Blackbox research is fun with the right mindset

Analyzing a blackbox system is actually pretty fun if you approach it with the right mindset. For me what shifted my perspective was realizing that you're not hunting one specific target, you're training an intuition that works on all of them.

For the longest time, I was not a huge fan of blackbox research. I thought it was tedious, a sort of guessing game. And in a way, I am still not a fan of it today. However, over the years my perspective and my approach to it shifted. Let me try to explain it with this short post.

By blackbox system I mean:

• a system where you have no access to any form of source code.
• you can only interact with it by giving it some form of input and you get some form of output back.
• optionally, you may also have some logs.
• e.g. It could be a remote website, it could be a compiled binary, etc.

Blackbox research is essentially feeding something to a mysterious entity and trying to infer what it does under the hood.

It's like you're a hunter tracking down your prey thanks to the traces it left behind, you never actually see the thing happening. You only give it some input, get some output, and sometimes get a few logs that hint that your prey went this or that way. Open-source would be as if you had a GPS tracker constantly tracking your prey. It's a pretty cool analogy if you think about it.

This hunter intuition that you build transfers, because everything is a blackbox at some scale. Most of what you're using on your computer is a form of blackbox: you don't exactly know what's going on under the hood. Your computer itself is one: do you really know everything that happens when you ask it to execute a program? You may have a broad understanding, but in the end you give it your input and expect some output. Only your experience lets you map a given behavior back to the particular subsystem responsible for it.

I would even argue that an open-source project, if its complexity is high enough, ends up being what I would call a "blackbox of complexity". The Linux Kernel is open-source, does that mean everybody knows how it works? Absolutely not. It is composed of so many subsystems intertwined and communicating with each other that it ends up creating a blackbox of complexity. The source is fully available, but it won't necessarily save you, only your intuition does.

So with time, I understood that blackbox research is far from being a guessing game. The best researchers develop an intuition, something far more valuable than the source code for a specific target. You are effectively improving your hunting skills, and those skills can be applied equally to an open-source or a blackbox target. That is why it's fun: you never walk away with just one kill, you walk away a better hunter.