference, can tell that there could be some sort of vulnerability - key areas to focus on are something that is something downstream to user input, or something similar.
All of that is to say that, if you aren't already "useful", your country is probably going to have a regime change before you can find anything strictly useful.
If there's something simple enough that someone who's relatively unexperienced can do it, then it's probably automated.
OR - use a bunch of stolen credit cards you bought online for $3 each to rent a few VPS' (maybe come up with some consolidation solution to more easily make accounts and setup SSH boxes) and throw as much layer 4 traffic at Russian endpoints as you can :-).
That being said, and now that it's clear that you aren't just going to push a number higher until you can send all of your cyber zerglings into the enemy's virtual mineral line, this is a good process to follow for finding serious vulnerabilities - exploiting them should be trivial if you have a good enough understanding of the system:
- Think of a system in use, at any layer of the stack. This could be a specific web application in use by the enemy, a runtime that's used by some applications of theirs, or a memory/cache model on a CPU architecture that's flawed or anything like that
- Learn enough about that system that you can understand any inner working of it
- Painstakingly look through areas where you, just via inference, can tell that there could be some sort of vulnerability - key areas to focus on are something that is something downstream to user input, or something similar.
All of that is to say that, if you aren't already "useful", your country is probably going to have a regime change before you can find anything strictly useful.
If there's something simple enough that someone who's relatively unexperienced can do it, then it's probably automated.
OR - use a bunch of stolen credit cards you bought online for $3 each to rent a few VPS' (maybe come up with some consolidation solution to more easily make accounts and setup SSH boxes) and throw as much layer 4 traffic at Russian endpoints as you can :-).
In the short term, low intensity large scale "offensive" action is probably the course to take with most potential return. Just poke with as many Russian server/service as possible. Since your country has a high risk of being (unfortunately) under Russian control soon, take some minimal precautions to cover your traces.
This is basically the same principle as international sanctions. Try to make everything harder for Russia and (unfortunately) for Russian people. Playing people's opinion against their leader. You can do the same in Belarus that saw civil unrest recently, mobilizing Russian soldiers.
This is basically the same principle as international sanctions. Try to make everything harder for Russia and (unfortunately) for Russian people. Playing people's opinion against their leader. You can do the same in Belarus that saw civil unrest recently, mobilizing Russian soldiers.
That's what I was suggesting with my little addendum at the bottom. Would honestly like to try it, if someone would like to pay my mortgage + fooooood costs with VC bucks for a few years.
I laughed so hard at “cyber zerglings”
The place I would start is not with offensive skills, but on the defensive side. Learn how to:
- Know when you might be introducing software vulnerabilities
- Find and repair bugs that might turn into vulnerabilities (things like static analysis and fuzzing, but also identifying code smells and where to inspect)
- Identify and avoid phishing attempts
- Identify (and, ideally, mitigate) places where resource exhaustion attacks are likely to be most effective
- Identify (and, ideally, mitigate) places where a process is dependent on external infrastructure that is controlled by another party
- Teach others how to do these things
These things are of high value in the day to day life of a software developer anyway, and there are lots of reputable resources available to learn and practice. In the future, if it turns out that you need offensive skills, that will work out OK too -- there's quite a bit of overlap, though not 100% overlap.
- Know when you might be introducing software vulnerabilities
- Find and repair bugs that might turn into vulnerabilities (things like static analysis and fuzzing, but also identifying code smells and where to inspect)
- Identify and avoid phishing attempts
- Identify (and, ideally, mitigate) places where resource exhaustion attacks are likely to be most effective
- Identify (and, ideally, mitigate) places where a process is dependent on external infrastructure that is controlled by another party
- Teach others how to do these things
These things are of high value in the day to day life of a software developer anyway, and there are lots of reputable resources available to learn and practice. In the future, if it turns out that you need offensive skills, that will work out OK too -- there's quite a bit of overlap, though not 100% overlap.
