Three days!

What can I do in three days?

Playing "360 Heroes" can probably be played dozens of games; Take a short and medium-distance trip that you don't want to go; Immersing yourself in preparing for the re-exam, which boosts your confidence or realizes that you are really hopeless......

Or, maybe it's undergone a radical change?!

Lighting a cigarette for himself, Sun Cheng scratched his messy hair, but his eyes stared straight at the computer in front of him that had fallen into a blue screen restart again, and an emotion called excitement was constantly flashing on his face. Pen, fun, and www.biquge.info

"Did you find another vulnerability? Good job, man! ”

With a cigarette in his mouth, he took a beautiful puff, and Sun Cheng muttered in his mouth.

In the past few days, he had to stay up in the club room every day until the point where the power was cut off before leaving, and he would get up and rush to the club room at dawn the next day.

After several days of high-intensity work, Sun Cheng had obvious dark circles in his eyes.

However, what you pay will naturally be rewarded.

In the course of three days, he had absorbed a lot of computer-related expertise, although he had only memorized them preliminarily, and he could not completely use them for his own purposes.

But Rao is like this, Sun Cheng's computer level has also made significant progress on the original basis.

Not to mention that it only takes a thought, and the wealth of computer knowledge that has been imprinted in his head will automatically emerge for him to read.

The accumulation of knowledge has also directly affected the improvement of his eyesight and skills, and now Sun Cheng is no longer the lucky person who had a treasure but couldn't use it well a few days ago.

Using his own technology, which is no less than that of ordinary computer engineers, he downloaded several professional Linux vulnerability detection software from the Internet to absorb and fuse to remove the bad and retain the essence, and on this basis, he wrote the first software in his life, a Linux vulnerability detection software that he named 'Sky Eye'.

It's not entirely accurate to say that it's vulnerability detection software.

Unlike some vulnerability detection software available for download online, Sun Cheng also added a virus database to SkyEye to enhance its aggressiveness.

When testing the Linux system, WikiBit can not only use more than 100 viruses he found on the Internet to test the security mechanism and built-in software of the system, but also simulate various energy consumption environments to test the state reaction of software and hardware and possible hardware vulnerabilities.

Once a vulnerability is found during the detection process, Sky Eye will force the computer to restart with a blue screen after automatic recording.

Although Sun Cheng also admits that the software he designed is extremely harmful to the life of the hardware, it cannot be denied that it is a very practical brute force detection software.

No, in just one day, Tianyan detected five vulnerabilities in the 'Kirin 7.0' version of the operating system born based on linux, including a high-risk vulnerability called "Heartbleed" (Heartbleed), and a security vulnerability (Shellshock) based on LinuxBashShell.

What he didn't expect was that Tianyan unexpectedly discovered a hardware vulnerability in the core 'Athlon II.' series of CPUs, and hackers who mastered this vulnerability could write the corresponding code, and through the caching mechanism, they unknowingly invaded any computer equipped with this core CPU.

In just one day's work, Tianyan has not done a complete surface inspection for 'Kirin 7.0', and so many vulnerabilities have been discovered, and Sun Cheng is excited and excited.

These discoveries not only mean that he is starting from scratch, but that the improved operating system based on Kirin 7.0 will be more perfect.

At the same time, the discovery of more and more loopholes also made him faintly feel that it seemed that the initial capital for his own business had been raised.

In 2007, with the launch of the 'Bug Bounty Program (VRP)' by the search engine giant Google, another Internet giant in the United States Facebook, followed suit the following year, and launched the 'White Hat Plan' program, which eventually triggered many Internet companies in Europe and the United States to follow suit.

In recent years, domestic Internet companies have also followed suit, since the beginning of last year, the well-known domestic social software Panda OO took the lead in announcing the 'Panda Knight Reward Program', domestic local enterprises have built their own vulnerability reward platforms, encouraging domestic and foreign security technology experts to inform enterprises of vulnerability information.

Previously, the Oday exploit (a vulnerability that has never been made public and has not been patched) was often circulated on the "black market" online, where hackers used it to profit from cybercrime.

Since vendors often find vulnerabilities and make patches after they are attacked, losses are unavoidable.

