Interested in Internet Security, suggestions on learning?

[araisbec]

Hey everyone!

Wow it has been a while since I have posted on here, and I have come a long way since I first found these forums in high school.

It has come to my attention now - that as I am 20 and entering my third year of computer science at University - that if I wish to make a lot of money and become highly competent in my area of application within computer science... I must take learning into my own hands out of school.

I am very interested in internet security, and besides session jacking my friends for fun or breaking into my girlfriends parents' wifi, I am not very knowledgable on the topic.

Can any of you recommend good starting points for me to learn more? Good topics to get started on, books/sites? Learning vast topics such as this always seem so daunting to me, and I never have a really good idea of where to begin!

Thanks everyone!

[2goto1]

Internet security is really one subset of software security. Maybe you could start by getting an overview of how the software industry breaks down common security issues today, and then from there work your ways through the parts that interest you the most.

Here's a resource that might be worth starting from: http://cwe.mitre.org/

[mikazo]

I had a similar feeling of how huge a task it would be to learn about computer security, once I decided I was interested. I've found that it's been very helpful to learn about assembly, how viruses work, different types of attack vectors, how to secure a web server, that kind of thing. You basically just have to dive in head-first and see what interests you. Once you find something interesting, see if there's a book on it or a project you could do to learn more about it.

Here are some ideas you can try:

Try some Smash The Stack challenges. http://smashthestack.org/

Learn what a Windows Portable Executable file looks like.
http://msdn.microsoft.com/en-us/magazine/cc301805.aspx

Set up a Linux server with Debian on an old machine, then secure it.
http://www.debian.org/doc/manuals/securing-debian-howto/

Read about the dumb parts of security.
http://www.ranum.com/security/computer_security/editorials/dumb/

Read about how anti-virus works. (I've read this book cover-to-cover, it's pretty interesting.)
http://www.amazon.com/Art-Computer-Virus-Research-Defense/dp/0321304543

[araisbec]

Thanks to both of you guys. I forgot how awesome the community on these forums is; Lots of sites will just flame you to hell and back for being a n00b or tell you "UTFSE". Hey, everyones gotta start somewhere.

Ok, so I have a good idea of how assembly works already, I have taken a good class on programming the M68K microprocessor, and learned a ton of valuable information. I guess I'll start by looking at things that are related to memory (so more on the local computer security side of things). First off, buffer overrun exploits!

[Tony]

Operating Systems is an extensive subject, but it is very useful material to know. Especially in terms of how they manage memory.

Buffer overflows are fun, but watch out for NX-bit support, address space randomization, and other protective systems. Basically to get started with security, you might have to go back to fairly old systems, where executing certain techniques is easier, and work you way up from there.

[mikazo]

Good to point that out, I know some of the Smash The Stack Servers intentionally disable some of those security features for learning purposes. I got about 10 levels into the IO server and learned a lot about buffer overflows.