Notes on Finding Evasive Bugs (by James Kettle)

Highly recommend security researchers to watch this. The talk focuses more toward improving your methodology and mindset:

1. Don’t look for defences; Start with the attacks first.
2. Look for unfashionable flaws.
3. Your understanding of a vulnerability concept may be corrupted. Don’t reply on internet searches to learn. Learn from the original sources.
4. Recognise the fear from the new or unknown (Technique sounds cool but…)
5. Recognise that you might think that something is an implausible idea. Don’t just try something and then give out if it does not work. Instead do this: Explain why the idea will not work unless condition X exists. Try the obvious to make sure that it is obviously secured.
6. Invisible Chainlinks give you advantages. They can be related to a particular context, application specific knowledge, inconvenient. For example, param miner works well if you have the application specific knowledge.

Automation

• Use automation to scan for clues about the application.
• Scan to learn
  • Test Hypothesis
  • Ask question and iterate
• When enumerating, focus on specific things rather than broad information to reduce noise.
  • Make asking questions cheap.
  • Develop your own framework.