[Full-disclosure] Re: Publishing exploit code - what is it good for

From: Thomas Reinke (reinke_at_securityspace.com)
Date: 06/30/05

  • Next message: John Madden: "[Full-disclosure] Re: Publishing exploit code - what is it good for" 
    Date: Thu, 30 Jun 2005 13:55:50 -0400
To: Aviram Jenik <aviram@beyondsecurity.com>

    > benefit of public exploit codes. Quote: " If I speak to an end-user
    > organization and they express legitimate needs for exploit code, then I'll
    > change my opinion."

    Heh...very close-minded to begin with. Good luck trying any
    argument with this "analyst".

    > Please note: I don't need any arguments pro or against full disclosure; all
    > this has been discussed in the past. I also don't need you to tell me about
    > someone else or some other project (e.g. nessus, snort) that utilizes these
    > exploits. Tried that. Didn't work.
    >
    > What I need is a security administrator, CSO, IT manager or sys admin that can
    > explain why they find public exploits are good for THEIR organizations. Maybe
    > we can start changing public opinion with regards to full disclosure, and
    > hopefully start with this opinion leader.
    >
    > TIA.
    >

    You may wish to point out to your "analyst" that end-user benefits
    are indirect How many times have we seen organizations attempt
    to sweep problems under the cover. This is an old, well understood
    reason for full disclosure. Now, how many times have their been
    arguments about "this is not a code injection exploit, only a DoS,
    so the customer impact is not severe, so we're delaying fixing this
    until release X.Y in 3 months time", only to find someone
    actually coded an exploit to prove that a vulnerability is fully
    exploitable.

    The end result: Exploit code, responsibly handled, serves the exact
    same purpose that vulnerability information disclosure serves: an
    accountability mechanism to ensure that Vendors do not attempt to
    bury information that they perceive to negatively impact their products
    and services. Thus, exploit code serves the customer by ensuring
    that vendors handle vulnerabilities promptly because the vendor is
    aware that exploits will likely be developed, and that the negative
    publicity of exploits running wild against their products outweigh
    the negative publicity of admitting (and fixing) a vulnerability.

    But, somehow, giving the attitude your analyst is conveying, I'd say
    more effort has been expended than is worthwhile.

    Thomas
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: John Madden: "[Full-disclosure] Re: Publishing exploit code - what is it good for"

    Relevant Pages

    • Re: BBO hand 8/25/2007...The Full Hand
      ... I cited a couple of specific expert sources what a two level overcall ... bidding 2D divided the net losses for bidding 2 diamonds is greater ... regardless of the source it is opinion. ... at equal vulnerability. ...
      (rec.games.bridge)
    • The only Truth in the Jewish Propaganda is their Protocols: 12
      ... The word "freedom," which can be interpreted in various ... The produce of publicity, which nowadays ... It is true that party organs might not spare money ... think they are repeating the opinion of a newspaper of their own ...
      (alt.religion.christian.roman-catholic)
    • Know Dy Wost Enemy, dig dis: 12d Protocol uh de Elders uh Zion (Judaism}
      ... The word "freedom," which can be interpreted in various ... The produce of publicity, which nowadays ... It is true that party organs might not spare money ... think they are repeating the opinion of a newspaper of their own ...
      (talk.origins)
    • KnowDy Wost Enemy, dig dis: 12d Protocol uh de Elders uh Zion (Judaism}
      ... The word "freedom," which can be interpreted in various ... The produce of publicity, which nowadays ... It is true that party organs might not spare money ... think they are repeating the opinion of a newspaper of their own ...
      (talk.origins)
    • Re: What IF
      ... > opinion is often quick to judge -- including me. ... > law enforcement takes a backseat to publicity stunts." ... wasn't the only thing they talk about anymore is his bad attitude. ... driving, speeding, running the stop sign and failing to pull over all go away! ...
      (rec.autos.sport.nascar)