All of 0 of these skills will help the current situation as this developer probably does not control any of the critical software himself. This sounds like a great list if you're CTO currently building software for critical infrastructure and have the power to enforce trainings across the org.
I'd understood from the OP (though granted this is not explicit) that they are not so much looking to help Ukraine with their current conflict, as looking to learn skills that may be useful if they are asked to aid in some future conflict. Frankly, if you want to help the Ukrainian people right now, it would be better to use your computer skills to earn some money and donate it to a humanitarian NGO.
If, on the other hand, you're looking to start down a path that might have you doing useful things in a similar situation in 2032, this seems to me like a reasonable place to start.
If, on the other hand, you're looking to start down a path that might have you doing useful things in a similar situation in 2032, this seems to me like a reasonable place to start.
It's increasingly difficult to tell what's going to be critical infrastructure and what isn't. The same is true in the real world; a defender or a belligerent alike might hope that the grain mill in the village will be functional when winter rolls in. Whether it is or not could depend on the work of someone who isn't even aware of the concept of a job title.
Here’s the UK’s cyber reservist list of desirable skills:
https://www.gov.uk/government/organisations/joint-forces-com...
https://www.gov.uk/government/organisations/joint-forces-com...
The current cyber reservist page is:
https://www.gov.uk/government/organisations/strategic-comman...
https://www.gov.uk/government/organisations/strategic-comman...
Are any of those listed qualifications valuable? I already know that Prince2 isn’t going to be the bulwark against an invasion.
I have an ITIL certification and I can honestly say it was the most useless 3 or 4 days (I don't even remember) of my entire professional life. Absolute rubbish, it was either completely made up / false, or such a basic level of common sense it makes you wonder how anyone got paid to write it down in the first place. The certification never expires but I haven't had it on my resume since I left that job.
I see many security certifications in that list that are useful (e.g. OSCP). You focused on the least useful of those.
AXELOS has a very bad track record.
Learning and getting certified by a company that botched ~80% of their projects... indeed not a good idea.
Learning and getting certified by a company that botched ~80% of their projects... indeed not a good idea.
Find a system or a piece of software, use it a lot (look at source code if you have it) and then ask yourself how you can break it. That's the key to becoming a great hacker.
If you don't understand a piece of software (and I mean really understand it) you probably can't break it in a meaningful way. You may accidentally break it, but your lack of understanding how it actually works will prevent you from further exploiting it.
Just my 2 cents. Hope it helps.
If you don't understand a piece of software (and I mean really understand it) you probably can't break it in a meaningful way. You may accidentally break it, but your lack of understanding how it actually works will prevent you from further exploiting it.
Just my 2 cents. Hope it helps.
At the end of the day firearm training is probably more valuable than anything else in Ukraine right now. Taking pot shots from a distance at groups of troops can cause them to seek cover and slow down their progression. I think that's about the best you can do as 1 - 4 people. Look to the Vietnamese or Taliban on how to defeat a larger better equiped force with a smaller less equiped one.
You should connect with your country's leadership to put the pressure where it belongs here. You are a citizen showing interest in supporting your nation. So they need to be able to offer you training starting from the basic frameworks, usually the "why" and "what" and later down to the "how" and "when".
As part of that training, they should be showing you which skills they want, how they can be acquired, and so on.
This is also important because you need institutional legal support and an objective ethics framework to affiliate with. Otherwise one misstep and you can end up looking like a vigilante even though you had the best intentions. Or you could end up ready to take action yet without the infrastructure or other resources that would be needed to carry out your work in a wartime environment.
If they can't meet that minimum bar it's a non-starter IMO. You are left to your subjective estimations of what is needed and are without formal support. Contact your representatives and hold them to it.
Edit: Is op from UKR? I can't tell--if so the first priority is connection with community of experts no matter how small.
As part of that training, they should be showing you which skills they want, how they can be acquired, and so on.
