Employee stories
"I first heard about VR when I was in secondary school, from a government initiative which was running at the time that was all about getting teenagers interested in cybersecurity. Safe to say it worked on me!
I developed my skills doing CTF (Capture the Flag) competitions throughout secondary school and university. At university, I was really involved in the Cybersecurity Society there, running CTFs and other talks and activities for them - it was my #1 hobby!
Joining Interrupt Labs straight after university was my first "proper" work experience in VR. There’s a lot of learning on the job but companies that do VR offer great training and support.
My advice to aspiring Vulnerability Researchers would be never give up! It's cheesy, but when I started out I would say it probably took me multiple years before I thought I fully understood some of the basic things, let alone anything more complex - but from then on it became easier. If you persevere, eventually it will start to make sense!
Also, never move on from something you don't fully understand yet! When starting out, if something doesn't quite make sense or you aren't really sure how it worked (even if you have succeeded at your task!), you should keep going until you feel you understand it fully!" - Adam, Researcher - Basebands
"I first came to hear about VR when I applied for an internship at another company. I flopped the interview but learnt more about VR which sounded super cool, resulting in me applying again for a different VR role once I'd improved my knowledge.
I took an online course on software license cracking . Also, I watched a lot of YouTube videos on the fundamentals of memory corruption, binary exploitation, and hardware hacking whilst following along.
A big barrier in the industry is just not knowing that VR exists as a career! It’s not something that is actively taught or talked about at higher education, so you need to find the learning resources yourself, and be motivated to learn. The interviews for VR roles can also be tricky if you are not very experienced - they require a ‘VR mindset’ which takes a while to build.
My advice to people starting out would simply be to hack something! Doesn't have to be anything novel, there are plenty of demo videos on YouTube that will take you from tearing down an IoT camera, extracting firmware, getting debug access, reversing firmware, exploiting bugs etc - just follow them along. If you like it then start applying for jobs or placements and your hacking experience will be a great thing to talk about in interviews. Explain what you did to hack a device, the importance of each step, and the parts you especially enjoyed (or didn't)!" - Calvin, Associate Researcher - Embedded Systems
"I started out in offensive security when I was in high school but it wasn’t something taught in school, so all my learnings and experiments were done after school or during vacations. CTFs were definitely a fun avenue to get exposed to different things and a good testbench for my skills.
I spent a lot of time on forums and IRC which is where I met a lot of people I still talk to today - pretty wild actually!
The last important ingredient for me has been to share with others. I decided early to open a blog and a GitHub account to document my work. Writing’s immensely useful for me as a tool to clarify my understanding. Every time I write, I asked myself a bazillion of follow-up questions: “Actually, why does it work this way?”, “Are you sure this statement is actually true?”. All of those were great opportunities for me to go find answers, dig deeper & better my understanding.
I would really encourage people interested in a VR career to figure out if this is really something they want to do. It might be seen as 'sexy' but it takes very specific personalities to be okay with the amount of ‘failure’ it involves.
I would also suggest they shift their focus from the end goal of finding a bug or exploit. You will not start seeing bugs without any effort, obviously, but you will be better positioned to see things that aren’t obvious if you spend time reading and trying to debug code. So 100 hours spent without ‘producing’ anything will not be wasted because your understanding and skills will have improved so much!" - Axel, Principal Researcher - Browsers
"I've loved hacking ever since I was a kid and got my PlayStation Portable – I wanted to get the most out of it! Being curious and loving tinkering with my tech, I got into the jailbreaking scene to run my own code on it. This is where I learned that it actually takes fully exploiting the system through memory corruption which I found fascinating.
When I started in university the tools and training available for VR were hard to find at the time. As the CTF scene has gotten more mainstream, however, there’s a lot more beginner material available through Reverse Engineering and Pwn challenges. This combined with Ghidra being open source has made the sector a lot more accessible.
At uni, I was fortunate to be in the first cohort of CyberFirst bursary students which gave me the opportunity to do an internship every summer. One of these gave me a full 8-week training course on VR taking us through looking at real IoT devices. After my internship I kept developing those skills through CTFs and Pwn challenges.
My advice would be to always e curious! I would recommend getting comfortable with basic concepts through CTFs, then throwing yourself at real devices. While finding 0-days great - the journey to get there is purely about understanding what is going on. Once you understand how it works – often you will find out how it doesn’t work." - Robert, Senior Researcher, iOS