Fuzzing for bugs yields poor results on offense. Too many other people looking with same tools, long dev time. #youkillityoueatit
-
Talking from experience with pwn2own
#youkillityoueatitpic.twitter.com/1fZFKHpnov
How do you find logic flaws? In a word, experience. Lots of vague advice: try threat modeling, identify trust boundaries, think really hard.
-
-
This talk summarizes pretty well another reason why I won't use Android. Rich IPC enables trivial attacks between sandboxed apps.
-
MWR is abusing a trick in Android Chrome to reflect Android IPC calls all over the place. Feels like exploiting XSS.
- 4 more replies
New conversation -
-
-
I'm consistently impressed at how quickly and thoroughly experts in non-security things can tell you how to break their things.
-
A good example: work with a professional java developer when exploiting a java app and they'll cut your dev time in half.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.