This is also important because you need institutional legal support and an objective ethics framework to affiliate with. Otherwise one misstep and you can end up looking like a vigilante even though you had the best intentions. Or you could end up ready to take action yet without the infrastructure or other resources that would be needed to carry out your work in a wartime environment.
If they can't meet that minimum bar it's a non-starter IMO. You are left to your subjective estimations of what is needed and are without formal support. Contact your representatives and hold them to it.
Edit: Is op from UKR? I can't tell--if so the first priority is connection with community of experts no matter how small.
I mean his countries leadership is a little busy at the moment...
If you want to learn offensive security skills, particularly binary analysis, I highly recommend https://pwn.college
It's a hands-on class that takes you through interacting with programs, to reverse engineering and memory corruption, all the way to race conditions and kernel exploitation.
Created by @Zardus and run also as a class at ASU.
It's a hands-on class that takes you through interacting with programs, to reverse engineering and memory corruption, all the way to race conditions and kernel exploitation.
Created by @Zardus and run also as a class at ASU.
Consider joining intelligence agency and working there for some time to learn.
Probably the best education you can get anywhere.
Other than that, working as a pentester. Again, you can learn from online sources, but if you are a competent programmer, why not cold approach asking you would like to work in cyber security
Probably the best education you can get anywhere.
Other than that, working as a pentester. Again, you can learn from online sources, but if you are a competent programmer, why not cold approach asking you would like to work in cyber security
Cyber defense is generally a joke. The people who know how to do it knew how before they ever joined the military. The bar is so low for security for pretty much everything that simply showing up to run a Nessus scan and patching basic firewall rules is considered advanced in most quarters. I don't see any path towards helping that isn't a giant waste of time.
I have seen this recommended - https://overthewire.org/wargames/
Play capture the flag games to get hang of vulns but
I hope that military has firewalls written in Ada/Rust and formally verified or fuzzed hard.
In comercial setting defence works by updating DB of viruses and network monitoring (basically watches all open ports and inspects tcp/ip packets).
Still def is hard as weakest chain loses and this means phishing, sms, email.
If I were Russian I would have agents working in FB/Twitter and bomb/stalk people based on that.
IMO best software engineers can do to maintain power balance are temper proof communication tools that are easy to use. Best if work also without internet - so called mesh-networking.
Still def is hard as weakest chain loses and this means phishing, sms, email.
If I were Russian I would have agents working in FB/Twitter and bomb/stalk people based on that.
IMO best software engineers can do to maintain power balance are temper proof communication tools that are easy to use. Best if work also without internet - so called mesh-networking.
- opsec (your neighbors will rat you out as a bargaining tool to save themselves)
- python, C, and assembler
- Gnuradio / HackRF (direction finding, spoofing/replay, jamming, etc)
- basic electronics
- basic model rocketry / pyrotechnics
- basic lock picking, escapes, first aid and wound care etc
- some off the shelf malware / botnet / RAT kits and usb installers, metasploit, etc.
From nothing to developing new zero day probably isn't going to happen during this conflict, and best hack will be using skills to get out of the country.
- python, C, and assembler
- Gnuradio / HackRF (direction finding, spoofing/replay, jamming, etc)
- basic electronics
- basic model rocketry / pyrotechnics
- basic lock picking, escapes, first aid and wound care etc
- some off the shelf malware / botnet / RAT kits and usb installers, metasploit, etc.
From nothing to developing new zero day probably isn't going to happen during this conflict, and best hack will be using skills to get out of the country.
It is extremely useful, if you have the time to spend on it, to investigate and help repair any open source vulnerabilities you can. The cleaner underlying libraries are the better all of our defenses get - it's not as glamorous as being a 1337 h4x0r but contributing to a core library provides an immense amount of value.
The way I've learnt this shit was very unstructured, extensively unoptimized and even still, I'm far from being anywhere near the l33ts. However, over the past 2 years, I can say for sure I became pretty proficient in identifying vulnerabilities in (web) applications for the most part.
