Re: [Full-disclosure] To disclose or not to disclose

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Simon,
If the issue really involves critical infrastructure you can
expect(to an extent) many government and quasi-government
organizations to step in and pressure the vendor to fix the issue
before you go public. A real world example. At a recent conference,
I was talking to a security executive of a rather large utility and
the recently disclosed Citec issue came up. He mentioned that he
was at a certain government organizations lab while they were
assessing the issue based on the information they received from
CORE. If you read CORE's disclosure timeline, the real fire hadn't
been lit until this organization, along with some others, stepped
in and really got under the vendor's skin. He also mentioned how
clueless Citec's initial response was, but thats another story.
Given the general awareness of these organizations of the fact that
critical infrastructure vulnerabilities = potentially major
problems, I think setting a deadline(which will probably be
extended at the behest of these organizations) for the vendor is
not a bad idea, and the chances of the issue getting fixed before
you spill the beans are pretty high. You can't forget the
"somewhat" obvious as well, if you found it, someone else can find
it too. As far as the vendor is concerned, well, we all know what
happened to a certain electronic voting machine vendor...Look, I'm
not expert, this is just my .02...

elazar

On Sun, 28 Sep 2008 03:01:08 +0000 Simon Smith <simon@xxxxxxxxxxx>
wrote:
Elazar,
I suppose that could be a good action, but doing that would
potentially
put the security companies customer at risk. Granted, in the
argument
they were already notified of the risk. So the question is, is
that the
ethical choice? Is that a good business choice?


Elazar Broad wrote:
I would opt for #1, additionally, contacting CERT and other
quasi-
government security organizations would be a plus, they might
have
better luck lighting a fire under the theoretical vendors ass...

elazar

On Sat, 27 Sep 2008 03:39:34 +0000 Simon Smith
<simon@xxxxxxxxxxx>
wrote:
Greetings,
I have a theoretical question of ethics for other security
professionals that participate in this list. This is not an
actual
situation, but it is a potentially realistic situation that I'm
interested in exploring and finding an acceptable solution to.

Supposed a penetration testing company delivers a service to a
customer. That customer uses a technology that was created by a
third
party to host a critical component of their infrastructure. The
penetration testing company identifies several critical flaws
in
the
technology and notifies the customer, and the vendor.

One year passes and the vendor had done nothing to fix the
issue.
The
customer is still vulnerable and they have done nothing to
change
their
level of risk and exposure. In fact, lets say that the vendor
flat
out
refuses to do anything about the issue even though they have
been
notified of the problem. Lets also assume that this issue
affects
thousands of customers in the financial and medical industry
and
puts
them at dire risk.

What should the security company do?

1-) Create a formal advisory, contact the vendor and notify
them
of the
intent to release the advisory in a period of "n" days? If the
vendor
refuses to fix the issue does the security company still
release
the
advisory in "n" days? Is that protecting the customer or
putting
the
customer at risk? Or does it even change the risk level as
their
risk
still exists.

2-) Does the security company collect a list of users of the
technology
and notify those users one by one? The process might be very
time
consuming but by doing that the security company might not
increase the
risk faced by the users of the technology, will they?

3-) Does the security company release a low level advisory that
notifies
users of the technology to contact the vendor in order to gain
access to
the technical details about the issue?

4-) Does the security company do something else? If so, what is
the
appropriate course of action?

5-) Does the security company do nothing?

I'm very interested to hear what people thin the "responsible"
action
would be here. It appears that this is a challenge that will at
some
level create risk for the customer. Is it impossible to do this
without
creating an unacceptable level of risk?

Looking forward to real responses (and troll responses too...
especially
n3td3v).

--

- simon

----------------------
http://www.snosoft.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

--
Self Storage Options - Click Here.
http://tagline.hushmail.com/fc/Ioyw6h4eNgR1BRhFB3CXCR61VEtfAqJ45ZV3
4qDMKcjsXBCGM0kWG5/



--

- simon

----------------------
http://www.snosoft.com
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQECAAYFAkjfxMEACgkQi04xwClgpZjClAP/frm/enc7E52FjvW7QWhEbtZCJ8Kr
/PM1o20qCZV9RdwP8IJhfbg3aF4ko3VrJcsFTuHSp5w5Pi4O/k6l3Vggak3cRlejN26q
9nIjHl8C0V4KaismHL5cXS7OZKyDFI9uMnw/Mpmao5bF7+jxdo1qK6nnrBawojtRwifg
tjJTQic=
=OqUn
-----END PGP SIGNATURE-----

--
Hotel pics, info and virtual tours. Click here to book a hotel online.
http://tagline.hushmail.com/fc/Ioyw6h4eRClAkcJxO5raG2q61I2CHdEok8REye7AsAlE6A964lyJ9u/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • [Full-disclosure] To disclose or not to disclose
    ... That customer uses a technology that was created by a third ... One year passes and the vendor had done nothing to fix the issue. ... level of risk and exposure. ... refuses to fix the issue does the security company still release the ...
    (Full-Disclosure)
  • RE: the "why" of tiered pricing (Was RE: Using Java in batch on z/OS?)
    ... the "right" way to charge more IMHO is to charge ... Someone, either the software vendor or the customer, is ... How to account for the transactions in a non-intrusive, ...
    (bit.listserv.ibm-main)
  • Re: It takes two to tango
    ... great nation was founded with freedom in mind, and this freedom is what we ... likely going to reproduce it so the vendor should be able to reproduce it). ... ASSUME the risk of making any information public. ... which melted the CPU onto the motherboard causing a downtime of 4 hours. ...
    (Bugtraq)
  • Re: One for the legal eagles...
    ... Even with a stop payment, ... >> If a merchant loses a check, is the customer responsible to reissue ... >> Assume that the customer and merchant have some bad blood; ... > either your vendor or whoever finds it might still cash it. ...
    (rec.outdoors.fishing.fly)
  • Re: Decompiler.NET reverse engineers your CLS compliant code
    ... > much of a risk that you may get hit by a bus tomorrow and won't need the ... of becoming useless in the unfortunate case that the vendor dissappears. ... >> with that kind of licensing. ... It does nothing to keep prices low ...
    (microsoft.public.dotnet.languages.vb)