Sharing knowledge is in Zetier’s corporate DNA, and this expresses itself in multiple ways.  For example, we participate in conferences, we host summer interns, and we share lists of resources with students who can benefit from their content.

Conferences

Zetier engineers like going to security conferences, both as attendees and speakers.  It’s a great opportunity to learn new information, grow professional networks, and share information with others.  In 2023, members of our staff attended and presented at Schmoocon, GrrCON, and the Texas Cyber Summit.  Plans are underway to be a part of conferences (Shmoocon, for one) in 2024, and our engineers look forward to discussing their work and sharing their knowledge of (and passion for) cybersecurity research.

Internships

We believe there is no better way to help train the next generation of cyber researchers than to offer summer internships to college students.  This past summer we hosted two interns, and they were arguably the best class of students Zetier has ever hosted.  Johannes M. was a rising senior at Norwich University in Vermont and Garrett H. was a rising junior at Purdue.

During the summer, Johannes and Garrett sat among mid- and senior-level engineers—literally feet away from those who mentored them.  During their last week with us I asked each what was the best aspect of the internship.  Johannes wrote, “I was truly treated like a regular employee, and was not just handed some menial intern task.  This really helped me get a good understanding of the work and also allowed me to learn at a much faster pace.  I also enjoyed that I was not being overmanaged, but was rather given the freedom to work in my own way.”  Garrett also had a positive experience during his Zetier internship:  “From a personal development perspective, working next to subject matter experts and contributing directly to Zetier’s products enabled exponential growth of my technical abilities over the summer. Leadership actively seeks opportunities to invest in employees and create an environment where everyone can thrive.”

At the end of the summer we said goodbye to Garrett and wished him well at his next internship and future scholastic endeavors.  With Johannes, though, we said “see you later” — because he is joining Zetier full-time as an engineer when he graduates next spring.

Are you interested in interning at Zetier?  If so, send a resume and brief cover letter listing your interests to careers@zetier.com.

Resources

Zetier’s engineering staff assembled a list of websites, tools, books, and videos to share with high school and college students.  The list is an attempt to provide guidance on resources students and people transitioning to the field can use to make themselves stronger candidates.

Websites

• https://microcorruption.com/ — A good site for learning debugging and fundamental hacking concepts.
• http://pwnable.kr — Multiple pwnable challenges, good for learning system exploitation.  The site has an assortment of easy and difficult challenges.
• https://pwn.college — This site, run by a professor at Arizona State University, is used in ASU cybersecurity courses.  The website covers multiple topics surrounding software security and exploitation.
• https://github.com/rng70/Hacking-Resources/tree/master — A large collection of online books, PDFs, and exercises for learning hacking.  As you expand your knowledge, you can find many topics covered by the content here.
• https://github.com/xairy/linux-kernel-exploitation — A large collection of exploitation writeups for Linux systems.  You may not start learning the material here, but as you progress, you can learn about more bug patterns and exploit techniques by reading these writeups.
• https://elixir.bootlin.com/linux/latest/source — An online source browser that indexes the Linux kernel.

Tools

• https://binary.ninja/ — Binary Ninja offers a suite of binary analysis capabilities, with a free version and excellent student and educator discounts.
• https://ghidra-sre.org/ — Ghidra is a suite of free reverse engineering tools from the NSA.  Go to the site to find the tool for download and links for getting started.
• https://github.com/sashs/Ropper — For finding and building ROP chains.
• https://github.com/skylot/jadx — For Android to decompile bytecode to Java.
• https://frida.re/ — Inspection hooking toolkit.
• https://docs.pwntools.com/en/stable/index.html — A GDB plugin to make CTFs and hacking easier.

Books

• Hacking: The Art of Exploitation, by Jon Erickson — Great book for getting into reversing and exploitation.
• The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, by Chris Anley et al. — Good book for learning bug classes and shellcoding.
• Practical Reverse Engineering, by Bruce Dang et al. — Covers reverse engineering for Windows and a variety of concepts.
• The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities, by Mark Dowd et al. — An unmatched software security auditing guide authored by top experts with a history of discovering vulnerabilities.
• A Bug Hunter’s Diary, by Tobias Klein — Gain invaluable insights into the world of cybersecurity and learn from the experiences of a seasoned bug hunter.
• Practical Binary Analysis, by Dennis Andriesse — This book gives you what you need to know about the anatomy of a binary and how it’s loaded into memory.  There are also sections on binary instrumentation and analysis.
• Guide to Kernel Exploitation: Attacking the Core, by Enrico Perla and Massimiliano Oldani — Introduces readers to kernel exploitation and motivates an in-depth study of operating system internals.
• Blue Fox: ARM Assembly Internals and Reverse Engineering, by Maria Markstedter — Provides a solid foundation in ARM assembly internals and reverse-engineering fundamentals.

Zetier thinks so highly of the value of these books that we sometimes send hard copies to junior candidates who show promise but don’t yet have the technical skills required to work here.  We mail the books, give the candidate time to read and study the material, and then offer another chance to interview.

Videos

• Binary Exploitation / Memory Corruption by LiveOverflow (https://youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN) — A series of short (~11 minutes) videos covering coding in different languages, reversing, exploits, and more.  The video topics start simple and work their way up to more challenging exploits.
• You can learn a lot from Robert Mustacchi as he talks about performance tuning, hardware/software interface, and operating system fundamentals (https://www.youtube.com/watch?v=vnD10WQ2930).

Share Your Thoughts!

What resources did you find valuable when you began studying offensive cybersecurity?  Where would you encourage a person just starting his or her education in this field to look?  Please tell us your thoughts in a note to hello@zetier.com.