The article that brought back my interested in hacking was this: https://gist.github.com/jaredsburrows/9e121d2e5f1147ab12a696... after reading this: https://crimethinc.com/2018/06/05/hackback-talking-with-phin....
There was a bunch of things I didn't understand when I first read it, so I took notes of mostly everything and started slowly by isolating topics, trying connect the dots as I was learning something new. Every once in awhile, I would go back to see if there were still things I didn't get it / or had missed, and there was always something. Eventually, the whole thing became a little more straightforward.
From there, it was just a matter of sharping my knowledge regarding more specific types of vulnerabilities and basically try them out into the wild. Worth mentioning, I have a background as a developer and although I had always been interested in cyber security, some concepts just escaped me. My programming skills however, made it easier to understand how to attack / defend applications. But this is just a small part of it.
Hacking is broader than that though, so it's not something that happens overnight. There are things I still have no idea how it works, but at least i know where to look. Also, not knowing a few things here and there doesn't make me necessarily worse than others h4ck3rs, as stupidity plays a huge whole in the cyber security realm as well and quite often, things are easier than you would expect (looking from the attacking standing point). Sitting on the defending side is quite hard though, as you have to covered everything as much as you can, while being an attacker, you just have to get lucky once.
hope this gives you some sort of direction.
There was a bunch of things I didn't understand when I first read it, so I took notes of mostly everything and started slowly by isolating topics, trying connect the dots as I was learning something new. Every once in awhile, I would go back to see if there were still things I didn't get it / or had missed, and there was always something. Eventually, the whole thing became a little more straightforward.
From there, it was just a matter of sharping my knowledge regarding more specific types of vulnerabilities and basically try them out into the wild. Worth mentioning, I have a background as a developer and although I had always been interested in cyber security, some concepts just escaped me. My programming skills however, made it easier to understand how to attack / defend applications. But this is just a small part of it.
Hacking is broader than that though, so it's not something that happens overnight. There are things I still have no idea how it works, but at least i know where to look. Also, not knowing a few things here and there doesn't make me necessarily worse than others h4ck3rs, as stupidity plays a huge whole in the cyber security realm as well and quite often, things are easier than you would expect (looking from the attacking standing point). Sitting on the defending side is quite hard though, as you have to covered everything as much as you can, while being an attacker, you just have to get lucky once.
hope this gives you some sort of direction.
I'm going to be brutally blunt. If you have to ask in a forum, you're not hacker material. A better option for someone eager but skill-less would be to enlist in one of the branches of armed forces in your country.
What kind of BS elitist attitude is this?
It's not elitism, I'm being fairly realistic here. Hackers are curious self-driven people that go poke and find things for themselves, it's pretty much a hard requirement for the trade. Asking for things on a silver plate in a forum whose name has "hacker" on it is frankly pretty lazy.
If you think dropping some "helpful" links here will help the dude actually "defend his country", I'm sorry to have to be the one to say that that's all delusional feel-good theater.
The other comment above talking about zergling rushes also caught on to the misguided motivation for this thread. If this was about being of service, my recommendation stands: join the army, that makes a material difference, especially when there are literal tanks physically invading your territory. Dreaming up fantasies - and not following through when you eventually realize that cybersecurity is hard - is stupid.
People are dying out there.
If you think dropping some "helpful" links here will help the dude actually "defend his country", I'm sorry to have to be the one to say that that's all delusional feel-good theater.
The other comment above talking about zergling rushes also caught on to the misguided motivation for this thread. If this was about being of service, my recommendation stands: join the army, that makes a material difference, especially when there are literal tanks physically invading your territory. Dreaming up fantasies - and not following through when you eventually realize that cybersecurity is hard - is stupid.
People are dying out there.
You can learn the hacker mindset in school.
What school? Where VUSEC teaches (Amsterdam).
What school? Where VUSEC teaches (Amsterdam).
Best thing is probably just to secure your own devices so that your stuff isn't used as a zombie and you don't become part of the mess that needs to be cleaned up (taking resources away from other things).