According to the intelligence that Sun Cheng has searched on the Internet in the past two days, the vulnerabilities of some popular software and operating systems are often marked as high as thousands to tens of thousands of dollars on the "black market", especially some vulnerabilities in Microsoft's newly launched win7 operating system, which can even be sold for hundreds of thousands of dollars on the Internet.

Like foreign software companies, the bug reward offered by Fiberhome for the 'Kirin' series of operating software is not high, and the reward for vulnerabilities that are identified as 'ordinary' is 500 yuan, the reward for 'intermediate' vulnerabilities is 1,000, and the 'high-risk' vulnerabilities are only 2,000.

In addition, if the person who found the vulnerability can provide test cases, Fiberhome will give an additional 50% reward on top of the original bonus, and if it can provide a patch, the bonus will be doubled.

Obviously, judging from the rewards alone, it is certainly not cost-effective to work for the stingy beacon.

In contrast, the domestic hardware company, Tai Core, is undoubtedly much more generous in its 'vulnerability reward'.

There are 1,000 logical vulnerabilities, 3,000 functional vulnerabilities, and 10,000 high-risk vulnerabilities without an upper limit, and it is also a U.S. knife.

After discovering the hardware vulnerability of the 'Athlon II.' series CPU, Sun Cheng quickly determined that what he discovered was a 'high-risk vulnerability'.

While he couldn't find more Athlon CPUs to test, he had some suspicions that the architectural flaw might not be limited to the Athlon II. series, but was common to the entire Athlon series.

If that's the case, then the problem is much more serious.

Because in recent years, the chips used in the commercial servers and supercomputers produced by Taicangzhou, the parent company of Taihexin, are the 'Athlon' series of Taihexin.

If this vulnerability is exposed, it will not only have a very bad impact on the star product 'Athlon' series of Tai Core core, but it may even take the opportunity to steal a series of servers and supercomputers equipped with this CPU.

At that point, the problem will be bigger.

There is already a plan to knock a sum from the 'Tai Core ', and Sun Cheng is obviously in a good mood.

Humming a little song, he waited for nearly a minute before the computer restarted completely, he opened the eye of the sky unhurriedly, and quickly found the newly recorded vulnerability prompt.

“GrandUnifiedBootloader…… Catch a logical loophole? ”

Sun Cheng couldn't help but be stunned, GRUB2 is the boot management program for most Linux operating systems, and the same is true for Kirin 7.0.

If it has a vulnerability, it will be a highly dangerous vulnerability.

But then after reading the detection and analysis of Tianyan, Sun Cheng's face couldn't help but twitch, "I'll wipe it, this will work!" ”

The newly discovered vulnerability is indeed a high-risk vulnerability, and hackers can use it to access GRUB2's RescueShell to escalate privileges, copy disk information, install a rootkit, or destroy any data, including GRUB, even if the disk is encrypted, it may be overwritten, causing the system to fail.

But the problem is, the discovery of this vulnerability is really not too interesting.

Previously, when the detection entered the GRUB and asked for a username, Sun Cheng, who was lighting a cigarette for himself, accidentally dropped the lighter and smashed it on the reverse button, causing it to fall into it and click continuously for a while, and when he noticed it, he hurriedly dug up the reverse button.

But no one expected that it was this unintentional encounter that was actually captured by the eye of the sky, and when the reverse key was struck 28 times, the system process actually entered the RescueShell rescue mode.

"What a low-level to incredibly high-risk vulnerability!"

After pinching out the cigarette butt and recording it with a smile, Sun Cheng finally understood why such a low-level loophole had never been discovered so far.

If the conventional, non-destructive detection method has been used, there is no coincidence like him, even the most professional system vulnerability detection software needs at least countless repeated analysis of the program to find such a low-level but dangerous vulnerability.

After saving the record to the USB drive and removing it, Sun Cheng quickly made Tianyan work again, ready to continue to detect more possible system vulnerabilities.

He himself lay down comfortably in his chair, squinting and preparing to continue sorting out and digesting the large amount of computer-related knowledge he had absorbed a few days ago.

In the activity room, there was silence for a while.

Until a phone rings!