keep moving

Agree to some extent. In some places getting a certificate is just a means to get through the door. But yes it has very little to do with actual skills.

Here’s an excerpt from a 2016 Ars Technica article: Recruiter Thomas Ptacek, whose Chicago-based agency Starfighter specializes in recruiting security folk, describes the CISSP as “a joke,” and claims that in his experience a job description requiring a CISSP was a warning flag to industry elite not to apply. “I don’t think there are that many high-level practitioners outside of management who put much stock in the CISSP,” he says. Dan Tentler, founder of the attack simulation consultancy Phobos Group, compares hiring infosec workers based on passing an exam to hiring other professionals on the same basis: “Would you feel comfortable letting a doctor be your primary care physician if all it took was to pass a written multiple choice exam?” He believes that “ISC2 is making money hand over fist,” and that the organization is “diluting the market with

Source: Information Security Certifications are Worthless and Causing More Harm than Good

A new vulnerability discovered by Project Zero affects tons of smart phones (iPhone, Nexus, Samsung S*). The attack proceeds silently over WiFi – you wouldn’t see any indication you have been hacked. For iPhone users, iOS 10.3.1 fixes this. Android users? Good luck.

In this two-part blog series, we’ll explore the exposed attack surface introduced by Broadcom’s Wi-Fi SoC on mobile devices. … The first blog post will focus on exploring the Wi-Fi SoC itself; we’ll discover and exploit vulnerabilities which will allow us to remotely gain code execution on the chip. In the second blog post, we’ll further elevate our privileges from the SoC into the the operating system’s kernel. Chaining the two together, we’ll demonstrate full device takeover by Wi-Fi proximity alone, requiring no user interaction.

Source: Project Zero: Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)

Get this: you are running Microsoft Edge in a VM and visiting a website. Your VM gets compromised and the malware jumps out of the VM to the host. The Qihoo security team has been coming up with a number of very impressive hacks.

Hack worked by stitching together three separate exploits.

Source: Virtual machine escape fetches $105,000 at Pwn2Own hacking contest [updated]