Otherwise, maybe try to join your country's cyber warfare group or cyber security in a company. You could try reading up on cyber warfare and practicing on an self-owned network that is not connected to other devices (so you don't accidentally impact anyone else). But I don't think this will be that helpful in most circumstances.
Otherwise, maybe try to join your country's cyber warfare group or cyber security in a company. You could try reading up on cyber warfare and practicing on an self-owned network that is not connected to other devices (so you don't accidentally impact anyone else). But I don't think this will be that helpful in most circumstances.
I strongly believe that one needs several years to achieve the skill level to become useful in that field. Unless you are looking for a job for life, starting now is a few years too late. Other comments provided info on how to start.
I also think that tanks, fighter planes and helicopters are pretty hard to defend via hacking; it's like defending a password against a 5$ wrench used to hit you repeatedly.
I also think that tanks, fighter planes and helicopters are pretty hard to defend via hacking; it's like defending a password against a 5$ wrench used to hit you repeatedly.
learning Metasploit would be a good start
Cyber warfare attack is when you damage critical infrastructure of enemy
And cyber defense:
"... in cyberspace, it is much easier to attack than to defend. The primary defense we have against military attacks in cyberspace is counterattack and the threat of counterattack that leads to deterrence."
And cyber defense:
"... in cyberspace, it is much easier to attack than to defend. The primary defense we have against military attacks in cyberspace is counterattack and the threat of counterattack that leads to deterrence."
Look at CSPM (cloud security posture management) solutions, it ensures there aren't any silly holes in your cloud like open S3 buckets etc, as well as ensuring pretty advanced organization specific custom policies. Look at Prisma, Wizio, Crowdstrike Horizon, etc.
The "lower" you get down the stack the more valuble youll be. You have to understand the fundimentials of how software works in order to reverse engineer it and start "hacking"
If you are in EU, then I would say building wireless mesh computer networks, maybe also creating longer range low bandwidth wireless links.
Do not underestimate the power of open source intelligence gathering and well executed social engineering.
If you're asking in the general case, as opposed to "How would I respond to this call" - my opinion is that the most practical and effective thing you can do is to help secure code used by individuals - web browsers, the Linux kernel, image decoders, etc. I think there are a number of reasons for this:
1) There is a real asymmetry between offense and defense in (nominal) peacetime. Helping the defense generally helps the "good guys" much more than the "bad guys" (at least in my worldview). If you look through attempted attribution of 0day attacks in the wild, what you generally see is repressive governments attacking individuals - watering-hole attacks on news sites, targeted malware against lawyers and journalists, etc. Cases of attacks on governments (like the 2012 MD5 collision that took down an Iranian nuclear reactor) seem to be rarer, and in particular, cases that rely on bugs in mass-market software (as opposed to supply-chain attacks or DoSes or very targeted attacks) are rarer, and attacks from less powerful / "hacker underground" groups towards governments are rarer still.
2) Structurally, it makes more sense. Cyberattacks aren't like physical attacks. When ammunition hits a target, there's a very classical-mechanics effect of the energy of the weapon versus the strength of the structure or shielding. Offense, at a very high level, is about more and stronger weapons, and defense is about withstanding or escaping attacks. Software, naturally, doesn't work that way. It's more mathematical; either the attack works, and is potentially completely compromising, or it doesn't. If you can make a system that robustly parses input without bugs (or sandboxes the parsing, or whatever), there is no cyber-weapon that can get past it.
3) You can make a real impact. A huge number of the systems that ordinarily people use are open-source software projects that accept contributions. (And note that this includes a whole lot of security-sensitive code in system that are not open-source as a whole product - for instance, most of the attack surface on iOS is in WebKit, image parsers, or the xnu kernel.) A lot more is available free-of-charge and accepts security reports. And there is, unfortunately, a lot of relatively low-hanging fruit.
