I Hate Infosec

on YouTube ↗57m

" summary

Argues that infosec shows little net improvement since 2007 with concrete evidence: old classes of bugs still dominate, an X server bug from 1991 sat undiscovered for years, vendors keep issuing remote‑code patches, breaches (Target Home Depot) barely dent stock, and exploit development still succeeds (SMS iPhone takeover, car remote exploits) even as defenses change. Notes engineering wins—sandboxing reduces exploitability, fuzzing with 500,000 fuzzer iterations is common, and new tools like AFL fuzz plus rising payouts (four Pwn2Own wins) shift attacker economics.

AI-written summary · about

" chapters (53)

1. 0:00Start
2. 2:39About me
3. 2:51Why would I hate infosec? HACKERS CAN TURN YOUR HOME COMPUTER
4. 4:47Browsers
5. 5:15Then and now
6. 6:14Conferences 2007 or now?
7. 7:53Breaches 2007 or now?
8. 8:11Patches 2007 or now?
9. 12:04Do breaches hurt? - 10.2018
10. 12:17Do breaches hurt? D10.2013
11. 12:36Do breaches hurt? 2013
12. 14:14Lessons learned
13. 16:17Compliance != security
14. 16:45More on compliance
15. 16:58Can't even stop the kiddies
16. 17:46We suck at finding bugs
17. 19:16Causes of failure
18. 20:18What is a 0-day?
19. 20:41What are 0-days used for?
20. 21:20Who uses 0-days
21. 22:45More 0-day quotes
22. 23:11Last quote
23. 23:53Find all the bugs
24. 27:15Effect of fixing a bug
25. 30:17Fix the bugs
26. 31:58What to do
27. 32:21Strategy
28. 33:28unhackable systems
29. 36:12Vulnerabilities
30. 36:45Measuring security • Consumers might decide to buy more secure, but costly products given the choice
31. 39:09(Lack of) Consequences of insecurity
32. 39:54iPhone SMS exploit
33. 40:36Nimda Worm
34. 43:24Laws
35. 44:26Military help?
36. 45:09Problems with the press
37. 47:11The rise of stunt hacking
38. 48:50Stunt hacking in the news
39. 49:52A bit of history
40. 50:07What changed?
41. 50:34The problem
42. 51:21Internet security
43. 51:59Press coverage of Heartbleed
44. 53:15Security of products going up
45. 53:30Why still pwn2own wins? (and breaches)
46. 53:50Still pwnable
47. 54:20Vendors getting smart
48. 54:34Cyber Fast Track
49. 54:49Bug Bounties and similar
50. 55:34Pwn2Own prizes
51. 55:54Crowdsourced audits
52. 56:20Conclusions
53. 56:53Questions?

" related talks

• 05mEnterprise security: A new hopeHaroon Meer · O'Reilly Security Conference 2017 - New York, NY
• 33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026Pedram Hayati · PyCon AU 2026
• 35mOS Security Is Hard: Why All the Fuzzers in the World Won't Change the Way...Alex Ionescu · WOOT '20
• 39mSoftware Security Engineering (Learnings from the past to fix ...)D. Mohanty · OWASP 20th Anniversary 2021
• 20mKeynote: Outsmarting IoT Defense: The Hacker's PerspectiveNatali Tshuva · Zephyr Developer Summit 2023
• 43m50 Shades of AppSecTroy Hunt · OWASP AppSec Research (AppSecEU) 2015
• 58mKeynote: What Got Us Here Wont Get Us ThereHaroon Meer · Black Hat Europe 2015
• 36mKeynote: What's New or Not in 2020: Are we Making Progress?Larkin Ryder · BSidesSF 2020