Where to publish security research?

Question

I'm considering doing some research in to an attack vector which I think doesn't get enough attention. It's not an earth-shaking vector but I think I can demonstrate an attack where none have been in the past.

But once I've done this, and I have (say) some demo code and a ten-page PDF, what would I do? How would I get this in front of people's noses? Could/should I just blast it off to some mailinglists and forget about it? I don't have much to my name (besides a few now-reported 0day) so I'm not sure I could start doing talks about it to the community, for example (although some youtube videos of demos might be useful?)

As I say, it isn't the next super-sexy sensation, but it is a new data exfiltration technique operating in a place which is currently overlooked.

Ideally, what I'd like out of it is better community awareness of attacks in this place, and another paragraph or two on the CV. Any ideas on how to get there from "I attacked X and got Y to happen"?

Answer 1

I can think of a few options.

1. You can try submitting it as a talk at a security conference or two. This is probably one of the best ways to get your research out there if it is semi interesting. Even if the topic isn't accepted for one of the main talks, many conferences have lightning talk sections where any attendees can go up and speak for a few minutes.

2. Publish the attack on your personal website/blog and submit it to r/netsec or Hacker News. This is pretty hit or miss though, there is no guarantee that people will see it due to the sheer volume on those sites.

3. Publish it on the Information Security Stackexchange blog! It is (relatively) high traffic, you can easily point to the blog post on a CV and you can guarantee that at least the regulars on the site will read it!

Answer 2

Terry Chia had indeed given a good number of options. Just to add something more - if you think what you have researched is indeed something novel, you can try approaching some journal for publishing the data. IEEE Computer Society's Technical Committee on Security and Privacy, ACM Transactions on Information and System Security can be a good some of the good places to look to. However, you might want to get a look into how other papers are (I mean it in a way that you should look into the content; research paper also have decent amount of statistical content about their findings. Also, these papers also tend to provide solutions to the problems they demonstrate. I hope you get what I am talking about.)

Answer 3

Some great approaches already suggested, here's my addition:

Given the average security researcher will often have a less typical academic background than researchers in other fields, it's sometimes necessary to use different approaches to getting stuff published, distributed, or otherwise just 'known' of. I haven't published any security research myself, but I have published other 'outsider' research in technical fields, and these are my useful tips:

• Conferences have been mentioned already. Worth noting is that just as there are big conferences like DefCon, BlackHat and so on, there are conferences specifically dedicated to the stuff that can't make it into the bigger confs. An example is Security B-sides, which runs conferences in the same cities as a few bigger confs, and tackles less high profile research. Doing smaller confs is a good gateway to doing bigger confs in future.

• Academics. If you aren't a published academic yourself (and most of us aren't) then why not speak to one? By their nature, academics are people who love an interesting new take on something, so phoning one at your local uni with your idea and asking to meet for a coffee can't hurt. It worked for me, again in a different arena than security.

• Hackerspaces are great for this kind of thing. If you've not come across them, HAckerspaces are local groups of people who meet and mess around with technology. Although they can't publish you, they can act as a decent pre-peer review to iron out any mistakes before you submit to anywhere else, and they can help develop your ideas further. They're also good fun.

Finally, good luck with this, nice to see people taking a decent interest in publishing their exploits in the wider arena.