From: Jason Ross (algorythm@gmail.com)
Date: Thu May 11 2006 - 07:26:10 EDT
On 5/10/06, William Hancock <bill.hancock@isthmusgroup.com> wrote:
> In an article posted to slashdot today
> (http://it.slashdot.org/article.pl?sid=06/05/10/112259&from=rss) a man
> has been convicted of hacking when he casually and helpfully reported a
> security vulnerability to the owners of a web site, in this case The
> University of Southern California.
As I understand it (from the article), he did not report it to the
owners of the web site at all, rather, he sent it anonymously to a
journalist at SecurityFocus. SecurityFocus contacted the owners.
I am admittedly new to the security side of IT (officially anyway) but
in my opinion, that was a bad move on his part. Had he notified the
site owners directly, my guess is this would have gone a different
way. The fact that he made an anonymous report to SecurityFocus
instead is in itself a bit suspect in my opinion.
The article says "he made no effort to hide his tracks" which isn't
quite true if he's making an anonymous report. It makes me wonder if
there is more to this story than it seems, and whether perhaps the
person reporting the vulnerability had some form of a relationship
with the site owners.
(That said, it may be the case that he had contacted USC and gotten
nowhere with them, and then turned to SecurityFocus, in which case I'd
rethink my position. But based solely on what information is provided
in the article, I really don't have a lot of sympathy for him. )
> We should we, the good guys,
> who are paid for our knowledge and ability to exploit mistakes,
> oversights, and weaknesses then professionally report them to aid in the
> securing of information capital (or anyone who reports the flaw for that
> matter) worry about prosecution.
The key word there is "professionally". In this particular case (again
imo and based solely on the information available in the article) the
vulnerability was not handled in a professional manner at all.
I do have concerns that a number of laws that have already been passed
(and are currently being considered) will cause no end of potential
problems for security professionals. How to deal with that issue is
unfortunately not something I have an answer for. It really depends on
educating lawmakers about the issues involved, which is not likely to
be easy, as that implies an understanding of computing and network
technologies that is quite apparently lacking in the institutions we
rely on to make and enforce laws.
> We, as a or even The security community, should push
> corporations, governments, and organized body's to take responsibility
> and ownership of their problems.
agreed. But how one goes about 'pushing' is critical.
> If they publish a site that is flawed
> or exposing information then they are authorizing the retrieval of that
> information.
So, by this logic, if you leave your front door unlocked I am free to
come inside and rifle through your desk and take a picture of anything
I find interesting ?
> I'm not advocating that they laws should allow any jerk to
> try and brute his or her way in to a public or private web site, but
> come on.
How do you differentiate between 'any jerk' and a 'security
professional' over the internet ?
> If someone leaves their wallet in the park with no guard or protection,
> I pick it up and bring it back to the owner, the owner didn't want me to
> have it but I brought it back to him. Why in the hell should I have to
> go to jail for returning it to him, why should I/we be punished for
> doing the right thing?
But what if instead you took their wallet to the newspaper and said
"hey, check it out. John Doe is irresponsible and has left their
wallet laying around" and then the newspaper contacts John Doe and
says "we hear you're leaving valuable stuff out there for anyone to
pick up, what do you have to say about that" ... is that still the
right thing ?
> I acknowledge this to be a rant but there must but some way to insist
> that when people make something available to the public that it is their
> responsibility to safeguard it and appreciate not persecute someone who
> let's them know (for free I might add) that a weakness exists.
Again, how one goes about letting them know is critical.
> This is simple scapegoating, the University did something not advisable as a
> good practice and instead of owning up to it they villafied a
> professional pen-tester for offering valid advice.
I'm not sure I agree at all with this statement. One thing I am
curious about is how they traced it back to an individual? It's one
thing to get an IP address or such out of the web logs, but tracking
that back to an individual is not necessarily a trivial task.
Just my 2bits.
-- Jason Ross gpg key: 0xF80C38B6 ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request@cenzic.com for details. ------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:56 EDT