[Full-disclosure] RE: Publishing exploit code - what is it good for

From: Morales, David (Seta) (David_Morales_at_onr.navy.mil)
Date: 07/01/05

  • Next message: securitynews: "Re: [Full-disclosure] plz suggest security for DLL functions" 
    Date: Fri, 1 Jul 2005 08:03:07 -0400
To: "Aviram Jenik" <aviram@beyondsecurity.com>, <full-disclosure@lists.grok.org.uk>, <bugtraq@securityfocus.com>

    Hi Aviram,

    I use this type of code to ensure that when patches are applied, it does
    not "break" any part of the OS and or application which has already been
    patched. Also I don't take anyone's word that a system has been patched
    or a security hole has been fixed without testing and re-certifying the
    application or the OS.
    Without the exploit code I would not be able to verify any of this and
    could very well leave my systems wide open.
    In a private sector company this code should be used in the same manner,
    to ensure compliance with SOX. To leave systems untested would be
    hanging your company out to dry.

    David Morales
    moraled@onr.navy.mil
    703-696-4022

    -----Original Message-----
    From: Aviram Jenik [mailto:aviram@beyondsecurity.com]
    Sent: Thursday, June 30, 2005 8:14 AM
    To: full-disclosure@lists.grok.org.uk; bugtraq@securityfocus.com
    Subject: Publishing exploit code - what is it good for

    Hi,

    I recently had a discussion about the concept of full disclosure with
    one of
    the top security analysts in a well-known analyst firm. Their claim was
    that
    companies that release exploit code (like us, but this is also relevant
    for
    bugtraq, full disclosure, and several security research firms) put users
    at
    risks while those at risk gain nothing from the release of the exploit.

    I tried the regular 'full disclosure advocacy' bit, but the analyst
    remained
    reluctant. Their claim was that based on their own work experience, a
    security administrator does not have a need for the exploit code itself,
    and
    the vendor information is enough. The analyst was willing to reconsider
    their
    position if an end-user came forward and talked to them about their own
    benefit of public exploit codes. Quote: " If I speak to an end-user
    organization and they express legitimate needs for exploit code, then
    I'll
    change my opinion."

    Help me out here. Full disclosure is important for me, as I'm sure it is
    for
    most of the people on these two lists. If you're an end-user
    organization and
    are willing to talk to this analyst and explain your view (pro-FD, I
    hope),
    drop me a note and I'll put you in direct contact.

    Please note: I don't need any arguments pro or against full disclosure;
    all
    this has been discussed in the past. I also don't need you to tell me
    about
    someone else or some other project (e.g. nessus, snort) that utilizes
    these
    exploits. Tried that. Didn't work.

    What I need is a security administrator, CSO, IT manager or sys admin
    that can
    explain why they find public exploits are good for THEIR organizations.
    Maybe
    we can start changing public opinion with regards to full disclosure,
    and
    hopefully start with this opinion leader.

    TIA. 

    -- 
Aviram Jenik
Beyond Security
http://www.BeyondSecurity.com
http://www.SecuriTeam.com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: securitynews: "Re: [Full-disclosure] plz suggest security for DLL functions"

    Relevant Pages