Pick something you're interested in, go look at recent exploitable CVEs, and do some reading on how the exploits work and how they might be systematically prevented. A little bit of your time spent making it easier to systematically prevent exploits has a real long-term benefit on the world.
As a good historical example - most database libraries around 10-20 years ago made it most natural to construct database queries by appending strings together, which made SQL injections entirely too common. Since then, there's been a combination of a push for libraries to make it easier to do parametrized queries, a cultural / documentation push to get programmers to be aware of this, and a move towards database abstractions like ORMs that avoided the problem entirely.
Someone who wrote some docs 10 years ago about these libraries probably helped hundreds of annoyed enterprise programmers get their system built in the right way when their boss was yelling at them about deadlines, and may well have prevented millions of people losing their data in a breach.
When you think about attacks on secure messengers, etc., it's not hard to imagine that the same amount of effort could save countless lives just a few years down the line.
I think memory safety is one of the highest-impact changes we could make in development that would help the cause of defense, and there's a lot of work to be done. Most of it, mind you, is not merely showing up places and saying "I'll rewrite this in Rust" - it's helping people be able to integrate incremental rewrites and ship things in new programming languages, or perhaps helping them avoid memory-safety problems in their existing programming languages. Chrome has a good article on this https://www.chromium.org/Home/chromium-security/memory-safet... , and "fuzzing," the technique of throwing generated inputs at libraries to see where they crash and then fixing those crashes, is also highly valuable.
But there are a whole lot of other similar classes of problems to help with, too. The Linux Kernel Self-Protection Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... is working on eliminating classes of bugs in the upstream kernel. Some of these have already been addressed, to some extent, in security-focused forks of the kernel, but getting the fixes into the standard kernel is important for getting them in everyone's hands and also a good way to learn about things.
1) There is a real asymmetry between offense and defense in (nominal) peacetime. Helping the defense generally helps the "good guys" much more than the "bad guys" (at least in my worldview). If you look through attempted attribution of 0day attacks in the wild, what you generally see is repressive governments attacking individuals - watering-hole attacks on news sites, targeted malware against lawyers and journalists, etc. Cases of attacks on governments (like the 2012 MD5 collision that took down an Iranian nuclear reactor) seem to be rarer, and in particular, cases that rely on bugs in mass-market software (as opposed to supply-chain attacks or DoSes or very targeted attacks) are rarer, and attacks from less powerful / "hacker underground" groups towards governments are rarer still.
2) Structurally, it makes more sense. Cyberattacks aren't like physical attacks. When ammunition hits a target, there's a very classical-mechanics effect of the energy of the weapon versus the strength of the structure or shielding. Offense, at a very high level, is about more and stronger weapons, and defense is about withstanding or escaping attacks. Software, naturally, doesn't work that way. It's more mathematical; either the attack works, and is potentially completely compromising, or it doesn't. If you can make a system that robustly parses input without bugs (or sandboxes the parsing, or whatever), there is no cyber-weapon that can get past it.
3) You can make a real impact. A huge number of the systems that ordinarily people use are open-source software projects that accept contributions. (And note that this includes a whole lot of security-sensitive code in system that are not open-source as a whole product - for instance, most of the attack surface on iOS is in WebKit, image parsers, or the xnu kernel.) A lot more is available free-of-charge and accepts security reports. And there is, unfortunately, a lot of relatively low-hanging fruit.
Pick something you're interested in, go look at recent exploitable CVEs, and do some reading on how the exploits work and how they might be systematically prevented. A little bit of your time spent making it easier to systematically prevent exploits has a real long-term benefit on the world.
As a good historical example - most database libraries around 10-20 years ago made it most natural to construct database queries by appending strings together, which made SQL injections entirely too common. Since then, there's been a combination of a push for libraries to make it easier to do parametrized queries, a cultural / documentation push to get programmers to be aware of this, and a move towards database abstractions like ORMs that avoided the problem entirely.
