Re: Disclosure of vulns and its legal aspects...

True, that might be a better idea, send everything you have found and
make no further contact.

Isn't it a great shame that we find it dangerous and difficult to
inform organisations that their security has holes in it? Why do they
immediately jump on the offensive and accuse the good Samaritan of
hacking? Just accept the information and make yourself more secure!
Simple.

I suppose that sometimes, they just don't deserve the help.





On 5/30/07, Steve Friedl <steve@xxxxxxxxxxx> wrote:
On Wed, May 30, 2007 at 09:14:39AM +0100, Lee Lawson wrote:
> I would personally create an anoymous email account and send them some
> information stating that you are a penetration tester that 'happened'
> upon a possible security flaw in their website, but because of the
> state of fear that some unenlightened organisations have about this
> type of situation, you wish to remain anonymous at this point. Then
> explain that if they are open to increasing the security of their
> website, you will gladly analyse the security flaw further and give
> them full disclosure, on the basis that you will be given written
> permission prior to continuing further.

I hardly think that "written permission" granted after what would be
received as an extortion attempt would be valid.

If you are really intent on helping the party that's insecure, then the
only quasi-safe way to do it is to send an anonymous report that has all
the details, shows them how to reproduce the issue themselves, and urge
them to contact their local security experts to have this looked at.

The ONLY CHANCE of having your message being taken seriously is if there
is no question about your motives, and the only way to attempt that is to
remove yourself from the loop once you've sent off the report. That means
no ongoing contact, no payment, no work. You leave it to them to fix.

Even this is no guarantee - the great majority of unsolicited security
reports is ignored even if presented clearly and with an unambiguous
message disclaiming any personal gain.

It's really just not worth the trouble.

Steve

---
Stephen J Friedl | Security Consultant | UNIX Wizard | +1 714 544-6561
www.unixwiz.net | Tustin, Calif. USA | Microsoft MVP | steve@xxxxxxxxxxx



--
Lee J Lawson
leejlawson@xxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------

Relevant Pages

  • RE: what to do it illegal activity found during pen-test
    ... My initial thought was report it to the police ... designated in the contract at the start of the engagement. ... email you encrypt it using the public key of the security contact given to ... managed service can help you: http://www.cenzic.com/news_events/wpappsec.php ...
    (Pen-Test)
  • Portcullis Advisory 05-006 Update, Webseries Payment Application
    ... Portcullis Security Advisory ... Bottomline acknowledge that there is a slight risk of exposure of data ... via unauthorised report generation. ...
    (Bugtraq)
  • Foot and Mouth. The truth for America
    ... Homeland Security released June 20. ... "If DHS believes Plum Island is truly going to be significantly safer, ... foot-and-mouth disease - facts noted in the Homeland Security report. ... The only scenarios described in the report where an outbreak could ...
    (uk.business.agriculture)
  • Malicious Code On Rise: Web Sites Responsible
    ... In the first quarter of 2007, security firm Sophos ... day infected with so-called malware. ... The report was released during InfoSec, ... Sophos reported that 70% of infected websites were legitimate sites ...
    (comp.dcom.telecom)
  • London The PC Zombie capital
    ... Get breaking Security news straight to your desktop - click here to ... taken from Symantec's Global Internet Threat Report ... Symantec reckons the likely cause of this rise is down to the rapid ...
    (uk.telecom.broadband)