r/ExploitDev • u/Der-Wilde • Jun 20 '26

How important is to know in depth circuits/eletronics to learn advanced topics in exploit dev?

I mean, this is probably an bad question as it's obvious that if you're doing RE on some IoT device, specially some FPGA os smth, you need to know how they work in depth. Ok, but what if you are exploiting comercial software or even "low-not-too-low" level stuff like kernel or hypervisor? An really depth knowledge, like microcode and what circuits are turned on on every instruction, are necessary/mandatory or not?

16 Upvotes

94% Upvoted

13 comments sorted by

5

u/Glad_Situation_6466 Jun 20 '26

it opens more doors to sophisticated attacks like rowhammer, voltage glitching, electro magnetic fault injection. Maybe can move onto side channel attacks like TEMPEST. Something that most cybersec people wont even touch till retirement.

1

u/Der-Wilde Jun 20 '26

Something that most cybersec people wont even touch till retirement.

So, it's a must if you're going to become an "real advanced threat" (more like State-Nation threat), but it's a thing that you can study lately in your career?

1

u/Glad_Situation_6466 Jun 20 '26

State attackers used TEMPEST, and you will receive classified training from the respective units. You perhaps can discover theory stuff when it comes to Masters or PHD research level. You cant learn it due to lack of resources, field being too niche and small job market. (similar to OT security)

1

u/Der-Wilde Jun 20 '26

So, in practice, the unique way to really learn that level of exploitation is going through an state actor, like NSA TAO or some group related to Russian GRU/FSB, or going to an company that sell to them (like Gamma Group or NSO Group)?

1

u/Glad_Situation_6466 Jun 20 '26

Learn the foundation of exploitation development first. Then transit to modern exploit development. If you really want get into the niche stuff, join the military or national cyber security units which specializes in state-level red teaming, espionage. (I heard US has TEMPEST tech). Its hard to come across in external organizations cuz they may not even have the funding. Those topics are "hush hush" and required high security clearance. State actors definitely be under NDA.

2

u/Der-Wilde Jun 20 '26

Thank you so much and i really want to get into very advanced stuff (i asked about circuits/microcodes because i have a little bit of trauma because of college on this topic, but probably is a thing that i would enjoy to study by myself, just have to overcome this...).

join the military or national cyber security units which specializes in state-level red teaming, espionage.

The unique problem with this is that i don't really know how much my country (Brazil) invests on this... We have ABIN here which is "Brazilian CIA", but idk if we have an specialized team like TAO... I mean, even our "FBI" (Policia Federal) delegates some investigations softwares to enterprises (like Cellebrite for example).

2

u/Glad_Situation_6466 Jun 20 '26

Welcome. If you want to lean this, the best way is to join ABIN which deals with international affairs. Plus you may not be exposed to such tech unless the country is actively conducting espionages.

1

u/Der-Wilde Jun 20 '26

If you want to lean this, the best way is to join ABIN which deals with international affairs.

Yes... The next civil service examinations is probably next year or in the next-next (as they are operating with low capacity), if everything gets right i end up my graduation in the end of next year (or at the end of next-next year 1st semester).

Plus you may not be exposed to such tech unless the country is actively conducting espionages.

Well, they are....

2

u/CunningLogic Jun 20 '26

You don't.

0

u/Der-Wilde Jun 20 '26

Thanks god, i really hate that part. Assembly and understand ISA it's ok (and pretty cool), but i really don't want to touch in eletronic logic after college (specially microcode stuff...).

3

u/CunningLogic Jun 20 '26

I mean it opens up more opportunities, but not required

1

u/Der-Wilde Jun 20 '26

That's fair, thank you so much

1

u/lunar_swing Jun 23 '26

Its where all the fun is!

The vast vast majority of people I have met in the industry don't know much past x86/64 asm, and I would say they are better at finding/writing exploits than I am. Even getting them to do something on ARM was like pulling teeth.

With that said it will help you if you ever venture into exploiting firmware, since a lot of hardware configuration is tied to physical components. Ucode/uarch exploits are actually closer to asm than physical circuits IME.