Someone who wrote some docs 10 years ago about these libraries probably helped hundreds of annoyed enterprise programmers get their system built in the right way when their boss was yelling at them about deadlines, and may well have prevented millions of people losing their data in a breach.
When you think about attacks on secure messengers, etc., it's not hard to imagine that the same amount of effort could save countless lives just a few years down the line.
I think memory safety is one of the highest-impact changes we could make in development that would help the cause of defense, and there's a lot of work to be done. Most of it, mind you, is not merely showing up places and saying "I'll rewrite this in Rust" - it's helping people be able to integrate incremental rewrites and ship things in new programming languages, or perhaps helping them avoid memory-safety problems in their existing programming languages. Chrome has a good article on this https://www.chromium.org/Home/chromium-security/memory-safet... , and "fuzzing," the technique of throwing generated inputs at libraries to see where they crash and then fixing those crashes, is also highly valuable.
But there are a whole lot of other similar classes of problems to help with, too. The Linux Kernel Self-Protection Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... is working on eliminating classes of bugs in the upstream kernel. Some of these have already been addressed, to some extent, in security-focused forks of the kernel, but getting the fixes into the standard kernel is important for getting them in everyone's hands and also a good way to learn about things.
Work for the government or a military contractor.
hackthebox.eu provides good training
Not sure if it’ll be enough
Not sure if it’ll be enough
Lots of great things being shared here. We never know if OP is actually Russian and aiming to do the opposite of claimed -- nevertheless let's share what we'd normally share anyways.
Adding on to what others have said I would say start with this. To be a useful "hacker" to *defend* your country start with ensuring you are not immediately exploitable yourself & then repeat for others close to you. A incomplete shortlist off the top of my head
1. Ensure all your devices are secured including great passwords, updates applied, minimal/no ports expose
2. Secure your financial instruments w/ great passwords and multifactor options. physical devices like yubikey is (afaik) top of the line, other styles are an improvement over nothing.
3. Create backups of important things so you're unlikely to be blackmailed by ransomware
(others, what am I missing?)
Adding on to what others have said I would say start with this. To be a useful "hacker" to *defend* your country start with ensuring you are not immediately exploitable yourself & then repeat for others close to you. A incomplete shortlist off the top of my head
1. Ensure all your devices are secured including great passwords, updates applied, minimal/no ports expose
2. Secure your financial instruments w/ great passwords and multifactor options. physical devices like yubikey is (afaik) top of the line, other styles are an improvement over nothing.
3. Create backups of important things so you're unlikely to be blackmailed by ransomware
(others, what am I missing?)
[deleted]
Everything.
The time to start a campaign against Russia on behalf of Ukraine was weeks ago. It’s too late now, like calling up the national guard hours before a massive shock and awe blitzkrieg campaign. Zelensky should have been making these appeals a long time ago but was delusional.
Was Zelensky delusional 10 months ago when he requested NATO speed up Ukraine's membership plan?
https://youtu.be/admHGiHGnYY
NATO has decided it was fine with letting Russia have Ukraine with the expectation that Russia would not invade other countries. I swear I've heard this before in a history class.
https://youtu.be/admHGiHGnYY
NATO has decided it was fine with letting Russia have Ukraine with the expectation that Russia would not invade other countries. I swear I've heard this before in a history class.
Yes, 10 months ago and the time surrounding it, Ukrainian membership has never been viable politically or militarily so Zelensky should have seen the writing on the wall. What is sad is that NATO would allow war to happen in order to maintain the hypothetical capacity to admit a country that may no longer exist. If NATO appeasement wouldn't have contained Putin it would be nice to at least have him on record saying he is invading for other reasons.
That seems harsh, Russia was actively looking for any excuse and those might be good enough. The fact they still attacked could look obvious now but that’s hindsight.
Everyone of us here has above average computer skills, but most of us don't have offensive or defensive cyber warfare skills.
We have all seen how quickly war can break out.
What does one need to know to be of value to one's military, should the need ever arise?
What skills would they be looking for?
How can I acquire those skills?