[Full-disclosure] RE: Publishing exploit code - what is it good for

From: Marvin Simkin (Marvin.Simkin_at_asu.edu)
Date: 06/30/05

  • Next message: KF (lists): "Re: [Full-disclosure] Publishing exploit code - what is it good for" 
    Date: Thu, 30 Jun 2005 13:02:43 -0700
To: Aviram Jenik <aviram@beyondsecurity.com>, full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com

    While performing penetration testing at the request of a Fortune 500
    financial services company, I discovered a vulnerability that, if
    abused, could have been used to initiate fraudulent funds transfers,
    stock market transactions, etc.

    The client was skeptical when told the exploit could occur in a matter
    of two or three seconds, go unnoticed by the victim, and gain such
    comprehensive unauthorized access. At the client's request, I wrote a
    proof-of-concept exploit that demonstrated everything except the final
    fraudulent action, but made it clear that exposure was only one more
    tiny step away. The client overcame their skepticism.

    While this particular exploit was not published, it shows a real-world
    "end-user organization [with] legitimate needs for exploit code"
    resulting in greater security for all customers of this organization.
    Another penetration tester in similar circumstances might be able to use
    or adapt a published exploit instead of writing a new one from scratch.

    Marvin Simkin
    http://simkin.asu.edu/

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: KF (lists): "Re: [Full-disclosure] Publishing exploit code - what is it good for"