In a (cyber)space not that far away, was a time when offensive security was all fun and games (or profit), and finding vulnerabilities a nice and cool way to understand how something worked. Needless to say, things have changed a bit since.
Offensive security is now recognized as equally important as defensive measures when it comes to the safeguard of our digital lives.
Vulnerability research is now an essential but never-ending quest, dealing with an ever-growing code base and increasing difficulty.
In a short future, it will require not only skills but also the proper tools and automation. And the road is a tough and long one.
At Quarkslab, a French cyber-security company, we are trying to face those challenges, with limited resources, but inspired by our customers, and supported by our developers and devops teams. This talk will focus on some tools we made, which all proved to be working in real-life situations, and all of them being available and open source:
– LIEF, a library to Instrument Executable Formats;
– QBDI, a modular Dynamic Binary Instrumentation framework;
– Triton, a dynamic Taint and Symbolic Execution engine.
We want to share what we learned, how we are finding vulnerabilities today, and what it could take to still doing it in the next decade.
