TY - GEN
T1 - 'Watching over the shoulder of a professional'
T2 - 45th IEEE Symposium on Security and Privacy, SP 2024
AU - Ford, Irina
AU - Soneji, Ananta
AU - Kokulu, Faris Bugra
AU - Vadayath, Jayakrishna
AU - Basque, Zion Leonahenahe
AU - Vipat, Gaurav
AU - Doupé, Adam
AU - Wang, Ruoyu
AU - Ahn, Gail Joon
AU - Bao, Tiffany
AU - Shoshitaishvili, Yan
N1 - Publisher Copyright:
© 2024 IEEE.
PY - 2024
Y1 - 2024
N2 - The complex and diverse nature of software systems necessitates a careful manual approach to unveil vulnerabilities, involving deep analysis, creative problem-solving, and specialized expertise. Like all complex tasks, it's susceptible to mistakes stemming from cognitive limitations and behavioral factors that hinder optimal performance. Although there are significant research efforts focused on vulnerability discovery, little attention has been given to comprehending mistakes within the process. Understanding these mistakes could pave the way for better-designed education programs and automated tools, aiming to mitigate and prevent potential mistakes and enhance the efficiency of vulnerability research.In this paper, we leverage social media, specifically YouTube, to examine mistakes made by security content creators exploiting vulnerabilities in CTF-style challenges. Analyzing 30 screencasts from 11 hackers, we identified 124 distinct issues and investigated their types, underlying causes, and time investments. Additionally, we delved into the cognitive and behavioral aspects associated with these issues.
AB - The complex and diverse nature of software systems necessitates a careful manual approach to unveil vulnerabilities, involving deep analysis, creative problem-solving, and specialized expertise. Like all complex tasks, it's susceptible to mistakes stemming from cognitive limitations and behavioral factors that hinder optimal performance. Although there are significant research efforts focused on vulnerability discovery, little attention has been given to comprehending mistakes within the process. Understanding these mistakes could pave the way for better-designed education programs and automated tools, aiming to mitigate and prevent potential mistakes and enhance the efficiency of vulnerability research.In this paper, we leverage social media, specifically YouTube, to examine mistakes made by security content creators exploiting vulnerabilities in CTF-style challenges. Analyzing 30 screencasts from 11 hackers, we identified 124 distinct issues and investigated their types, underlying causes, and time investments. Additionally, we delved into the cognitive and behavioral aspects associated with these issues.
UR - http://www.scopus.com/inward/record.url?scp=85204057529&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85204057529&partnerID=8YFLogxK
U2 - 10.1109/SP54263.2024.00202
DO - 10.1109/SP54263.2024.00202
M3 - Conference contribution
AN - SCOPUS:85204057529
T3 - Proceedings - IEEE Symposium on Security and Privacy
SP - 350
EP - 368
BT - Proceedings - 45th IEEE Symposium on Security and Privacy, SP 2024
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 20 May 2024 through 23 May 2024
ER -