Hacking with Go: Part 3

Go Time: Golang, Software Engineering

Ivan Kwiatkowski joins Natalie once again for a follow-up episode to Hacking with Go: Part 2. This time we’ll get Ivan’s perspective on the way Go’s security features are designed and used, from the user/hacker perspective. And of course we will also talk about how AI fits into all this…

Join the discussion

Changelog++ members save 4 minutes on this episode because they made the ads disappear. Join today!

Sponsors:

• Sourcegraph – Transform your code into a queryable database to create customizable visual dashboards in seconds. Sourcegraph recently launched Code Insights — now you can track what really matters to you and your team in your codebase. See how other teams are using this awesome feature at about.sourcegraph.com/code-insights
• FireHydrant – The reliability platform for every developer. Incidents impact everyone, not just SREs. FireHydrant gives teams the tools to maintain service catalogs, respond to incidents, communicate through status pages, and learn with retrospectives. Small teams up to 10 people can get started for free with all FireHydrant features included. No credit card required to sign up. Learn more at firehydrant.com/

Featuring:

• Ivan Kwiatkowski – GitHub, Mastodon, X
• Natalie Pistunovich – GitHub, X

Show Notes:

• Hacking with Go: Part 1
• Hacking with Go: Part 2
• Pascal (programming language)
• Hacking tool: IDA Pro
• Hacking tool: Ghidra
• Stowaway – Multi-hop Proxy Tool for pentesters
• Ivan’s video on reversing a Go malware
• “Stylometry” - recognizing author by code style, talk from the CCC 2014

Something missing or broken? PRs welcome!

פרקים

1. Opener (00:00:00)

2. Sponsor: Sourcegraph (00:00:23)

https://info.sourcegraph.com/changelog

3. It's Go Time! (00:02:47)

https://changelog.social/@gotime

4. Welcome back, Ivan! (00:03:36)

5. IDA Pro helping reverse engineers (00:04:41)

6. Is Go better for researchers or hackers? (00:06:36)

7. Rust is the real menace (00:07:35)

8. On Go's cross-compilation feature (00:09:31)

9. Go support for exotic platforms (00:10:57)

10. Security risks of listing module deps (00:13:49)

11. Benefits of Go over C & C++ (00:16:22)

12. Is Go code more secure overall? (00:18:29)

13. Sponsor: FireHydrant (00:19:47)

https://firehydrant.com/

14. Does COBOL malware exist? (00:21:18)

15. Reversing Pascal malware (00:22:02)

16. Defining APT (00:22:36)

17. Is the reversing process always the same? (00:25:09)

18. Those pesky goroutines (00:29:13)

19. Visualizing the reversing process (00:33:11)

20. Does Go's simplicity aid reversing? (00:35:24)

21. The efficiency of Go's compiler (00:37:52)

22. Do malware devs catch their errors? (00:38:47)

23. Evaluating errors in Assembly (00:41:33)

24. AI Tools for malware code review (00:43:23)

25. AI and codegen (00:46:08)

26. Ivan's (premature) unpop (00:49:37)

27. AI for fingerprinting malware authors (00:51:59)

28. Wrapping up! (00:55:16)

29. Outro (00:56:44)

https://changelog.fm